VULNERABILITY TRACKER

Drupal released patches for two critical RCE vulnerabilities that can be exploited without authentication. Organizations must patch promptly to maintain a defensible audit trail and meet control‑assurance requirements.

CISA placed CVE‑2025‑61624 (Fortinet) and CVE‑2026‑102764 (BeyondTrust) into its KEV catalog after confirming active exploitation. The flaws illustrate why continuous vulnerability‑management and auditable patch evidence…

A newly disclosed template‑engine injection (CVE‑2026‑103849) allows arbitrary PHP execution on Magento and Adobe Commerce servers. The flaw underscores the need for continuous patch management and verifiable evidence of…

Security researchers published a PoC that combines a decades‑old integer overflow with a newer kernel flaw to obtain root on OpenBSD 7.9, bypassing KASLR, SMAP and SMEP. The finding underscores the need for continuous OS…

Noma Labs discovered a high‑severity flaw in Anthropic’s Claude Code Desktop that lets crafted HTML files steal stored developer API keys and tokens. The issue highlights the importance of robust access‑control and crede…

CISA warns that a critical authentication‑bypass vulnerability (CVE‑2026‑102764) in self‑hosted BeyondTrust Remote Support is being actively exploited. Organizations must patch, restrict network access, and collect foren…

A use‑after‑free flaw (CVE‑2026‑93536) in X.Org Server allows a local attacker with low‑privileged code execution to read sensitive memory and potentially achieve root privileges. The issue underscores the need for conti…

LibreOffice’s PDF parser contains a heap‑based buffer overflow (CVE‑2026‑63274) that can be triggered by a malicious PDF, allowing remote code execution. The flaw underscores the need for continuous vulnerability‑managem…

A use‑after‑free bug in the FreeBSD kernel (CVE‑2026‑58093) allows low‑privileged users to gain kernel‑level rights. The flaw underscores the importance of continuous vulnerability monitoring and documented patching for …

LibreOffice’s PDF parser suffers an out‑of‑bounds write that enables remote code execution when a malicious PDF is opened. The flaw (CVE‑2026‑63273) scores 7.8 CVSS and has been patched. Organizations must prove timely p…

LibreOffice disclosed CVE‑2026‑6045, an integer‑overflow flaw in its EMF+ image parser that can lead to arbitrary code execution when a victim opens a crafted ODT file. The vulnerability underscores the need for robust v…

A newly disclosed XXE vulnerability (CVE‑2026‑88794) in Sparx Systems Enterprise Architect’s XSLT Debugger can leak sensitive data when a user opens a crafted file. The issue underscores the importance of continuous thir…

Threat actors are exploiting CVE‑2025‑61624 in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager to drop the PEERSTITCH malware family. The flaw allows path traversal that bypasses VPN session tagging, highlighting th…

A command‑execution flaw in Collabora Online’s built‑in CODE Server app (CVE‑2026‑110447) is being exploited to install web‑shells on Nextcloud servers, exposing password stores and crypto wallets. The incident highlight…

A newly disclosed Linux kernel flaw (CVE‑2026‑99999) enables code inside a virtual machine to read host memory. The issue undermines tenant isolation, a core control for audit and compliance programs.

CISA added four high‑severity CVEs affecting Palo Alto firewalls, Cisco Secure Email Gateway, and AhsayCBS backup software to its Known Exploited Vulnerabilities catalog. Exploitation is confirmed, underscoring the need …

Google released Chrome 155 updates fixing 37 security issues, seven critical, such as CVE‑2026‑110152 (buffer overflow) and two PDF use‑after‑free bugs. The fixes highlight the need for disciplined vulnerability‑manageme…

NGINX released versions 1.30.6 and 1.31.7 fixing five vulnerabilities—three memory‑corruption bugs that could enable code execution and a TLS flaw that may skip client‑certificate checks. Organizations must patch quickly…

Next.js released an emergency update fixing two critical unauthenticated RCE vulnerabilities in React Server Components and the librsvg library used via sharp. The flaws expose web applications to remote code execution, …

Eclipse Milo versions 0.6.0‑1.1.4 contain five critical flaws that allow credential theft, data deletion, impersonation, or DoS. The issue highlights the need for robust access‑control assurance and audit‑ready evidence …

Thermo Fisher’s Torrent Suite Software ≤ 5.18 is vulnerable to a path‑traversal flaw (CVE‑2026‑107777) that lets authenticated users read arbitrary files. The issue underscores the need for rigorous third‑party patch man…

J4Care’s dcm4chee‑arc‑light 5.35.1 contains six CVSS 9.1 flaws that let attackers delete, overwrite, or forge DICOM studies and expose patient data. The gaps highlight the need for robust authorization controls and audit…

CISA warns that three critical CVEs in Guangzhou Juan IoT’s EseeCloud app and firmware allow attackers to log in with hard‑coded credentials and manipulate device settings, potentially compromising cameras used in energy…

CISA has listed CVE‑2026‑21589, a vulnerability that lets unauthenticated actors read files on Atlassian tools, in its Known Exploited Vulnerabilities catalog. The addition signals a high‑risk, actively exploited flaw th…

CISA Malcolm versions ≤ 26.07.1 and ≤ 26.08.0 contain six high‑severity vulnerabilities that enable authentication bypass, SSRF, and data amplification. Organizations using Malcolm must patch and verify access‑control en…