en
CVE-2026-16812: Arista VeloCloud Orchestrator's Actively Exploited Command Injection Zero-Day
Technical breakdown of the actively exploited pre-auth command injection zero-day in Arista VeloCloud SD-WAN Orchestrator.
CVE Deep Dive
en
CVE-2026-59309 & CVE-2026-59310: VMware vCenter's Critical Auth Bypass and RCE Duo
Technical analysis and remediation for VMware vCenter Server critical authentication bypass and remote code execution vulnerabilities.
en
CVE-2026-54121: Certighost and the AD CS Flaw That Lets a Standard Account Impersonate a Domain Controller
How the CertiGhost AD CS vulnerability enables standard domain accounts to forge DC certificates and achieve instant domain takeover.
en
CVE-2026-35273 & CVE-2026-35278: The Oracle PeopleSoft Zero-Day Chain Behind 100+ Breaches
How threat actors chained two unauthenticated Oracle PeopleSoft zero-days to breach over 100 enterprise environments.
en
CVE-2026-50522: Microsoft SharePoint's Next Deserialization RCE, Exploited Days After a Public PoC
Technical root cause of the SharePoint deserialization RCE exploited within days of public proof-of-concept release.
en
CVE-2026-56164 & CVE-2026-56155: Microsoft's SharePoint and AD FS Zero-Days in the July 622-CVE Patch Tuesday
Deep dive into Microsoft's record 622-CVE Patch Tuesday featuring active SharePoint and Active Directory Federation Services zero-days.
en
CVE-2026-15409 & CVE-2026-15410: Inside the SonicWall SMA 1000 Zero-Day Chain
Technical root cause and exploit chain analysis for the maximum-severity SonicWall SMA 1000 zero-day pair.
en
DuneSlide: CVE-2026-50548 / CVE-2026-50549 — Zero-Click Prompt Injection to RCE in Cursor IDE
Cato AI Labs discloses DuneSlide: chaining prompt injection to sandbox escape and remote code execution in Cursor IDE.
en
Argo CD Repo-Server: 18-Month Unpatched Zero-Auth RCE Enables Full Kubernetes Cluster Takeover
Technical breakdown of the 18-month unpatched zero-authentication RCE in Argo CD enabling full Kubernetes takeover.
en
CVE-2026-45659: Microsoft SharePoint RCE Weaponized by Storm-2603 Warlock Ransomware — CISA KEV, Federal Deadline July 4
How Storm-2603 weaponized a SharePoint deserialization flaw to deploy Warlock ransomware across enterprise networks.
en
Adobe ColdFusion: Six CVSS 10.0 RCEs in One Update — CVE-2026-48276, 48277, 48281, 48282, 48283, 48316
Technical analysis of Adobe's emergency bulletin addressing six simultaneous CVSS 10.0 unauthenticated RCE flaws.
en
CVE-2025-67038: Lantronix EDS5000 CVSS 9.8 Code Injection — CISA KEV, ICS/OT Alert, Federal Deadline Today
CISA issues urgent warning over critical CVSS 9.8 code injection in Lantronix industrial serial converters.