Articles & Writeups
Submit ArticleCommunity-curated external articles, writeups, and technical analysis about CVE vulnerabilities.
Actively Exploited Edge and Browser Flaws Anchor This Week's Risk
Overview Of 2268 vulnerabilities tracked this week, 285 were critical and 780 high, with 3 confirmed in CISA's Known Exploited Vulnerabilities catalog spanning SonicWall SMA1000 and Google Chrome. Public exploit code exists for 372 issues, and 605 critical or high vulnerabilities remain unpatched, including several WordPress plugin flaws enabling remote code execution. Critical Threats - CVE-2026-83548 (CRITICAL, CVSS 10.0) — SonicWall SMA1000 pre-authentication server-side request forgery in the Work Place interface allows unauthenticated remote attackers to reach internal functionality and perform unauthorized operations; affects firmware through 12.4.3-03453 and 12.5.0-02835. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-85046 (HIGH, CVSS 8.8) — Google Chrome type confusion in V8 JavaScript engine enables unauthenticated remote attackers to execute arbitrary code within the renderer sandbox by enticing a user to visit a specially crafted HTML page. Confirmed actively exploited (CISA KEV); vendor-released patch: 152.0.7977.82. - CVE-2026-83549 (HIGH, CVSS 7.8) — SonicWall SMA1000 Appliance Management Console OS command injection allows a remote authenticated administrator to execute arbitrary commands (CWE-78). Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-4357 (CRITICAL, CVSS 10.0) — Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) allows unauthenticated attackers to upload arbitrary PHP files, enabling remote code execution. Public exploit code available; no vendor-released patch identified. - CVE-2026-77009 (CRITICAL, CVSS 9.9) — Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user, including low-privilege subscribers, to execute arbitrary PHP via an unrestricted debugging console. Public exploit code available; no vendor-released patch identified. - CVE-2025-9314 (CRITICAL, CVSS 9.8) — Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) via the bundled SWFUpload component, enabling remote code execution. Public exploit code available; no vendor-released patch identified. - CVE-2026-78362 (CRITICAL, CVSS 9.8) — WordPress SEO Flow by LupsOnline plugin (versions 3.0.0 through 3.0.2) authentication bypass via improper API credential validation, allowing unauthenticated attackers to operate with administrator-level privileges and achieve full site takeover. Public exploit code available; vendor-released patch: 3.0.3. Unauthenticated remote attackers. - CVE-2026-82971 (CRITICAL, CVSS 9.3) — QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) command injection via the `ipaddr` argument of `/cgi-bin/net_tr.cgi` allows unauthenticated remote attackers to execute arbitrary OS commands. Public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: WordPress (318), Linux (188), IBM (70), Suse (57), Google (53). Most common attack techniques: Information Disclosure (444), Authentication Bypass (363), Denial Of Service (211), XSS (208), RCE (188). Patch coverage: 1107 of 2268 CVEs have a patch; 605 Critical/High remain unpatched. Key Trends - Volume is 11% down week-over-week (2558 → 2268 CVEs). - 3 CVEs are in CISA's KEV catalog. - 372 CVEs have public exploit code.
