VULNERABILITY TRACKER

Citrix disclosed CVE‑2026‑107406, a critical memory‑overflow flaw in NetScaler ADC and Gateway that can enable remote code execution when the appliance acts as a SAML IdP/SP. The vulnerability underscores the importance …

Citrix NetScaler ADC and Gateway appliances configured as SAML IdP/SP contain critical RCE flaws (CVE‑2026‑19490, CVE‑2026‑88771, CVE‑2026‑88779, CVE‑2026‑88772). The issue underscores the need for continuous vulnerabili…

Researchers have published a functional exploit for a pre‑authentication remote code execution flaw in AnyDesk's Linux client that provides root access. The vulnerability highlights the need for robust vulnerability‑mana…

AhsayCBS backup software contains an authentication bypass (CVE‑2026‑105133) that attackers are exploiting to install XMRig miners disguised as Microsoft Edge. The flaw underscores the importance of robust authentication…

SonicWall’s SMA1000 series (models 6210, 7210, 8200v) contain a maximum‑severity SSRF/RCE flaw (CVE‑2026‑102255) that attackers are already probing. The issue underscores the need for robust access‑control, rapid patchin…

A high‑severity flaw (CVE‑2026‑47483) in NVIDIA’s DCGM Exporter lets anyone on the Internet send crafted requests that crash the metrics service, exposing GPU inventory and potentially halting AI workloads. The issue und…

Flax Typhoon is weaponising CVE‑2015‑3306, a critical improper‑access‑control bug in ProFTPD that grants unauthenticated file‑system access. Organizations must patch and prove control‑area compliance to satisfy audit exp…

The FBI alerts that the FortiBleed (CVE‑2022‑42475) vulnerability continues to be weaponized, with more than 86,000 FortiGate firewalls reported compromised. The episode underscores the need for continuous vulnerability…

Citrix disclosed CVE‑2026‑107406, a memory‑overflow flaw in NetScaler ADC/Gateway that can enable RCE or DoS when the device is configured as a SAML SP/IdP. The high CVSS score underscores the need for rapid patching and…

A cryptographic flaw in the GoBalance tool allows attackers to recover the private key that defines a hidden‑service .onion address, enabling full site takeover. This highlights the need for robust key‑management and con…

Citrix disclosed CVE‑2026‑107406, a memory‑overflow RCE flaw affecting NetScaler ADC and Gateway when used as SAML IdP/SP. The vulnerability underscores the need for continuous patch management and audit‑ready evidence o…

Citrix disclosed CVE‑2026‑107406, a memory‑overflow bug in NetScaler ADC and Gateway that can enable remote code execution or denial‑of‑service under certain configurations. The flaw underscores the importance of continu…

A newly disclosed vulnerability in AWS Bedrock AgentCore lets an attacker use one crafted AI prompt to take over every agent in an organization’s AWS environment. The flaw underscores the need for continuous AI‑service m…

Cisco disclosed five critical CVEs affecting Nexus 3000 and 9000 switches that allow arbitrary code execution with root privileges or forced reload when NX‑API, NGOAM, or MPLS OAM are active. The flaws underscore the nee…

Seven critical vulnerabilities in Red Lion N‑Tron 700 series switches allow unauthenticated admin access, configuration tampering, and scripted reboot loops. The flaws expose gaps in authentication and change‑management …

CISA reports six CVEs (CVSS 9.8) in openPDC and openHistorian that enable unauthenticated attackers to execute arbitrary code or perform SSRF. The flaws test the control objective of secure software lifecycle management,…

Satel Netco Design versions before v2.1.7 contain a stored cross‑site scripting flaw (CVE‑2026‑105269) that lets a privileged network operator inject malicious web content. Exploitation can lead to script execution, file…

A CVSS 9.3 path‑traversal bug (CVE‑2026‑21589) affecting multiple Atlassian Data Center applications is being actively exploited to read sensitive files. Enterprises must patch, tighten access controls, and capture evide…

ProFTPD versions before 1.3.5a allow unauthenticated attackers to read or overwrite arbitrary files via FTP commands. The flaw underscores the need for auditable access‑control evidence and continuous monitoring to satis…

A path traversal flaw in ONLYOFFICE Docs (CVE‑2021‑3199) allows an attacker to embed a '..' sequence in an image‑upload request, bypassing JWT checks and potentially executing arbitrary code on the server. The vulnerabil…

Strapi’s CMS stores user details in cleartext, allowing anyone with admin‑panel access to read them. The issue also enables a chain to remote code execution, highlighting the need for encryption‑at‑rest controls and audi…

Apache Struts versions with Dynamic Method Invocation enabled are vulnerable to a command‑injection flaw (CVE‑2016‑3081) that can lead to remote code execution. The issue highlights the need for continuous vulnerability …

A data‑processing error in ISC BIND can be triggered by malicious TKEY queries, causing the DNS service to crash. The issue highlights the need for continuous patch management and auditable evidence of service‑availabili…

Cisco Talos disclosed seven new CVEs affecting Adobe, Apple, Foxit, and Microsoft products; patches are available. The findings underscore the need for continuous vulnerability management and auditable patch‑deployment e…

SonicWall disclosed a CVSS 10.0 pre‑authentication SSRF vulnerability (CVE‑2026‑102255) affecting SMA1000 models, enabling unauthenticated attackers to reach internal functions. The flaw underscores the need for continuo…