Vulnerabilities
Curated coverage and analysis in this editorial area.
VMware Workstation: VMXNET3 Bug with CVSS 9.3 Breaks Hypervisor Isolation
CVE-2026-59346: An integer overflow in the VMXNET3 driver allows code execution on the physical host by anyone controlling a guest VM.…
GIMP: RCE Flaw in PSP Files Discovered, Update Available
The CVE-2026-4153 vulnerability in GIMP's PSP file parsing allows arbitrary code execution via an integer overflow. The CVSS 7.8 ratin…
CVE-2026-19780: RCE in Koha Puts Library Management Systems at Risk
An eval code injection flaw in the open-source Koha library system enables authenticated remote code execution. CVSS 8.8, patched acro…
SAP Patches OVERPASS: Maximum-Severity Kernel Bug Opens ERP Systems to Unauthenticated RCE
SAP released the September 2026 patch for CVE-2026-44756, a maximum-severity kernel vulnerability that allows unauthenticated remote c…
Telerik UI: Public RCE Exploit Turns Encryption Key Into a Weapon
TantoSec released a full exploit chain for Telerik UI for ASP.NET AJAX. The explicit encryption key, recommended as a hardening measur…
StyleSmuggler Hits Magento: Unpatched RCE, Stores Already Compromised
StyleSmuggler is an unauthenticated zero-day RCE in Magento and Adobe Commerce, actively exploited since September 4, 2026. Adobe has…
Dirty Frag: The Linux Kernel Bug That Bypasses Every Container Scanner
Dirty Frag exploits three CVEs in the Linux kernel to corrupt the page cache and gain root. The problem isn't in Docker images—it's in…
The 12-Step KEV Workflow Pushes Companies Toward 24-Hour Patching, But the Regulation Doesn't
Tech-insider.org has published a 12-step operational workflow for managing CISA's Known Exploited Vulnerabilities (KEV) catalog. The 2…
HPE Patches Two Critical RCE Flaws in ArubaOS-CX: Structural Technical Debt
HPE released patches on September 1, 2026 for 34 vulnerabilities in the ArubaOS-CX (AOS-CX) platform, the operating system powering en…
Plex Demands Urgent Update: Patches Before CVEs, Admins Left in the Dark
Plex urged users to immediately update Plex Media Server and Plex Desktop between September 1 and 3, 2026, without publishing the CVE…
ZDI-26-614: 0-day in PDF Architect Enables Remote Code Execution
The Zero Day Initiative published advisory ZDI-26-614 on August 31, 2026, detailing a 0-day vulnerability in the pdfforge PDF Architec…
Honeypot Confirms Active Exploitation of Sangoma Switchvox RCE
CVE-2026-9586 affects roughly 4,000 internet-exposed Switchvox systems. Defused Cyber honeypots recorded in-the-wild exploitation with…