Web App RCE and Privilege Escalation Dominate; Zero KEV This Week
Overview 2440 CVEs were published (337 Critical, 974 High, 766 Medium, 110 Low), 0 in CISA KEV, 239 with public exploit code. Critical Threats - CVE-2026-55565 (CRITICAL, CVSS 9.9) — Yamcs (yamcs-core <= 5.12.7 and 5.13.0–5.13.1) remote code execution via StreamSQL LIKE pattern injection that breaks out of a generated Java string literal compiled at runtime. Public exploit code available; upstream fix available (PR/commit). Authenticated low-privileged remote attackers. - CVE-2026-55634 (CRITICAL, CVSS 9.9) — Pimcore remote code execution via malicious DataObject class import affecting all releases up to 12.3.9 and 2026.1.0 through 2026.1.5; public exploit code available; upstream fix available (PR/commit). Authenticated low-privilege attackers with only the 'objects' DataObjects permission. - CVE-2026-19092 (CRITICAL, CVSS 9.8) — Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 allows remote attackers to overwrite internal template variables and call any zero-argument PHP function, enabling information disclosure and potential broader compromise. Public exploit code available; vendor-released patch: 4.0.6. - CVE-2026-75337 (CRITICAL, CVSS 9.8) — Yu AI Code Mother v4.3 arbitrary file read via the `/api/static/{deployKey}/` endpoint allows anonymous remote attackers to retrieve files outside the intended preview directory. Public exploit code available; no vendor-released patch identified. - CVE-2026-10522 (CRITICAL, CVSS 9.8) — WordPress MemberHero plugin privilege escalation allowing unauthenticated attackers to self-register with an arbitrary role, including Administrator, via unrestricted account fields in the frontend registration flow; affects through version 6.9. Public exploit code available; no vendor-released patch identified. - CVE-2026-55546 (CRITICAL, CVSS 9.8) — QWED-MCP arbitrary code execution via `verify_math_expression()` feeding attacker-controlled input into SymPy's `parse_expr()` with an unrestricted built-in namespace. Public exploit code available; vendor-released patch: 0.2.1. - CVE-2026-54569 (CRITICAL, CVSS 9.8) — Unauthenticated remote code execution in SENAITE.CORE 2.0.0 through 2.6.0 via a missing authorization check and `eval()` sink in the JSON API. Public exploit code available; upstream fix available (PR/commit). - CVE-2026-55559 (CRITICAL, CVSS 9.8) — Remote code execution in Yamcs (open-source mission-control server) versions ≤5.12.7 and 5.13.0–5.13.1 via YAML injection through the `templateArgs` parameter; unauthenticated users are affected in default no-security.yaml configurations where guest is superuser. Public exploit code available; upstream fix available (PR/commit). Threat Landscape Most-affected vendors: Google (356), Linux (230), WordPress (155), Microsoft (70), Apache (31). Most common attack techniques: Information Disclosure (708), Authentication Bypass (519), RCE (362), Denial Of Service (343), Buffer Overflow (248). Patch coverage: 1490 of 2440 CVEs have a patch; 472 Critical/High remain unpatched. Key Trends - Volume is 27% down week-over-week (3357 → 2440 CVEs). - 239 CVEs have public exploit code.
Actively Exploited RCE in Entra, MLflow, TrueConf Anchor This Week's Risk
Overview This week logged 3357 vulnerabilities, including 503 critical and 1454 high severity, with 4 confirmed in CISA KEV as actively exploited and 229 carrying public proof-of-concept code. Notably, 1150 critical and high severity flaws remain unpatched, and several KEV-listed remote code execution and SSRF issues—spanning Microsoft Entra, Red Hat MLflow, and TrueConf Server—lack an identified vendor fix. Critical Threats - CVE-2026-69836 (CRITICAL, CVSS 10.0) — Microsoft Entra remote code execution via deserialization of untrusted data (CWE-502). Confirmed actively exploited (CISA KEV); vendor-released patch available. Unauthenticated remote attackers. - CVE-2026-72530 (CRITICAL, CVSS 9.5) — TrueConf Server remote code execution in versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5 allows an unauthenticated attacker reaching TCP port 4307 to submit a crafted script that escapes the sandboxed execution environment and runs arbitrary code on the underlying host. Confirmed actively exploited (CISA KEV); no vendor-released patch version identified. - CVE-2026-64849 (CRITICAL, CVSS 9.3) — Red Hat MLflow server-side request forgery via the `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint, allowing unauthenticated remote attackers to coerce the server into making outbound requests to internal or cloud metadata endpoints. Confirmed actively exploited (CISA KEV); vendor-released patch: 3.15.0. - CVE-2026-72529 (CRITICAL, CVSS 9.3) — TrueConf Server remote unauthenticated code execution via port 4307/TCP, affecting versions through 5.3.9, 5.4.9, and 5.5.5. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-47686 (CRITICAL, CVSS 9.9) — vm2 Node.js sandbox library sandbox escape to remote code execution in versions 3.11.5 and earlier via an unhandled `Error.cause` property in `handleException()`. Public exploit code available; vendor-released patch: 3.11.6. - CVE-2026-47698 (CRITICAL, CVSS 9.8) — Sandbox escape in the vm2 Node.js sandboxing library (npm, versions <= 3.11.5) allows arbitrary OS command execution on the host. Public exploit code available; vendor-released patch available. - CVE-2026-67917 (CRITICAL, CVSS 9.8) — AzuraCast SQL injection in backup restore flow (versions up to and including 0.23.7) enabling privilege escalation via verbatim execution of restored `db.sql` content. Public exploit code available; no vendor-released patch identified. - CVE-2026-75860 (CRITICAL, CVSS 9.8) — WordPress JSON Options plugin (versions through 0.0.4) unauthenticated arbitrary option update enabling full site takeover via self-registration of an administrator account. Public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: Oracle (895), Suse (186), IBM (182), Linux (159), Red Hat (137). Most common attack techniques: Authentication Bypass (1225), Information Disclosure (734), Denial Of Service (361), RCE (315), Buffer Overflow (283). Patch coverage: 1584 of 3357 CVEs have a patch; 1150 Critical/High remain unpatched. Key Trends - Volume is 13% down week-over-week (3875 → 3357 CVEs). - 4 CVEs are in CISA's KEV catalog. - 229 CVEs have public exploit code.
