Tag: cve

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

Apr 17, 2026 6:38 AM

Tags: apache, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, vulnerability

A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 (CVSS score: 8.8), to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian First seen on thehackernews.com…
CVE-2026-33032: severe nginx-ui bug grants unauthenticated server access

Apr 17, 2026 12:48 AM

Tags: access, authentication, control, cve, endpoint, exploit, flaw, vulnerability

An actively exploited critical nginx-ui flaw (CVE-2026-33032) lets attackers bypass authentication and take full control of Nginx servers. A critical vulnerability in nginx-ui, tracked as CVE-2026-33032 (CVSS score of 9.8), is being actively exploited, allowing attackers to bypass authentication and fully take over Nginx servers. The issue stems from improper protection of the /mcp_message endpoint,…
Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day

Apr 17, 2026 12:48 AM

Tags: cve, exploit, flaw, microsoft, update, vulnerability, zero-day

Microsoft Patch Tuesday security updates for April 2026 fixed 165 vulnerabilities, including an actively exploited SharePoint zero-day. Microsoft Patch Tuesday security updates addressed 165 vulnerabilities, making it one of the largest updates by CVE count. One of the most interesting flaws fixed by the IT giant is a critical SharePoint zero-day, tracked as CVE-2026-32201, already…
NIST admits defeat on NVD backlog, will enrich only highest-risk CVEs going forward

Apr 17, 2026 12:48 AM

Tags: cve, nist, nvd, risk, vulnerability

NIST is overhauling how it manages the National Vulnerability Database (NVD) and switching to a risk-based model that prioritizes >>enrichment<< of only the most … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/16/nist-national-vulnerability-database-nvd-enrichment/
NIST limits vulnerability analysis as CVE backlog swells

Apr 17, 2026 12:48 AM

Tags: cve, nist, vulnerability

The agency will stop adding detailed information to vulnerabilities that don’t meet certain criteria. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/nist-vulnerability-analysis-criteria-nvd-cve/817683/
Fortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)

Apr 17, 2026 12:48 AM

Tags: authentication, cve, fortinet, unauthorized, vulnerability

Two vulnerabilities (CVE-2026-39813, CVE-2026-39808) in FortiSandbox could be leveraged by unauthenticated attackers to bypass authentication and execute unauthorized code or … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/16/fortinet-fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808/
RCE by design: MCP architectural choice haunts AI agent ecosystem

Apr 17, 2026 12:48 AM

Tags: access, ai, attack, ciso, cloud, control, cve, docker, exploit, framework, github, injection, LLM, malicious, network, nvidia, open-source, openai, rce, remote-code-execution, risk, saas, service, tool, vulnerability

sh, bash, powershell, curl, rm, and other high-risk binaries, they added.The core issue is that there’s currently no check in place to verify that a STDIO command is intended to initialize an MCP server rather than perform a malicious task. Furthermore, the researchers observed that even if the sent command fails to start the server,…
New PoC Exploit Published for Microsoft Defender 0-Day Flaw

Apr 17, 2026 12:48 AM

Tags: cve, cyber, exploit, flaw, microsoft, vulnerability, zero-day

A security researcher operating under the alias >>Chaotic Eclipse<< has publicly released a proof-of-concept (PoC) exploit for a vulnerability in Microsoft Defender. Published on April 15, 2026, the exploit targets a flaw in CVE-2026-33825, a recently patched vulnerability. The uncoordinated release highlights an escalating conflict between independent security researchers and Microsoft's vulnerability disclosure programs. Public…
NIST cuts down CVE analysis amid vulnerability overload

Apr 17, 2026 12:48 AM

Tags: ai, automation, awareness, ceo, cve, cybersecurity, defense, exploit, flaw, government, group, incident response, nist, software, technology, threat, update, vulnerability, zero-day

SOURCE: www.cve.org/about/Metrics CSOAs a result, NIST will now forego enrichment for all but the most critical of vulnerabilities.Backlogged CVEs received prior to March 1 will also be labeled “not scheduled.” None of those are critical vulnerabilities, NIST said, because those have always been handled first.”They’ve just come out and publicly stated, ‘We are never going…
Cisco Webex Vulnerability Allows User Impersonation Attacks

Apr 17, 2026 12:48 AM

Tags: advisory, attack, cisco, cve, cyber, flaw, vulnerability

Cisco has released an urgent security advisory warning organizations of a critical vulnerability in its Webex communication platform. Tracked as CVE-2026-20184, this severe flaw could allow unauthenticated, remote attackers to entirely bypass security checks and impersonate any legitimate user within the service. Understanding the Vulnerability According to the official Cisco Security Advisory published on April…
Behind the Mythos hype, Glasswing has just one confirmed CVE

