VULNERABILITY TRACKER

More than 1,000 publicly reachable GitLab instances are still running vulnerable versions of the CI/CD Regular Expression Compiler, exposing them to unauthenticated remote code execution. The flaw is listed in CISA’s KEV…

Ivanti released patches for CVE‑2026‑111357 and CVE‑2026‑118527, which threat actors have been chaining with a previously disclosed authentication bypass to gain unauthenticated root access on Connect Secure gateways. Th…

Canonical’s LXD and MicroCloud contain a CVSS 10.0 vulnerability that lets an attacker log in as a trusted client using only the public certificate, granting full cluster control. The flaw highlights the need for strong …

CISA listed three Ivanti Connect Secure VPN vulnerabilities in its Known Exploited Vulnerabilities catalog after observing unauthenticated remote code execution in the wild. The chain enables attackers to gain root on V…

A newly disclosed Android vulnerability (CVE‑2026‑58882) lets an attacker crash phones by sending a malformed SMS, disrupting calls—including emergency services. Devices lacking the October 2026 patch (Android 12‑13) rem…

Drupal’s Commerce Core module suffers a critical missing‑authorization flaw (CVE‑2026‑118539) that attackers are exploiting to bypass access controls on shopping‑cart and API routes. The issue underscores the need for c…

CISA added three Ivanti Connect Secure flaws to its KEV catalog, noting active, unauthenticated exploitation that grants root access. The issue highlights a gap in authentication and privileged‑function controls, a key a…

A PHP‑specific RCE flaw dubbed PHP2Shell is being weaponised in a series of attacks called “Black October,” affecting hospitals, retailers and SaaS platforms. The surge highlights the importance of continuous vulnerabil…

Parameter researchers found that a crafted ChatGPT share link can run attacker code in a logged‑in user’s browser, allowing extraction of private conversation data. The flaw was rated P1 by OpenAI and patched within eigh…

A use‑after‑free flaw in the Linux TCP stack (CVE‑2026‑98432) lets unauthenticated attackers gain root on servers with Multipath TCP enabled. The vulnerability spans kernels from version 4.4 onward, affecting major distr…

CISA has placed GitLab CVE‑2026‑97229 (integer overflow allowing remote code execution) and Cisco ASA CVE‑2026‑76418 (NULL‑pointer DoS) into its Known Exploited Vulnerabilities catalog. Both are unauthenticated, actively…

TeamViewer (CVE‑2024‑3094) lets an attacker run code on a support technician’s machine via a malicious link. The flaw highlights the need for robust remote‑access controls and continuous vendor‑risk oversight.

eMudhra issued intermediate certificates with trivially weak private keys that can be reconstructed from the public certs, allowing anyone to forge TLS certificates. Cloudflare patched its systems to reject those keys, h…

Netgear disclosed CVE‑2026‑11731 and CVE‑2026‑11732 affecting several router models; attackers on the local network could execute commands or alter settings. The flaws are medium severity and have been patched, but one m…

TeamViewer fixed a remote‑session flaw that lets a compromised host attack the controlling computer, exposing organizations that use remote‑support tools to potential code execution. The issue underscores the importance …

A high‑severity RCE vulnerability affecting WordPress Core 4.7‑7.1.3 prompted nearly 63 k exploit attempts within a day of disclosure. The event highlights the importance of robust patch‑management and continuous monitor…

CISA reports active exploitation of GitLab’s CVE‑2026‑97229, a critical integer‑overflow that lets unauthenticated attackers run code via malicious CI/CD regexes. Organizations must validate patch‑management controls to …

Drupal’s Commerce Core module contains a critical authorization bypass (CVE‑2026‑118539) that attackers are exploiting in the wild. Organizations must patch and audit order data, highlighting the need for continuous acce…

Drupal’s Commerce Core module (versions 0.0.0‑2.41 and 3.0.0‑3.3.13) contains a missing‑authorization flaw that attackers are exploiting to manipulate e‑commerce transactions. The vulnerability tests an organization’s ab…

CISA has added two actively‑exploited vulnerabilities—a CVSS 10.0 RCE in GitLab and a DoS flaw in Cisco firewalls—to its KEV list. Organizations must verify patch status and capture remediation evidence to meet vulnerabi…

A remote, unauthenticated attacker can exploit a buffer overflow in TianoCore EDK II firmware to execute code before the OS loads, bypassing Secure Boot. The flaw impacts any system using the vulnerable UEFI code, highli…

Attackers scanned thousands of internet‑exposed Palo Alto firewalls and leveraged the PHP2Shell vulnerability to compromise at least 25 servers, including a U.S. government environment. The episode highlights the importa…

Cisco ASA and FTD appliances are vulnerable to a DoS condition when a crafted SSL VPN request exploits CVE‑2026‑76418. The flaw affects multiple firmware releases and is actively exploited, highlighting the importance of…

CIS advisory 2026‑123 reports CVE‑2026‑97229, an unauthenticated remote code execution flaw in GitLab CE/EE versions prior to 19.2.8, 19.3.5 and 19.4.2. Exploitation via a malicious regular expression in a CI/CD pipeline…

Ivanti Connect Secure suffers a missing authentication check that lets a logged‑in user elevate privileges. The flaw is actively exploited and can be chained with other CVEs, underscoring the need for robust access‑contr…