Actively Exploited Unpatched RCE and Privilege Flaws Lead the Week
Overview This week's scan surfaced 3875 vulnerabilities, including 321 critical and 1306 high-severity findings, of which 531 critical and high issues remain unpatched. Three are confirmed on the CISA KEV list as actively exploited, and 255 have public proof-of-concept exploit code available. Leading findings include unpatched, actively exploited flaws in Metabase, Cisco ASA/FTD, and Microsoft Windows (afd.sys), alongside critical remote code execution in the Fabrik Joomla extension and WooCommerce Subscriptions. Critical Threats - CVE-2026-72898 (CRITICAL, CVSS 10.0) — Metabase SQL injection via the `/reset_password` endpoint allows unauthenticated remote attackers to inject arbitrary SQL and escalate to administrator. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-20349 (HIGH, CVSS 8.6) — Cisco Adaptive Security Appliance Software and Secure Firewall Threat Defense denial of service via crafted HTTP requests to the Remote Access SSL VPN service, enabling unauthenticated remote attackers to force an unexpected device reload. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2025-15684 (MEDIUM, CVSS 5.5) — Open5gs reachable assertion in the Diameter CER handler allows remote unauthenticated attackers to crash the process, causing a denial of service. Public exploit code available; upstream fix available (PR/commit). - CVE-2026-68820 (HIGH, CVSS 7.0) — Microsoft Windows privilege escalation in the Ancillary Function Driver for WinSock (afd.sys) via use-after-free memory corruption, allowing a locally authenticated attacker to gain SYSTEM-level privileges; confirmed actively exploited (CISA KEV). Affected products: Windows 10 1607, Windows 10 1809, Windows 10 21h2, Windows 10 22h2, Windows 11 23h2, Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025; no vendor-released patch identified. - CVE-2026-67282 (CRITICAL, CVSS 10.0) — Fabrik Extension for Joomla remote code execution via the frontend listfilter model; unauthenticated remote attackers can execute arbitrary code on the server with no user interaction. No vendor-released patch identified; immediate removal or disabling of the extension is advised. - CVE-2025-41769 (CRITICAL, CVSS 9.3) — Phoenix Contact PLCnext industrial controllers (AXC F 1152, AXC F 1252, AXC F 2152, AXC F 3152, RFC 4072R, RFC 4072S, BPC 9102S, BPC 9202S, VPLCnext Control 500/1000/2000/3000, EPC 1502, EPC 1522, VL3 UPC 2440 Edge) buffer overflow in PROFINET service allows unauthenticated remote code execution or denial-of-service in the default configuration; vendor-released patch available. EPSS: 59%. - CVE-2026-18391 (CRITICAL, CVSS 9.8) — WordPress WooCommerce Subscriptions PHP object injection escalating to unauthenticated remote code execution, affecting plugin versions 4.7.0 through 9.0.x on stores with High-Performance Order Storage enabled. Public exploit code available; no vendor-released patch version identified from provided data. - CVE-2025-15687 (LOW, CVSS 2.1) — Open5gs denial of service in the Session Management Function (SMF). Public exploit code available; upstream fix available (PR/commit). Network-adjacent attackers with low-privilege Diameter Gx peer access. Threat Landscape Most-affected vendors: Linux (1221), Microsoft (435), Red Hat (338), Suse (268), WordPress (228). Most common attack techniques: Information Disclosure (1524), Authentication Bypass (617), Buffer Overflow (534), Denial Of Service (481), RCE (249). Patch coverage: 2777 of 3875 CVEs have a patch; 531 Critical/High remain unpatched. Key Trends - Volume is 114% up week-over-week (1811 → 3875 CVEs). - 3 CVEs are in CISA's KEV catalog. - 255 CVEs have public exploit code.