Apr 17, 2026 12:48 AM

Tags: ai, control, cve, exploit, sans, technology, update

Why is Glasswing still a big deal: VulnCheck’s findings reframe Glasswing’s capabilities. The limited number of directly attributable CVEs is just one way of measuring its impact. Industry observers are interpreting Mythos much differently.Melissa Bischoping, a SANS Technology Institute board member and senior Director of security and product research at Tanium, thinks Mythos potential lies…
Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution

Apr 17, 2026 12:48 AM

Tags: cisco, cve, flaw, identity, service, vulnerability

Cisco has announced patches to address four critical security flaws impacting Identity Services and Webex Services that could result in arbitrary code execution and allow an attacker to impersonate any user within the service.The details of the vulnerabilities are below -CVE-2026-20184 (CVSS score: 9.8) – An improper certificate validation in the integration of single sign-on…
April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs

Apr 17, 2026 12:48 AM

Tags: access, ai, attack, business, ciso, cloud, cve, cvss, cyber, data, exploit, firewall, flaw, identity, injection, international, ivanti, LLM, malware, microsoft, network, remote-code-execution, sap, social-engineering, software, sql, threat, tool, unauthorized, update, vulnerability, windows, zero-day

block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that…
April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs

Apr 17, 2026 12:48 AM

Tags: access, ai, attack, business, ciso, cloud, cve, cvss, cyber, data, exploit, firewall, flaw, identity, injection, international, ivanti, LLM, malware, microsoft, network, remote-code-execution, sap, social-engineering, software, sql, threat, tool, unauthorized, update, vulnerability, windows, zero-day

block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that…
NIST to limit work on CVE entries as submissions surge

Apr 17, 2026 12:48 AM

Tags: cve, cybersecurity, nist, vulnerability

NIST said it will only add details and information to the records of vulnerabilities that meet a certain threshold, changing a longstanding mission to categorize every CVE, which stands for cybersecurity vulnerabilities and exposures. First seen on therecord.media Jump to article: therecord.media/nist-to-limit-work-on-cve-entries-surge
NIST narrows scope of CVE analysis to keep up with rising tide of vulnerabilities

Apr 17, 2026 12:48 AM

Tags: cve, government, nist, software, vulnerability

The National Vulnerability Database will now only analyze vulnerabilities in critical software, systems used in the federal government and those under active exploitation. First seen on cyberscoop.com Jump to article: cyberscoop.com/nist-narrows-cve-analysis-nvd/
The Q1 vulnerability pulse

Apr 17, 2026 12:48 AM

Tags: ai, cve, threat, vulnerability

Thor provides an overview of the Q1 2026 vulnerability statistics, highlighting key trends in legacy CVEs and the evolving impact of AI on the threat landscape. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/the-q1-vulnerability-pulse/
Ivanti Neurons ITSM Vulnerabilities Could Allow Session Persistence

Apr 17, 2026 12:48 AM

Tags: cve, ivanti, service, vulnerability

A newly disclosed set of ITSM vulnerabilities in Ivanti Neurons has been reported. The flaws could allow attackers to retain access to enterprise systems under certain conditions. The issues, tracked as CVE-2026-4913 and CVE-2026-4914, affect Ivanti’s Neurons for IT Service Management (ITSM) platform. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/itsm-vulnerabilities-ivanti/
Nobody knows how many CVEs Anthropic’s Project Glasswing has actually found

Apr 17, 2026 12:48 AM

Tags: cve

Like the majority of the companies participating, it remains a mystery First seen on theregister.com Jump to article: www.theregister.com/2026/04/15/project_glasswing_cves/
Nobody knows how many CVEs Anthropic’s Project Glasswing has actually found

Apr 17, 2026 12:48 AM

Tags: cve

Like the majority of the companies participating, it remains a mystery First seen on theregister.com Jump to article: www.theregister.com/2026/04/15/project_glasswing_cves/
Nobody knows how many CVEs Anthropic’s Project Glasswing has actually found

Apr 17, 2026 12:48 AM

Tags: cve

Like the majority of the companies participating, it remains a mystery First seen on theregister.com Jump to article: www.theregister.com/2026/04/15/project_glasswing_cves/
Claude Mythos: Prepare for your board’s cybersecurity questions about the latest AI model from Anthropic

Apr 15, 2026 12:52 AM

Tags: ai, api, application-security, attack, authentication, automation, best-practice, business, ceo, cisa, cloud, compliance, container, control, cve, cvss, cyber, cybersecurity, data, data-breach, endpoint, exploit, fedramp, finance, flaw, framework, governance, group, HIPAA, identity, injection, insurance, kev, law, linkedin, linux, LLM, macOS, network, PCI, risk, service, soc, software, strategy, technology, threat, update, vulnerability, vulnerability-management, windows, zero-day, zero-trust

