grep -rl "vulnerabilities" ./articles
CISA's review of 2024 and 2025 finds that the flaws attackers actually use are injection, input validation and path traversal — the same list as two decades ago. Seven of the ten most frequent weaknesses on the exploited-vulnerabilities catalog account for 41.5% of everything on it. CISA blames culture and workflow, not difficulty.
Broadcom shipped 91 vulnerability fixes for the Spring framework in one release, including a critical flaw in Spring Security's embedded LDAP server. The count went 22, then 16, then over 200. The jump is attributed to Broadcom putting AI on the problem, which is the same capability the attack stories run on, pointed the other way.
isolated-vm is how a lot of Node applications run untrusted JavaScript without a container. EndorLabs found its ExternalCopy path iterates a transfer list twice and trusts the earlier pass, so a JavaScript getter returning different values each time can point the native layer at attacker-chosen memory. Fixed in 6.2.0 and 7.0.1.
Nine vulnerabilities across Crosswork and Secure Workload, five of them scoring a maximum 10.0, including two separate authentication bypasses and a SQL injection. None are known to be exploited. All came out of Cisco's own internal review, which is the second such batch in a fortnight.
CVE-2026-69836 is a real maximum-severity flaw in Entra ID, and Microsoft fixed it cloud-side with nothing for customers to do. For most of 21 August its own bulletin marked it exploited in the wild. Microsoft corrected that field to No after a reporter asked. The correction has not travelled the way the original did.
CVE-2026-32475 is a CVSS 9.0 in Elementor Pro's Forms module. Validation and file-moving run in separate loops that handle empty entries differently, so submitting two file parts for one field skips the extension blocklist entirely. All versions to 4.2.1 are affected; 4.2.2 fixes it.
CVE-2026-19478 is a CVSS 9.4 in GitLab CE and EE: under certain conditions an unauthenticated user could modify or delete public projects and user data through a GraphQL directive. Patches landed on 17 August outside the normal release train. GitLab.com is already covered; self-hosted is not.
CVE-2026-64849 is an unauthenticated SSRF in MLflow's webhook test endpoint, CVSS 9.3, fixed in 3.15.0. The check on the destination was real; it just was not pinned, so a redirect or a second DNS answer walked straight past it into cloud metadata. watchTowr saw exploitation attempts the same day the CVE was assigned.
Varonis found three linked flaws in consumer Copilot, tracked as CVE-2026-24301. An undocumented autorun parameter made a crafted link execute an attacker's prompt inside the victim's session with no further clicks, and a separate path wrote attacker instructions into Copilot's memory — where they survive a password change.
CVE-2026-65400 bypasses credential validation on Apple's remote desktop service. The Dutch NCSC confirmed exploitation against internet-exposed Macs with port 5900 open, and what turned up was root access and a Monero miner.
The annotation feature opens a direct channel between viewers and the person sharing. A Security's 'Zoomsday' chain starts with a missing bound check in the text annotator and ends in remote code execution.
QUIRSO traced exploitation of CVE-2026-59310 across 47 countries, with victims first contacting attacker infrastructure on 3 August. The persistence mechanism is a cron job running an open-source reverse SSH tool.
Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.
Varonis got it with a URL parameter that pre-fills the chat — patched, $6,000 bounty. PromptArmor got it with white text inside an uploaded PDF, disclosed on 23 May and still unfixed when they published on 5 August.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.
Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.
Researchers from the University of Birmingham and Fuzzware showed that a hostile SIM can drive a standardised command called RUN AT straight into the modem. Three of eighteen phones accepted it. So did six of eight Quectel modules, and an EV charger.