$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Latest security news
Maersk Confirms Breach as WhiteArmor Demands $5M
Maersk confirms a threat actor breached a system from an acquired company. WhiteArmor claims 100GB stolen and demands $5 million. Maersk reports no operational impact.
Apache HTTP Server 2.4.71 Fixes Critical mod_http2 RCE
CVE-2026-119618 is a race condition in Apache's mod_http2 that can allow unauthenticated code execution. Upgrade to 2.4.71 or turn off HTTP/2 until you can.
CISA Adds Cisco BroadWorks XXE Flaw to KEV, Patch Now
CISA says CVE-2026-20320 in Cisco BroadWorks is exploited in attacks. Cisco patched it in August; federal agencies have until November 24. Here is the order of work.
SSHole OpenSSH Bypass Now Exploited, Patch to 10.6p2
Attackers are exploiting SSHole, CVE-2026-123158, an OpenSSH password bypass hitting musl-based Linux like Alpine and OpenWrt. Update to 10.6p2 and restart sshd.
Lone attacker's AI agents pulled Taipei dispatch records
Acronis researchers say one Taiwan-based attacker ran AI agents against hundreds of targets in 11 countries, reaching Taipei emergency dispatch records.
US Agencies Warn of Attacks on Refrigeration Controllers
CISA, FBI, HHS, USDA and DOT say actors are hitting internet-exposed cold-chain controllers, forcing heating and defrost cycles. Here is what operators should do.