$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Google Chromium Use-After-Free Vulnerability
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
Latest security news
Iris Ohyama Cloud Breach May Expose 7.7M Customers
Iris Ohyama says a third-party cloud service tied to its Iris Plaza store was accessed by an unauthorized party. Up to 7.7 million people may be affected.
Queens Public Library Confirms Ransomware Attack
Queens Public Library says ransomware has taken down on-site computers, Wi-Fi and digital services across its 66 branches. No gang has claimed the attack yet.
SonicOS SSL-VPN SAML Bypass Exploited, Patch Now
SonicWall fixed seven SonicOS flaws, including CVE-2026-19868, an SSL-VPN SAML bypass exploited in attacks and on CISA's KEV list. No workaround exists.
WordPress Fix Can Expose Sites During Its Own Update
The update that installs the CVE-2026-119977 fix still runs old code, so some sites stay exposed during the install. Block wp-content/upgrade first.
D-Link DGS-3130 Switches Have Unpatched DDP Flaws
D-Link disclosed unpatched flaws in DGS-3130 switches involving its Discovery Protocol. No CVE IDs yet. Disable DDP and isolate management access.
Windows Paint RCE Fix Ships Via Store, Not Windows Update
Microsoft fixed CVE-2026-83844 in Paint build 11.2609.401.0, but only the Microsoft Store delivers it. Check every user's copy, and ignore the older fixed-build number.