VULNERABILITY TRACKER

Two high‑severity authentication bypass flaws in the miniOrange SAML WordPress plugin are actively exploited, allowing unauthenticated attackers to assume any admin account. The issue highlights the need for robust SOC 2…

ZoneMinder versions 1.37.48 and 1.38.3 contain an authenticated OS‑command injection (CVE‑2026‑76060) that can give an attacker full remote code execution. The flaw highlights why SOC 2 access‑control and patch‑managemen…

CISA has listed CVE‑2026‑60004, a remote code‑injection bug in Gitea, in its Known Exploited Vulnerabilities catalog after observing active attacks. Organizations must prioritize remediation to satisfy SOC 2 vulnerabilit…

A CISA advisory reveals CVE‑2026‑73125, a critical authentication bypass in Ebyte NE2‑D11 gateways used in manufacturing and energy. The flaw enables unauthenticated remote access to admin functions, underscoring the nee…

PayRange’s API (all versions) lacks proper authorization on management endpoints, allowing unauthenticated attackers to view device inventories, alter device state, or cause denial‑of‑service. The issue highlights a SOC …

A missing authentication check in the Node‑RED HTTP interface of Siemens SIMATIC IoT2050 Advanced devices allows unauthenticated attackers to upload malicious flows and execute code with system privileges. The flaw (CVE‑…

Rently Smart Home versions ≤ 20.1.0 are vulnerable to CVE‑2026‑75960, an insufficiently protected credentials flaw that could expose master PINs and bypass user permissions. The issue highlights the need for strong crede…

A CISA advisory reports that the FURUNO FA‑50 Class B AIS transponder contains hard‑coded credentials and no authentication for its settings screen (CVE‑2026‑59769, CVSS 9.1). An attacker with access to the vessel’s inte…

The Bendix EC80 series Brake ECU is vulnerable to CVE‑2026‑67560, a stack‑based buffer overflow that enables remote code execution and CAN‑bus traffic injection. Exploitation could disable ABS, steering assist, speedomet…

CVE‑2026‑73570 allows unauthenticated attackers to run OS commands on Zimbra mail servers with the optional SNMP package enabled. Over 270 internet‑facing instances have been compromised, highlighting the need for rapid …

CISA has added Oracle HTTP Server and WebLogic Proxy Plug‑in vulnerability CVE‑2026‑21962 (CVSS 10.0) to its Known Exploited Vulnerabilities catalog. The flaw allows remote code execution without credentials, prompting i…

The miniOrange SAML 2.0 SSO plugin for WordPress contains an unauthenticated authentication‑bypass (CVE‑2026‑61979, CVSS 8.1) that lets attackers log in as any user, including administrators. For SOC 2‑compliant organiza…

Oracle WebLogic Server and Oracle HTTP Server contain a CVSS 10.0 remote‑code‑execution flaw (CVE‑2026‑21962) that is being actively exploited in the wild. For SOC 2‑compliant organizations, the incident highlights the n…

Slovakia’s cybersecurity watchdog found a hidden SMS‑activated backdoor in 279 NERO R‑ONE traffic cameras, allowing remote control without authentication. The flaw highlights supply‑chain risk and underscores the need fo…

ShieldBreak (CVE‑2026‑69414) lets a low‑privilege attacker gain SYSTEM rights on Windows 11 25H2 and Server 2025 via Microsoft Defender. No patch exists, so organizations must detect and mitigate now—an urgent SOC 2 acce…

A post‑authentication SQL injection in ProFTPD’s mod_sql module (CVE‑2026‑42167) enables remote code execution on servers using a PostgreSQL backend. The flaw underscores the need for robust change‑management, continuous…

Zimbra Collaboration Suite versions prior to the latest patch contain CVE‑2026‑73570, a critical flaw that enables unauthenticated full mailbox takeover. The vulnerability is being actively exploited, prompting a three‑d…

A flaw in Calix GS7 XGS routers (CVE‑2026‑75501) lets attackers create permanent port‑forwarding rules without authentication, exposing internal devices. The vulnerability highlights the need for continuous control‑mappi…

Researchers disclosed two auth‑bypass flaws in the miniOrange SAML SSO WordPress plugin that let attackers forge SAML responses and gain admin sessions. The issue highlights the need for robust SOC 2 access‑control evide…

CISA announced that CVE‑2026‑21962, an improper access‑control bug in Oracle HTTP Server and WebLogic proxy plug‑in, is now listed in the Known Exploited Vulnerabilities catalog, indicating active exploitation. The vulne…

A newly disclosed vulnerability in Red Hat Keycloak (CVE‑2026‑18963) enables unauthenticated attackers to force password resets and take over any user account. The flaw scores 9.1 on CVSS, making it a top priority for SO…

CISA has mandated U.S. federal agencies patch Zimbra Collaboration Suite (CVE‑2026‑73570) after confirming active exploitation. The flaw enables unauthenticated remote code execution, underscoring the need for documented…

A critical out‑of‑bounds write in libwebsockets’ HTTP/2 HPACK path header parsing (CVE‑2026‑19773) enables unauthenticated remote code execution. The flaw affects any product embedding the library, making timely patching…

Foxit PDF Reader contains a use‑after‑free flaw (CVE‑2026‑13129) that can disclose information when a crafted PDF is opened. Scoring 3.3 (Low) and requiring user interaction, the vulnerability highlights the need for rob…

OriginLab’s Origin Viewer contains a CVE‑2026‑19885 out‑of-bounds write that can lead to remote code execution when a malicious OGWU file is opened. The flaw scores 7.8 (High) and is fixed in version 10.4.0.25. For SOC 2…