$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Google Chromium Use-After-Free Vulnerability
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
Latest security news
SSHole OpenSSH Bypass Now Exploited, Patch to 10.6p2
Attackers are exploiting SSHole, CVE-2026-123158, an OpenSSH password bypass hitting musl-based Linux like Alpine and OpenWrt. Update to 10.6p2 and restart sshd.
Lone attacker's AI agents pulled Taipei dispatch records
Acronis researchers say one Taiwan-based attacker ran AI agents against hundreds of targets in 11 countries, reaching Taipei emergency dispatch records.
US Agencies Warn of Attacks on Refrigeration Controllers
CISA, FBI, HHS, USDA and DOT say actors are hitting internet-exposed cold-chain controllers, forcing heating and defrost cycles. Here is what operators should do.
OpenEMR advisories cover portal, fax and FHIR flaws
Three OpenEMR advisories describe patient-record exposure through the portal, fax/SMS module and FHIR API. Patched releases are 8.3.0 and 8.4.0.
Kyverno 1.19.1 Namespace Clamp Bypass Reaches Cluster Admin
A critical Kyverno advisory says a namespace tenant can escape the apiCall clamp added in 1.19.1 and escalate to cluster admin. Version 1.19.2 fixes it.
OpenAM 16.1.4 fixes critical SSO account takeover flaws
OpenAM 16.1.3 and earlier have critical flaws allowing unauthenticated session theft and admin account creation. Version 16.1.4 is the fix.