Topic

Security

Latest Security coverage — 14 articles.

RCE · Next.js · Security Alert · Security · Vulnerability · CVE

Critical Next.js ImageResponse RCE (CVE-2026-94545): A 9.5 That Hides in Your Image Generation

Vercel has disclosed a critical remote code execution flaw in the Node.js implementation of ImageResponse in Next.js, tracked as CVE-2026-94545. It carries a CVSS of 9.5, and it is network-reachable with no authentication and no user interaction. But whether it affects you comes down to a detail that a version check alone will not answer: whether untrusted data reaches the SVG your app generates. This is a case where "am I running an affected version" is only half the question. What the vulner

Sep 23, 20263 min read

CVE · Security Alert · Security · Vulnerability

Redis TLS Use-After-Free (CVE-2026-81934): A Case Study in Reading Severity Correctly

CVE-2026-81934 is a use-after-free in Redis that was first published as a CVSS 9.8 Critical, then reassessed down to High once the real exploitation conditions were weighed. It's a clean lesson in why the number on a CVE is a starting point, not the answer.

Sep 3, 20263 min read

Security Alert · CVE · Active Exploitation · Security · Vulnerability

Metabase Pre-Auth SQL Injection (CVE-2026-72898): CVSS 10.0, Actively Exploited

CVE-2026-72898 is an unauthenticated SQL injection in Metabase, scored CVSS 10.0 and already in CISA KEV. One request to /api/session/reset_password gives an attacker admin access and the credentials for every connected database. If you run Metabase, patch today.

Aug 27, 20262 min read

Security Alert · CVE · Vulnerability · Security

PostgreSQL to_char Heap Buffer Overflow (CVE-2026-14669): What It Is and How to Read It Fast

CVE-2026-14669 is a CVSS 8.8 HIGH heap buffer overflow in PostgreSQL's to_char function that can run arbitrary code as the database OS user, patched August 13, 2026. Two questions decide your workload: is Postgres in your stack, and is your version older than 18.5 / 17.11 / 16.15 / 15.19 / 14.24?

Aug 25, 20263 min read

Security Alert · CVE · Active Exploitation · Vulnerability · Security

Critical and Already Being Exploited: PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)

A 9.1 critical authentication bypass in PAN-OS GlobalProtect, actively exploited and now in CISA KEV. But it only bites under a specific config. The two questions that decide your workload: is the product in your stack, and does your config meet the exposure conditions?

Jun 2, 20263 min read

Security Alert · CVE · Security · Vulnerability

Palo Alto Firewall Has an Unpatched Critical RCE Today (CVE-2026-0300)

Active exploitation of an unauthenticated root RCE in PAN-OS firewalls. No patch until May 13. The one question your team needs to answer in the next two hours: is the User-ID Authentication Portal exposed to the internet?

May 6, 20264 min read

Security Alert · CVE · Security · Vulnerability

Copy Fail (CVE-2026-31431): An AI-Assisted Audit Surfaced a Linux Kernel Bug That Roots Every Distribution Since 2017

732-byte exploit. First-try root on every modern Linux distribution. Page-cache-only corruption that on-disk integrity tools miss. Crosses container boundaries. Surfaced by an AI-assisted audit in roughly an hour.

Apr 30, 20268 min read

Security Alert · CVE · Vulnerability · Security

MCPwn: The nginx-ui Flaw That Exposes a Bigger Problem With MCP Adoption (CVE-2026-33032)

A 27-character omission gave any network-adjacent attacker full control over 2,689+ publicly exposed nginx servers. The real story: every other app bolting MCP onto existing auth stacks.

Apr 20, 20267 min read

Zero-Day · Active Exploitation · CVE · Vulnerability · Security · Security Alert

Adobe Reader Zero-Day Exploited for Months Before Emergency Patch

CVE-2026-34621 chains two logic bugs to escape Adobe Reader's sandbox — no memory corruption needed. Exploited since December 2025, patched April 11. Russian-language lures targeting oil & gas sector.

Apr 13, 20263 min read

Zero-Day · Active Exploitation · CVE · Security · Security Alert · Vulnerability

FortiClient EMS Gets a Second Zero-Day in One Week — CVE-2026-35616 Is Already Being Exploited

Same product, different vulnerability class, same outcome: unauthenticated RCE on your endpoint management server. Exploitation started Easter weekend.

Apr 6, 20262 min read

Security Alert · Security · Vulnerability

Cisco's Critical Week: IMC Auth Bypass and SSM RCE — Both at CVSS 9.8

Two CVSS 9.8 vulnerabilities hit Cisco management infrastructure. IMC auth bypass lets attackers take over any admin account. SSM On-Prem gives unauthenticated root access. Neither requires credentials.

Apr 3, 20264 min read

Security Alert · Active Exploitation · Vulnerability · Security

CVE-2026-21643: FortiClient EMS Critical SQL Injection — Actively Exploited, No Credentials Required

A critical SQL injection in FortiClient EMS 7.4.4 allows unauthenticated attackers to dump admin credentials, endpoint data, and certificates with a single HTTP request. Active exploitation confirmed.

Mar 31, 20263 min read

Security Alert · CVE · Vulnerability · Security

Palo Alto PAN-OS Vulnerability (CVE-2026-0229) Can Trigger Firewall Reboot Loops

A denial-of-service vulnerability in PAN-OS Advanced DNS Security (CVE-2026-0229) allows unauthenticated attackers to force firewalls into repeated reboot cycles, potentially pushing them into maintenance mode. Upgrade affected PAN-OS versions immediately.

Feb 13, 20262 min read

Security · CVE · Security Alert · Vulnerability

MongoBleed - CVE-2025-14847: The Vulnerability Isn't the Hard Part — Tracking It Is

When a new CVE like CVE-2025-14847 is published, the expectation is clear: teams should review it, assess impact, and take action if necessary. In reality, the hardest part usually isn't patching or mitigation...

Jan 3, 20262 min read