Debug Flaw in Microsoft Android Apps Exposes Billions to Risk
A single code setting bypassed protections exposing billions of Microsoft Android app downloads; immediate review of token/access handling recommended.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesWednesday, June 3
Google's June Android Update Tackles Exploited Zero-Day and Over a Hundred Vulnerabilities
Google Android patches address a exploited zero-day plus 123 other flaws; prioritize devices exposed to internet or corporate networks.
Oracle WebLogic Vulnerability Exploited Two Years After Patch
Active exploitation of a two-year-old WebLogic vulnerability highlights persistent middleware risk. Patch guidance and KEV-aligned advisories are essential.
Monday, June 1
Critical Zero-Day in Gogs Allows Remote Code Execution
PremiumAuthenticated pull-request variant enables remote code execution. Apply upstream patches and restrict PR flows.
Google Chrome 148 Update Fixes 151 Vulnerabilities, Urgent Update Recommended
PremiumChrome 148 patches 151 vulnerabilities, including critical RCE flaws. Urge immediate browser updates across endpoints.
Urgent Patch Needed: PAN-OS Vulnerability Under Attack
PremiumActive exploitation of PAN-OS auth bypass CVE-2026-0257. Exploit can enable remote access without authentication; prioritize patching and access control.
Friday, May 29
FortiClient EMS Vulnerability Exploited to Deploy EKZ Infostealer Malware
PremiumActive exploitation of FortiClient EMS; apply hotfixes and verify endpoint integrity to prevent credential theft.
Severe Gogs Vulnerability Allows Code Execution by Authenticated Users
PremiumHigh-severity RCE in Gogs; patch and rotate credentials; monitor exploit attempts and review access controls.
Wednesday, May 27
Critical Security Flaw in SharePoint Server Requires Immediate Attention
Microsoft SharePoint Server remote code execution vulnerability disclosed and patched as CVE-2026-45659.
Urgent Patch Required for Active Exploitation of Drupal Vulnerability
SQL injection vulnerability in Drupal actively exploited; federal guidance to patch promptly.
Monday, May 25
Ghost CMS Vulnerability Exploited in Widespread Cyber Campaigns
PremiumGhost CMS CVE-2026-26980 is being exploited at scale to inject malicious scripts. Apply vendor patches and monitor sites.
Trend Micro Patches Critical Vulnerability in Apex One Systems
PremiumApex One on-premise systems are under active exploitation for CVE-2026-34926. Patch immediately to reduce risk.
Friday, May 22
Wednesday, May 20
Critical NGINX Vulnerability Poses Denial-of-Service Risk
High-severity vulnerability in NGINX-related stack exposed services to DoS; ensure patches are applied and traffic is filtered from untrusted sources.
Critical ChromaDB Flaw Risks Server Takeover Without Patch
A critical unpatched vulnerability in ChromaDB allows unauthenticated attackers to execute code and take control exposed servers. Patch and rotate credentials immediately.
Monday, May 18
Critical Vulnerability in Open WebUI Puts AI Workspaces at Risk
PremiumA stored XSS flaw in Open WebUI allows 1-click remote code execution when uploading a profile image. Patch status and mitigations required to protect AI workspaces.
Critical Vulnerability in Fortinet's FortiSandbox Exposes Enterprise Networks
PremiumFortinet disclosed a critical remote code execution flaw in FortiSandbox (CVE-2026-26083) requiring urgent patching to prevent unauthenticated code execution. Prioritize affected deployments.
Microsoft's May 2026 Patch Tuesday Addresses 120 Vulnerabilities Across Critical Systems
PremiumMicrosoft released a broad May 2026 Patch Tuesday covering 120 vulnerabilities across Windows, Azure, and Office, including 29 critical RCE flaws. Patch management is essential to reduce exposure.
New Exploit Exposes Windows Vulnerability, Urgent Patch Advised
PremiumPoC demonstrates SYSTEM-level privilege escalation on patched Windows; rapid patching recommended.
Urgent Mitigations Released for Microsoft Exchange Zero-Day Vulnerability
PremiumMicrosoft issues mitigations for a high-severity Exchange Server zero-day (CVE-2026-42897) exploited in the wild. Install mitigations promptly.
Get these articles delivered to your inbox.
Subscribe free