Weekly Vulnerability Briefing: Unpatched Critical RCE Dominates Findings
Overview 1811 CVEs were published (277 Critical, 707 High, 590 Medium, 175 Low), 0 in CISA KEV, 391 with public exploit code. Critical Threats - CVE-2026-15733 (CRITICAL, CVSS 9.8) — Remote code execution in WGDashboard (self-hosted WireGuard management web UI) versions up to 4.3.2 via OS command injection through unsanitized input paths, executing as root (CWE-78). Public exploit code available; no vendor-released patch identified. - CVE-2026-16940 (CRITICAL, CVSS 10.0) — WordPress Custom Fields plugin arbitrary file deletion allowing unauthenticated attackers to delete any file on the server, including wp-config.php, leading to full site takeover. Public exploit code available; vendor-released patch: 1.5.1. - CVE-2026-69240 (CRITICAL, CVSS 9.8) — SQL injection in Sequelize Node.js ORM (Oracle dialect, versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL via the string-escaping routine. Public exploit code available; vendor-released patch: 6.37.4. - CVE-2026-12872 (CRITICAL, CVSS 9.8) — Unauthenticated remote code execution in the WordPress Webinfos plugin (versions through 1.2) via unrestricted file upload; public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers. - CVE-2026-15734 (CRITICAL, CVSS 9.8) — WGDashboard 4.3.2 and earlier remote code execution via Server-Side Template Injection, allowing authenticated attackers to execute arbitrary commands as root. Public exploit code available; no vendor-released patch identified. - CVE-2026-67688 (CRITICAL, CVSS 9.8) — Unrestricted file upload in ICS-Park Smart Park Management System v2.0 allows a remote attacker to upload and execute arbitrary code via the file upload module, yielding full server compromise. Public exploit code available; no vendor-released patch identified. - CVE-2026-16258 (CRITICAL, CVSS 9.8) — PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 allows unauthenticated remote attackers to pass untrusted serialized data into a PHP `unserialize()` sink, escalating to remote code execution where a suitable POP gadget chain exists. Public exploit code available; vendor-released patch: 4.14.5. - CVE-2026-16250 (CRITICAL, CVSS 9.8) — Remote code execution in the Personal QR Message WordPress plugin (versions through 1.0) via unrestricted PHP file upload by unauthenticated attackers. Public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: WordPress (250), Google (92), Suse (86), Microsoft (66), Apache (63). Most common attack techniques: Information Disclosure (426), Authentication Bypass (367), Denial Of Service (229), RCE (170), XSS (148). Patch coverage: 883 of 1811 CVEs have a patch; 498 Critical/High remain unpatched. Key Trends - Volume is 7% down week-over-week (1949 → 1811 CVEs). - 391 CVEs have public exploit code.
