VULNERABILITY TRACKER

A long‑standing bug in the Squid proxy (dubbed “Squidbleed”) can leak full HTTP request data to unauthenticated observers, posing a compliance risk for SOC 2 controls around data in transit and log protection.

Zimbra patched a critical stored XSS vulnerability in its Classic Web Client (v10.1.19) that could let malicious emails execute code and steal mailbox data. The flaw highlights the need for rapid patching and evidence‑dr…

Wiz researchers showed that six AI coding assistants can be duped into writing to privileged files like SSH keys while showing a harmless‑file name in the approval dialog. The flaw highlights a control‑gap that SOC 2 aud…

Binarly researchers disclosed six U‑Boot vulnerabilities that can crash devices or let attackers run code before the OS loads. The issue highlights the need for firmware‑integrity controls and SOC 2‑ready evidence of sec…

A critical authentication bypass (CVE-2026-20896) in the official Gitea Docker image enables attackers to impersonate any user, including admins, by exploiting default reverse‑proxy settings. This highlights the need for…

Researchers disclosed three high‑severity OpenClaw AI assistant vulnerabilities that could be chained to steal credentials, elevate privileges, and run arbitrary code. The issues highlight the need for continuous control…

A coding error in Alibaba’s XQUIC QUIC/HTTP‑3 library lets any remote client crash a server with a short burst of legitimate traffic, exposing a denial‑of‑service risk. For SOC 2‑ready organizations, the incident undersc…

Zimbra disclosed a stored XSS vulnerability in its Classic Web Client that can steal session data when a malicious email is opened. The flaw underscores the need for robust SOC 2 access‑control and patch‑management evide…

Google issued back‑to‑back Chrome updates that close 27 security flaws, two of them critical use‑after‑free bugs. The rapid patch cycle illustrates why SOC 2‑ready organizations must maintain documented, continuously‑mon…

Researcher Nightmare‑Eclipse disclosed CVE‑2026‑50656, a race‑condition privilege‑escalation flaw in Microsoft Defender that can yield a system‑level shell. The vulnerability underscores the need for robust patch‑managem…

Insikt Group reported 60 high‑impact CVEs for June 2026, including 23 listed in CISA’s KEV catalog. The breadth of affected vendors underscores the need for continuous vulnerability management as a SOC 2 control.

A researcher released a PoC for a critical Windows Defender vulnerability (RoguePlanet) that enables remote code execution. The flaw impacts any Windows 10/11 endpoint with Defender enabled, making it a prime SOC 2 contr…

Cisco Talos reported 18 new vulnerabilities affecting WolfSSL, GeoVision, and VTK‑DICOM, all of which have been patched. The breadth of flaws underscores the need for continuous control mapping and audit‑ready evidence i…

A hidden backdoor (CVE‑2026‑11405) in Tenda router firmware grants unauthenticated administrative access, and researchers have observed active exploitation. The flaw bypasses standard login checks, enabling full device a…

A newly disclosed Windows Defender flaw (CVE‑2026‑50656) lets authenticated attackers gain SYSTEM privileges on Windows 10/11. The vulnerability is patched, but compliance teams must prove timely remediation to satisfy S…

OpenPLC Runtime v3 allows an authenticated attacker to write arbitrary files via its web UI, leading to native code execution. For SOC 2‑ready organizations, the flaw highlights a control‑mapping gap that must be documen…

Schneider Electric PowerChute Serial Shutdown versions ≤1.4 contain a path‑traversal and several input‑validation bugs (CVE‑2026‑2399) that could let attackers overwrite files, inject log data, or cause denial‑of‑service…

Microsoft released an update that fixes CVE‑2026‑50656, an elevation‑of‑privilege bug in Defender that could let a standard user obtain SYSTEM rights. The fix underscores the need for continuous patch‑management evidence…

Wiz identified symlink vulnerabilities in the GhostApproval component of leading AI coding assistants that can bypass approval checks and write to arbitrary files, potentially exposing sensitive code or credentials. For …

Microsoft disclosed CVE‑2026‑50656, a race‑condition flaw in the Malware Protection Engine that allows local attackers to obtain SYSTEM‑level privileges. The vulnerability underscores the need for robust access‑control m…

Microsoft released patches for the RoguePlanet flaw (CVE‑2026‑50656), a privilege‑escalation bug in Defender’s mpengine.dll that can grant SYSTEM privileges. The CVSS score is 7.8. For SOC 2‑compliant organizations, time…

Unauthenticated Flaw Allows Full Router, Network Takeover A hidden backdoor, disclosed by CERT/CC and found in multiple firmware versions made by Chinese manufacturer Tenda, bypasses authentication and could grant attac…

Microsoft released a patch for CVE‑2026‑50656, a Defender race‑condition that grants SYSTEM privileges on Windows 10/11. The fix is a core SOC 2 audit requirement for endpoint security and continuous compliance.

Researchers proved that Anthropic’s Claude Code and OpenAI’s Codex can be tricked into executing malicious code when run in autonomous mode. The flaw highlights the need for robust third‑party risk and SOC 2 controls aro…

Wiz researchers uncovered a symlink vulnerability in six AI coding assistants that can redirect benign file edits to sensitive system files, enabling arbitrary code execution on developers' machines. The issue highlights…