$ vulnerability-intelligence --current
Vulnerability news.
Exploitation context.
Follow sourced security reporting, check a CVE against exploited-vulnerability catalogs, and browse the products affected. Start with an identifier or a product you manage.
$ latest from the desk
All articles →
Latest intelligence
all articles →
Explore exploited products
Products with multiple CVEs in our dataset and at least one CISA Known Exploited Vulnerabilities listing. Open a product to compare its tracked CVEs and source records.
Known Exploited Vulnerabilities
GPUStack Improper Authentication Vulnerability
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
SignalWire FreeSwitch Code Injection Vulnerability
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
IBM Aspera Faspex Incorrect Authorization Vulnerability
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Apple Multiple Products Improper Authentication Vulnerability
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Latest security news
Iris Ohyama Cloud Breach May Expose 7.7M Customers
Iris Ohyama says a third-party cloud service tied to its Iris Plaza store was accessed by an unauthorized party. Up to 7.7 million people may be affected.
Queens Public Library Confirms Ransomware Attack
Queens Public Library says ransomware has taken down on-site computers, Wi-Fi and digital services across its 66 branches. No gang has claimed the attack yet.
SonicOS SSL-VPN SAML Bypass Exploited, Patch Now
SonicWall fixed seven SonicOS flaws, including CVE-2026-19868, an SSL-VPN SAML bypass exploited in attacks and on CISA's KEV list. No workaround exists.
WordPress Fix Can Expose Sites During Its Own Update
The update that installs the CVE-2026-119977 fix still runs old code, so some sites stay exposed during the install. Block wp-content/upgrade first.
D-Link DGS-3130 Switches Have Unpatched DDP Flaws
D-Link disclosed unpatched flaws in DGS-3130 switches involving its Discovery Protocol. No CVE IDs yet. Disable DDP and isolate management access.
Windows Paint RCE Fix Ships Via Store, Not Windows Update
Microsoft fixed CVE-2026-83844 in Paint build 11.2609.401.0, but only the Microsoft Store delivers it. Check every user's copy, and ignore the older fixed-build number.