$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. CISA notes it can be chained with other Ivanti Connect Secure flaws.
Ivanti Connect Secure Predictable Identifier File Upload
CISA lists an exploited predictable-identifier flaw in Ivanti Connect Secure. A remote authenticated attacker can upload attacker-controlled files to a known location on disk.
Cisco ASA/FTD SSL VPN Secondary Auth Logic Error Enables Remote DoS
Logic errors in Cisco ASA/FTD SSL VPN secondary authentication let unauthenticated remote attackers reload the firewall, causing a denial-of-service condition.
Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Latest security news
BTCPay Server Hot Wallets Drained on Outdated Instances
BTCPay Server's maintainer reports hot wallet thefts on instances running 2.4.1 or older. No credible drains reported on 2.4.7. Investigation is ongoing.
Langflow Critical Flaws Need an Upgrade to 1.13.0
IBM reports two critical unauthenticated Langflow flaws, CVE-2026-93680 and CVE-2026-110186. Every release through 1.12.8 is affected; 1.13.0 is the only fix.
Prefab UI sandbox escape fixed in 0.21.0
CVE-2026-120338 affects Prefab UI's optional Generative UI sandbox in versions 0.14.0 through 0.20.2. The 0.21.0 release contains the fix.
Three Command Injection CVEs Affect WAVLINK WN553X1-B
Three published CVE records identify command injection flaws in WAVLINK WN553X1-B firmware. All carry a CNA CVSS 3.1 score of 9.9.
Android 'SMS of Death' Crash Fix Exists, but Patch Coverage Is Unclear
Google's Android source contains a fix for a remote telephony crash. The October bulletin does not identify the issue, so device patch coverage remains unconfirmed.
Chainalysis Confirms Breach by 'Agentic' Attacker
Chainalysis confirms an external actor reached internal tools and customer contact data using 'offensive agentic techniques'. Entry point and dwell time unconfirmed.