Actively Exploited KEVs and Widespread PoC-Available RCE Flaws Lead Week
Overview This week's briefing covers 1949 vulnerabilities, including 307 critical and 693 high severity, with 2 confirmed on the CISA KEV list as actively exploited and 279 carrying public proof-of-concept code. Notably, 358 critical and high vulnerabilities remain unpatched, and top findings include maximum-severity command injection in VeloCloud Orchestrator (CVSS 10.0, KEV) and remote code execution flaws across VMware vCenter, Ruby on Rails, and the WordPress Streamit theme. Critical Threats - CVE-2026-16812 (CRITICAL, CVSS 10.0) — VeloCloud Orchestrator command injection vulnerability allows unauthenticated remote attackers to access internal functionality and fully compromise the host system. Confirmed actively exploited (CISA KEV); vendor-released patch available for Hosted and Dedicated VCO versions. - CVE-2026-20316 (MEDIUM, CVSS 5.3) — Cisco Secure Firewall Management Center (FMC) hardcoded static credentials allow an unauthenticated remote attacker to log in via a built-in low-privileged account and access sensitive data. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-59310 (CRITICAL, CVSS 9.8) — VMware vCenter Server (Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, Telco Cloud Platform) remote code execution via directory traversal in the Syslog server component. Public exploit code available; vendor-released patch available. Unauthenticated remote attackers with network access to vCenter. - CVE-2026-54735 (CRITICAL, CVSS 10.0) — Server-side request forgery in Prebid Server (Go) before 4.4.0 allows remote unauthenticated attackers to coerce the ad server into making HTTP requests to attacker-chosen destinations via unvalidated user-supplied parameters in multiple bidder adapters. Public exploit code available; upstream fix available (PR/commit). - CVE-2026-54680 (CRITICAL, CVSS 9.9) — Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Public exploit code available; vendor-released patch: 6.6.0. - CVE-2026-54658 (CRITICAL, CVSS 9.8) — SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter, potentially resulting in full disclosure, modification, or destruction of the database. Public exploit code available; upstream fix available (PR/commit). - CVE-2026-13423 (CRITICAL, CVSS 9.8) — Unauthenticated remote code execution in the WordPress Streamit theme (versions up to and including 4.5.0) via a missing-authorization AJAX endpoint that allows invocation of attacker-supplied PHP functions, enabling account creation and arbitrary code execution. Public exploit code available; no vendor-released patch identified. - CVE-2026-66066 (CRITICAL, CVSS 9.5) — Ruby on Rails Active Storage arbitrary file read and remote code execution via libvips-based variant processor. Public exploit code available; vendor-released patch: 7.2.3.2, 8.0.5.1, 8.1.3.1. Unauthenticated remote attackers. Threat Landscape Most-affected vendors: Google (393), Suse (370), Red Hat (355), WordPress (293), Apple (204). Most common attack techniques: Information Disclosure (610), Authentication Bypass (389), Buffer Overflow (213), Denial Of Service (205), RCE (192). Patch coverage: 1281 of 1949 CVEs have a patch; 358 Critical/High remain unpatched. Key Trends - Volume is 31% down week-over-week (2817 → 1949 CVEs). - 2 CVEs are in CISA's KEV catalog. - 279 CVEs have public exploit code.
Autel & Check Point Flaws Drive 1,096 Unpatched Critical/High Count
Overview 2817 CVEs were published (428 Critical, 1033 High, 836 Medium, 148 Low), 1 in CISA KEV, 158 with public exploit code. Critical Threats - CVE-2026-16232 (CRITICAL, CVSS 9.1) — Check Point SmartConsole authentication bypass allows unauthenticated remote attacker to gain full administrative rights on Quantum Security Management and Multi-Domain Security Management servers (R77.30 through R82.10). Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-8985 (CRITICAL, CVSS 10.0) — Autel MaxiCharger Single unauthenticated OS command injection through firmware V1.03.51. Public exploit code available; no vendor-released patch identified. - CVE-2026-8984 (CRITICAL, CVSS 10.0) — Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) remote code execution. Public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers can execute arbitrary code as root via crafted request to /test endpoint on TCP port 9002. - CVE-2026-8983 (CRITICAL, CVSS 10.0) — Autel MaxiCharger Single authentication bypass affecting firmware up to V1.03.51. Public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers. - CVE-2026-8982 (CRITICAL, CVSS 10.0) — Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51). Public exploit code available; no vendor-released patch identified. Remote attackers. - CVE-2026-8986 (CRITICAL, CVSS 9.5) — Autel MaxiCharger Single OS command injection in firmware v1.03.51 and earlier. Public exploit code available; no vendor-released patch identified. A malicious or compromised OCPP backend server can inject OS commands via the diagnostics URL parameter. - CVE-2026-8987 (CRITICAL, CVSS 9.4) — Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51; public exploit code available; no vendor-released patch identified. Authenticated attacker. - CVE-2026-63767 (CRITICAL, CVSS 9.3) — Remote code execution in ktransformers through version 0.6.3. Public exploit code available; upstream fix available (PR/commit). Unauthenticated remote attackers. Threat Landscape Most-affected vendors: Oracle (1119), Linux (334), WordPress (119), Suse (86), Mozilla (69). Most common attack techniques: Authentication Bypass (1129), Information Disclosure (704), Denial Of Service (342), Privilege Escalation (185), Buffer Overflow (170). Patch coverage: 1021 of 2817 CVEs have a patch; 1096 Critical/High remain unpatched. Key Trends - Volume is 9% up week-over-week (2580 → 2817 CVEs). - 1 CVE is in CISA's KEV catalog. - 158 CVEs have public exploit code.