With the Federal Reserve Chairman meeting with bank CEOs to discuss the security implications of Claude Mythos, you can bet that your board of directors will ask you about the impact of the AI model on your cybersecurity strategy. Here’s how to prepare. Key takeaways Anthropic announced Claude Mythos Preview, its most powerful general-purpose frontier…
Microsoft’s massive Patch Tuesday: It’s raining bugs

Apr 14, 2026 11:52 PM

Tags: attack, cve, microsoft, update

One CVE under attack, one already disclosed by angry bug hunter, and 163 more First seen on theregister.com Jump to article: www.theregister.com/2026/04/14/microsofts_massive_patch_tuesday/
Microsoft Discloses ‘Monstrous’ Number Of Bugs As AI Discoveries Surge: Researcher

Apr 14, 2026 10:53 PM

Tags: ai, cve, LLM, microsoft, tool, vulnerability

The unusually large number of CVEs (Common Vulnerabilities and Exposures) disclosed by Microsoft Tuesday is “likely” to be linked to AI-related developments, including the increasing discoveries of vulnerabilities using LLM-powered tools, according to a TrendAI researcher. First seen on crn.com Jump to article: www.crn.com/news/security/2026/microsoft-discloses-monstrous-number-of-bugs-as-ai-discoveries-surge-researcher
Microsoft’s April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)

Apr 14, 2026 10:53 PM

Tags: advisory, api, attack, best-practice, cloud, container, cve, cvss, cyber, data, exploit, firewall, firmware, flaw, framework, github, Internet, malicious, microsoft, mitigation, office, powershell, rce, remote-code-execution, service, software, sql, startup, tool, update, vulnerability, windows, zero-day

8Critical 154Important 1Moderate 0Low Microsoft addresses 163 CVEs in the April 2026 Patch Tuesday release, including two zero-day vulnerabilities, one of which was exploited in the wild. Microsoft patched 163 CVEs in its April 2026 Patch Tuesday release, with eight rated critical, 154 rated as important and one rated as moderate. This is the second…
wolfSSL Vulnerability Hits IoT, Routers and Military Systems, Update to 5.9.1 Now

Apr 14, 2026 9:52 PM

Tags: cve, flaw, iot, military, router, update, vulnerability

Critical wolfSSL flaw CVE-2026-5194 allows digital ID forgery across billions of devices, update to version 5.9.1 to fix the issue and reduce risk. First seen on hackread.com Jump to article: hackread.com/wolfssl-vulnerability-iot-routers-military-systems/
New PHP Composer Flaws Enable Arbitrary Command Execution, Patches Released

Apr 14, 2026 7:52 PM

Tags: control, cve, exploit, flaw, injection, vulnerability

Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution.The vulnerabilities have been described as command injection flaws affecting the Perforce VCS (version control software) driver. Details of the two flaws are below -CVE-2026-40176 (CVSS First seen on thehackernews.com Jump to…
Critical etcd Vulnerability Allows Unauthorized Access to Sensitive Cluster APIs

Apr 14, 2026 1:51 PM

Tags: access, ai, api, authentication, cve, cvss, cyber, flaw, unauthorized, vulnerability

An autonomous AI security agent developed by Strix has discovered a critical authentication bypass vulnerability in etcd, the widely used distributed key-value store that underpins countless backend systems worldwide. Tracked as CVE-2026-33413 and assigned a CVSS score of 8.8, this flaw allows unauthenticated or under-privileged users to invoke sensitive cluster operations. Strix identified the broken…
Attackers target unpatched ShowDoc servers via CVE-2025-0520

Apr 14, 2026 12:52 PM

Tags: cve, exploit, flaw, rce, remote-code-execution, tool

A critical RCE flaw, tracked as CVE-2025-0520, in ShowDoc is being actively exploited, putting unpatched servers at serious risk. A critical remote code execution flaw, tracked as CVE-2025-0520 (CVSS score of 9.4), affecting ShowDoc is under active exploitation in the wild. ShowDoc is an online tool that helps IT teams share documents and improve collaboration…
How AI is transforming threat detection

Apr 14, 2026 11:52 AM

Tags: ai, attack, automation, best-practice, business, ceo, cisa, cve, cyber, data, detection, email, endpoint, framework, google, governance, group, incident response, intelligence, international, jobs, kev, malware, network, nist, organized, phishing, risk, skills, soc, switch, technology, threat, tool

Reducing alert fatigue: In alert triage, AI agents are reducing alert fatigue by clustering alert patterns and enabling risk-based prioritization, adds Dipto Chakravarty, chief product and technology officer at Black Duck.For example, natural language processing agents can summarize threat alerts at scale and correlate them with threat intel feeds such as CVE.org and the CISA KEV Catalog,…