BugsToday

Cisco security appliances are supposed to be the thing keeping attackers out. Now one of Cisco’s own firewall vulnerabilities is being actively exploited, turning exposed network infrastructure into a potential entry point for attackers. The flaw affects Cisco Secure Firewall…

AI infrastructure is becoming another very large attack surface. Langflow, an open-source platform for building AI workflows, has a critical vulnerability that lets attackers execute arbitrary Python code through a crafted HTTP request. No complicated exploit chain required. The vulnerable…

Microsoft patched this one months ago. Attackers are only now making noise with it. CVE-2026-33824 is a critical remote-code-execution vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions component. CISA added it to its Known Exploited Vulnerabilities catalog after…

Another week, another server-side RCE moving from advisory to active exploitation. This time it is Adobe ColdFusion. The vulnerability is rated at the maximum CVSS 10.0, and attackers can exploit vulnerable systems without authentication to execute arbitrary code remotely. Adobe…

Another router. Another remotely reachable memory-corruption bug. This time the target is Netis NC63 firmware, where two newly published vulnerabilities carry a CVSS score of 9.8. The bugs were disclosed on August 24, making this one of the fresher entries…

GitLab has patched a critical code-injection vulnerability that is already being exploited. The bug affects self-hosted GitLab installations and can let unauthenticated attackers modify or delete data in publicly accessible projects. That is bad enough. Then the exploit became public.…

Your router is supposed to sit quietly in the corner and do one job. Route packets. Unfortunately, two vulnerabilities in the Cudy WR3000 can turn that quiet little box into a remotely controlled Linux machine running attacker commands as root.…

Some software bugs are annoying. Others are the sort where you really hope nobody puts the vulnerable server on the Internet. A serious vulnerability in NASA’s AMMOS Instrument Toolkit (AIT) could allow remote attackers to send commands, execute scripts and…

Zimbra Collaboration Suite has a problem that has moved well past the “security advisory” stage. Attackers are actively exploiting a command-injection vulnerability that can give unauthenticated attackers the ability to execute operating-system commands on vulnerable mail servers. CISA has now…

A WordPress plugin with more than 100,000 active installations has a nasty problem. Attackers don’t need an account to exploit it. They can potentially jump straight to administrator-level access. The bug is particularly ugly because it sits in an administrative…

Microsoft Edge just picked up another batch of security fixes. The latest advisory covers multiple vulnerabilities that can lead to denial of service, security restriction bypasses, information disclosure and, in the worst cases, remote code execution. The advisory was published…

Microsoft has another Windows update problem on its hands. Recent Windows 11 updates are causing print jobs to fail on some systems, and Microsoft has acknowledged the issue and published a workaround. This matters because printing is still deeply embedded…