WordPress has remediated a reflected cross-site scripting vulnerability in the login interface (wp-login.php) affecting all releases.

Broadcom has released security updates addressing five vulnerabilities affecting VMware ESX, vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and related Telco Cloud products.

Researchers have identified two vulnerabilities in WordPress Core dubbed ‘wp2shell’ which, when, chained together, can allow unauthenticated attackers to gain remote code execution on default WordPress installations.

A flaw in the Linux kernel lets any user with an ordinary, non-privileged login take complete control of the system as root. No special permissions or unusual configuration are needed.

On July 21, 2026, F5 disclosed and patched CVE-2026-42533, a critical-severity heap-based buffer overflow vulnerability affecting various versions of NGINX.

Zoom has released fixes for a critical vulnerability, tracked as CVE-2026-53412 (CVSS 9.8), affecting the Zoom Workplace desktop client for Windows, the Zoom VDI Client for Windows, and the Zoom Meeting SDK for Windows.

Critical Microsoft SharePoint Server vulnerabilities may allow privilege escalation, authentication bypass and remote code execution. Affected systems should be patched immediately.

On May 7, 2026, security researcher Hyunwoo Kim (@v4bel on GitHub) published a technical report detailing Dirty Frag, a Linux local privilege escalation (LPE) vulnerability class.

We’ve been notified of this local privilege escalation vulnerability, in Linux kernel 4.14 (introduced in 2017), that affects most flavours of Linux.

A critical unauthenticated Remote Code Execution (RCE) vulnerability has been identified in the Ninja Forms – File Uploads extension for WordPress.

Qualys Threat Research Unit (TRU) disclosed a set of nine vulnerabilities in Linux AppArmor, collectively named "CrackArmor".

In late January 2026, security researchers at DepthFirst discovered a flaw in OpenClaw – formerly known as Moltbot and Clawdbot – only a few months after the platform’s rapid rise in popularity.

Multiple NPM packages were compromised in late 2025 through account takeovers and malicious code injections.

A critical remote code execution vulnerability (CVE-2025-55182) has been found in React Server Components and in widely used frameworks such as Next.js.

On October 24, 2025, Microsoft published an out-of-band security update to a critical vulnerability in the Windows Server Update Service (WSUS).

A major security advisory was recently issued for Dell laptops, affecting millions of devices across more than 100 Latitude and Precision models.

CanSSOC became aware of a critical Remote Code Execution (RCE) vulnerability in Apache Tomcat, tracked as CVE-2025-24813.

The Stratascale Cyber Research Unit (CRU) team has identified two vulnerabilities in the Sudo utility. These vulnerabilities can result in the escalation of privileges to root on the impacted system.

The “AirBorne” vulnerability is a serious zero-click, remote code execution (RCE) exploit affecting Apple AirPlay-enabled devices.

CanSSOC became aware of a critical Remote Code Execution (RCE) vulnerability in Apache Tomcat, tracked as CVE-2025-24813.

A newly discovered critical vulnerability in Kibana, identified as CVE-2025-25012, exposes organizations to the risk of arbitrary code execution through prototype pollution.

Zero-day vulnerabilities in VMware products allow attackers with administrative privileges on a virtual machine to escape the VM sandbox and gain unauthorized access to the hypervisor, posing a significant risk to enterprise environments.

A critical authentication bypass vulnerability has been discovered impacting the WordPress plugin ‘Really Simple Security’ (formerly ‘Really Simple SSL’), including both free and Pro versions.

On October 23rd, Fortinet published an advisory related to a critical FortiManager API vulnerability, tracked as CVE-2024-47575 (CVSSv3: 9.8). The vulnerability was exploited in zero-day attacks to steal sensitive files containing configurations, IP addresses, and credentials for managed devices.

Microsoft has released its October 2024 patch Tuesday updates, addressing 118 vulnerabilities including 5 zero-day vulnerabilities from which 2 are actively exploited.

On September 26th, a set of vulnerabilities in multiple components of the Common UNIX Printing System (CUPS) open-source printing system were discovered. These flaws could potentially allow a remote unauthenticated attacker to execute arbitrary commands on UNIX systems under certain conditions.

Veeam has issued security patches addressing 18 high and critical vulnerabilities across its Backup & Replication (VBR), Service Provider Console, and ONE products. The most severe flaw, CVE-2024-40711, is a remote code execution (RCE) vulnerability with a CVSS score of 9.8.

A critical unauthenticated remote code execution (RCE) vulnerability in OpenSSH, identified as CVE-2024-6387 and dubbed "regreSSHion" has been discovered, which allows attackers to gain root privileges on glibc-based Linux systems.

Veeam has notified one of our units about the vulnerabilities in their Backup Enterprise Manager product listed below. The worst of them, CVE-2024-29849, allows an attacker to log in to the web interface as any user.

On March 8, QNAP published a security bulletin disclosing three security flaws in its NAS software products. Exploitation of these vulnerabilities can lead to an authentication bypass, command injection and SQL injection.