VULNERABILITY TRACKER

Rails' Active Storage framework contains CVE‑2026‑66066, a critical flaw that lets unauthenticated attackers upload crafted images via libvips, read arbitrary files and potentially execute code. The issue highlights the …

Adobe released a patch for a CVSS 10.0 remote code execution vulnerability (CVE‑2026‑48449) affecting Campaign Classic. The flaw allowed unauthenticated code execution via incorrect authorization. Prompt remediation is e…

Adobe Campaign Classic is affected by CVE‑2026‑48449, a CVSS 10.0 remote‑code‑execution bug that bypasses authorization. The flaw highlights the need for robust SOC 2 access‑control evidence and rapid patch‑management to…

Google released Chrome 151, fixing 370 security flaws—seven critical—across Windows, macOS, and Linux. The breadth of the update underscores the need for robust patch‑management controls to satisfy SOC 2 audit requiremen…

Google’s Chrome 151, 150 and 149 updates fixed 1,442 security bugs, outpacing the total fixes of the previous 23 releases. The rapid patch cadence highlights the need for continuous browser‑patch management to satisfy SO…

An academic team uncovered 84 security flaws in 4G and 5G core networks, ranging from denial‑of‑service to a session‑hijacking exploit. The findings highlight a control‑gap that SOC 2 programs must map, monitor, and evid…

Broadcom released patches for five VMware vulnerabilities, three of which are critical and enable authentication bypass, arbitrary code execution, or VM‑escape to the host. Organizations running vCenter, ESX, Workstation…

Wiz discovered a master‑key exposure in Azure Cosmos DB’s Gremlin API that could enable full account takeover. The flaw underscores the importance of SOC 2‑aligned key‑management and continuous access‑control monitoring.

Laundry Bear is weaponising CVE‑2026‑42897, an XSS bug in Exchange OWA, to deliver the OWAReaper backdoor that steals credentials and OAuth tokens. The flaw underscores the need for SOC 2‑aligned access‑control monitorin…

NASA’s Core Flight System Health & Safety application (≤ v7.0.1) contains a CVE‑2026‑18064 NULL‑pointer dereference that can crash the system, causing denial‑of‑service and a processor reset. For SOC 2‑ready organization…

Schneider Electric disclosed CVE‑2026‑12927, an out‑of‑bounds write in the IGSS Definition module that could allow data loss or arbitrary code execution when a malicious CGF file is imported. For SOC 2‑compliant organiza…

A CVE‑2026‑5846 vulnerability in Watchfire Controller Software embeds hard‑coded RSA private keys, allowing malicious actors to deliver firmware and seize full control of the controller. The flaw affects multiple version…

CISA reports four high‑severity vulnerabilities in the open62541 OPC UA stack that could enable remote code execution or denial‑of‑service on Windows and Linux deployments. For SOC 2‑ready organizations, mapping and evid…

Rockwell Automation’s CompactLogix 5380, ControlLogix 5580 and EN4TR communication modules fail to reject certificates signed by a revoked intermediate, allowing a network‑based attacker to trigger denial‑of‑service. The…

Johnson Controls’ OpenBlue Employee platform (≤ V2025.3.1) contains three CVEs that permit unrestricted file uploads and cross‑site scripting. The flaws map to SOC 2 CC6 controls, making timely patching essential for aud…

MikroTik RouterOS versions with the API enabled suffer an insufficient session‑expiration bug (CVE‑2026‑14227) that can let a low‑privilege user retain prior permissions and steal the router’s WireGuard private key. For …

CISA has issued an advisory for CVE‑2026‑12562, a missing‑authentication flaw in Toptech Systems’ RCU II+ and Multiload II+ controllers that allows an attacker to obtain full root control. The issue affects energy‑sector…

CISA reports eight CVEs in MZ Automation's libiec61850 (< 1.6.2) that enable unauthenticated denial‑of‑service attacks on IEC 61850 GOOSE traffic. The flaws affect energy‑sector control equipment worldwide and require im…

MZ Automation disclosed two out‑of‑bounds read flaws (CVE‑2026‑61893, CVE‑2026‑63033) in lib60870 2.4.0 that can cause device crashes. For SOC 2‑ready organizations, the issue highlights the need for rigorous third‑party…

CISA reports CVE‑2026‑13584 in Mitsubishi Electric’s CC‑Link IE TSN communication protocol, allowing an attacker on the same network segment to inject crafted packets that can disrupt or mis‑direct controller operations.…

Cisco Secure Firewall Management Center contains a static‑credential vulnerability (CVE‑2026‑20316) that attackers are exploiting to gain unauthorized access. Organizations must apply the hot‑fix, rotate all credentials,…

Cisco Secure Firewall Management Center (FMC) contains a hard‑coded low‑privileged account that attackers can use without authentication to view sensitive data. The vulnerability (CVE‑2026‑20316, CVSS 5.3) is actively ex…

Cisco Secure Firewall Management Center (FMC) contains a zero‑day flaw (CVE‑2026‑20316) that lets unauthenticated attackers gain admin access and harvest static credentials. For SOC 2‑compliant organizations, the issue h…

Laundry Bear is exploiting CVE‑2026‑42897, an XSS flaw in Microsoft Exchange OWA, to deliver the OWAReaper backdoor and gain long‑term mailbox access. The activity spans government, telecom, finance, hospitality, and aer…

Cisco disclosed that a built‑in static account in Secure FMC (CVE‑2026‑20316) is being used in zero‑day attacks to gain unauthorized access. The issue highlights the need for robust access‑control evidence and rapid patc…