Actively Exploited SharePoint and SMA1000 Zero-Days Lead the Week
Overview This week covered 2580 vulnerabilities, including 224 critical and 1042 high-severity findings, with 5 confirmed on the CISA KEV list as actively exploited and 251 carrying public proof-of-concept code. The KEV entries span unpatched SharePoint RCE (CVE-2026-58644), an SMA1000 SSRF rated CVSS 10.0 (CVE-2026-15409), and AD FS privilege escalation, while 447 critical and high-severity vulnerabilities remain unpatched. Multiple critical SharePoint deserialization flaws and a SYSTEM-level Windows Kernel use-after-free with public exploit code further compound the exposure. Critical Threats - CVE-2026-58644 (CRITICAL, CVSS 9.8) — Microsoft SharePoint (Enterprise Server 2016, Server 2019, Subscription Edition) remote code execution via deserialization of maliciously crafted serialized data; unauthenticated remote attackers can run arbitrary code on the server. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-56164 (CRITICAL, CVSS 9.8) — Microsoft SharePoint Server privilege elevation (Enterprise Server 2016, Server 2019, Subscription Edition) allowing unauthenticated network attackers to reach a security-critical function lacking authentication checks (CWE-306), gaining elevated privileges on the target farm. Confirmed actively exploited (CISA KEV); vendor-released patch available. - CVE-2026-15409 (CRITICAL, CVSS 10.0) — SMA1000 Appliance Work Place interface server-side request forgery (SSRF). Confirmed actively exploited (CISA KEV); no vendor-released patch identified. Unauthenticated remote attackers can cause the appliance to make requests to unintended locations. - CVE-2026-15410 (HIGH, CVSS 7.2) — SMA1000 Appliance Management Console post-authentication code injection enabling arbitrary OS command execution by remote authenticated administrators. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-56155 (HIGH, CVSS 7.8) — Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) on Windows Server 2012 through Windows Server 2025, allowing an authenticated low-privileged user to gain higher privileges via insufficient access control granularity. Confirmed actively exploited (CISA KEV); vendor-released patch available. - CVE-2026-50522 (CRITICAL, CVSS 9.8) — Microsoft SharePoint Server (2016, 2019, and Subscription Edition) remote code execution via untrusted-data deserialization; unauthenticated remote attackers can execute arbitrary code with no user interaction required. No vendor-released patch identified. - CVE-2026-55040 (CRITICAL, CVSS 9.1) — Microsoft SharePoint security feature bypass (Enterprise Server 2016, Server 2019, Subscription Edition) allowing unauthenticated network-based attackers to defeat authentication protection mechanisms with no user interaction required. Vendor-released patch available. - CVE-2026-49798 (CRITICAL, CVSS 9.3) — Microsoft Windows Kernel local privilege escalation via use-after-free (CWE-416), allowing an unauthorized attacker to gain SYSTEM-level privileges; affects Windows 10 (1607 through 22H2), Windows 11 (24H2 through 26H1), and Windows Server (2012 through 2025). Public exploit code available; no vendor-released patch version identified. Threat Landscape Most-affected vendors: Microsoft (542), Linux (435), WordPress (123), IBM (34), Google (28). Most common attack techniques: Information Disclosure (823), Authentication Bypass (448), Buffer Overflow (410), Denial Of Service (341), RCE (197). Patch coverage: 1701 of 2580 CVEs have a patch; 447 Critical/High remain unpatched. Key Trends - Volume is 71% up week-over-week (1512 → 2580 CVEs). - 5 CVEs are in CISA's KEV catalog. - 251 CVEs have public exploit code.
