Every story tagged CVE, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
812 stories · open in the command center
Security researchers discovered over 10,000 Polish public entities and 250,000 websites containing critical vulnerabilities, including critical infrastructure like courts, hospitals, and airports—exposing the nation to significant cyber risks amid ongoing state-sponsored attacks. The findings highlight systemic gaps in vendor patch management, lack of bug bounty programs, and insufficient vulnerability reporting mechanisms across public sector organizations. IT leaders must recognize this as a wake-up call that legacy systems, end-of-life software, and fragmented security practices create enterprise-wide risk that extends beyond individual organizations to national security and public safety.
Apple released emergency security updates across three macOS versions (Sonoma, Sequoia, and Tahoe) without beta testing, including a critical Screen Sharing vulnerability fix that suggests the vulnerability posed significant risk. This rapid, unscheduled patching cycle indicates Apple is prioritizing security issue resolution and IT organizations should treat these updates as high-priority given the expedited release pattern and potential threat severity. Organizations managing heterogeneous macOS environments must implement a swift deployment strategy to minimize vulnerability exposure across their device fleet.
Apple released emergency security updates across three macOS versions (Sonoma, Sequoia, and Tahoe) to patch a critical Screen Sharing vulnerability (CVE-2026-65400) that could allow unauthenticated network attackers to remotely access Mac systems without valid credentials. This authentication bypass poses significant risk to enterprise environments where remote access capabilities are leveraged, potentially enabling unauthorized screen viewing, file access, and system manipulation. The urgency of this out-of-cycle, multi-version patch indicates Apple's assessment of the severity and the need for immediate IT deployment across all affected Mac deployments.
Zapscape (CVE-2026-64561) is a critical KVM escape vulnerability enabling guest-to-host privilege escalation in virtualized environments, allowing attackers with guest root access to execute arbitrary code on the host kernel with root privileges. This poses severe risks for multi-tenant cloud environments and any organization running untrusted workloads on KVM/x86 hypervisors, potentially enabling data breaches, lateral movement across tenant VMs, and complete infrastructure compromise. IT leaders must urgently assess their KVM deployments, apply patches across the affected kernel versions (2020-2026), and implement additional isolation controls for untrusted guest workloads.
North Korean state-sponsored hacking operations have compromised 1,640 companies across 57 countries in just 22 months, representing a significant and sustained threat to global enterprise security. This coordinated, persistent campaign demonstrates that organizations across all geographies and industries face elevated risk from advanced threat actors with state resources and sophistication. IT leaders must recognize this as a critical security priority requiring enhanced threat detection, incident response capabilities, and cross-organizational intelligence sharing.
Apple's Private Relay feature, which claims to hide user IP addresses in Safari, contains critical vulnerabilities that allow attackers to circumvent the protection and reveal actual IP addresses through WebKit browser engine flaws. This represents a significant privacy and security risk for iCloud+ subscribers relying on this feature for protection, with researchers bypassing Apple's security without reporting through official channels due to past delays and dismissiveness. IT organizations must reassess their privacy and security posture regarding Apple device management and employee browsing protections, as this vulnerability undermines a key privacy control and highlights broader risks in Safari-based security implementations.
Bugtraq, the legendary full-disclosure security vulnerability mailing list, has been revived under new ownership with a commitment to researcher-first transparency and preservation of critical cybersecurity history. This resurrection matters strategically because it re-establishes a trusted, unfiltered channel for vulnerability disclosure outside corporate gatekeeping, while simultaneously creating a permanent archive of security research that is increasingly valuable as AI-generated information becomes harder to verify. For IT organizations, this means security researchers now have a credible, community-backed platform to responsibly disclose vulnerabilities, potentially creating new disclosure pathways that CISOs and security teams must monitor and integrate into their vulnerability management strategies.
CVE-2026-60007 is a critical vulnerability (CVSS 9.1) in Eclipse Milo versions 0.6.0-1.1.4 that allows attackers to recover user passwords through a padding oracle attack on encrypted authentication tokens, enabling unauthorized system access without requiring user interaction. This vulnerability poses significant risk to organizations using affected OPC UA implementations, particularly in operational technology and industrial control environments where Milo is commonly deployed. IT organizations must prioritize immediate patching to version 1.1.5 or later to prevent potential credential compromise and unauthorized access to sensitive industrial systems.
CVE-2026-58080 is a critical authorization bypass vulnerability (CVSS 8.8) affecting Eclipse Milo OPC UA server versions 1.0.0-1.1.4, where the configuration copy function fails to preserve role mappings, allowing unauthenticated clients to bypass access controls and manipulate protected resources. Organizations using vulnerable versions face significant risk to industrial control systems and operational technology environments where role-based access is essential. IT teams must immediately audit deployments, prioritize upgrades to version 1.1.5 or later, and validate that role-based access controls are functioning properly post-patch.
CVE-2026-10709 is a high-severity (CVSS 7.8) stack-based buffer overflow vulnerability in Autodesk FBX SDK that allows arbitrary code execution through maliciously crafted FBX files, posing a significant risk to organizations using 3D design, animation, or modeling tools that rely on the affected SDK. This vulnerability impacts the integrity and confidentiality of systems processing FBX files and requires immediate patching of FBX SDK version 2020.3.9 to 2020.3.10 or later. IT organizations must conduct an urgent inventory of applications and workflows dependent on the FBX SDK and implement controls to restrict processing of untrusted FBX files from external sources.
CVE-2026-69252 is a high-severity authorization bypass vulnerability in Flowise (an LLM workflow platform) prior to version 3.1.3 that allows low-privileged authenticated users to view and delete files across other workspaces within their organization, creating significant data loss and confidentiality risks. Organizations using Flowise for AI/LLM applications must immediately assess deployment scope and apply the patch, as the vulnerability requires only valid API credentials with minimal privileges to exploit. This incident highlights critical security gaps in multi-tenant LLM infrastructure and underscores the need for robust permission enforcement in emerging AI platforms that IT teams are rapidly adopting.
CVE-2026-21366 is a HIGH-severity (CVSS 7.8) memory corruption vulnerability affecting multiple Qualcomm Snapdragon platforms used in automotive and IoT devices, exploitable by local users with low privilege to achieve complete system compromise including confidentiality, integrity, and availability breaches. IT organizations must immediately inventory affected Snapdragon versions across connected devices and automotive systems, then prioritize patching based on device criticality and network exposure. This vulnerability represents a significant risk to organizations with connected vehicle fleets or edge computing infrastructure relying on Qualcomm chipsets.
CVE-2026-24079 is a HIGH severity (CVSS 8.1) cryptographic vulnerability affecting Qualcomm Snapdragon components across multiple platforms (mobile, IoT, automotive, wearables) that enables attackers to compromise authentication and data confidentiality through malformed registration requests. This vulnerability poses significant risk to organizations deploying Qualcomm-based devices and requires immediate inventory assessment and patch deployment to prevent unauthorized access and data breaches. CIOs must prioritize this across their device ecosystem, particularly for connected IoT and mobile deployments that handle sensitive user data.
CVE-2026-25288 is a high-severity denial-of-service vulnerability (CVSS 7.4) affecting Qualcomm Snapdragon chipsets across mobile, automotive, industrial IoT, and computing platforms through malformed WiFi channel usage response frames. This vulnerability could allow adjacent network attackers to temporarily disable device connectivity without authentication, impacting enterprise mobility, connected devices, and supply chain partners relying on Snapdragon processors. IT organizations must urgently inventory affected Snapdragon versions and coordinate patching with device manufacturers and OEMs, as this vulnerability affects widespread hardware platforms.
A critical unauthenticated remote code execution vulnerability (CVSS 9.8) exists in kotaemon versions through 0.12.0, allowing attackers to execute arbitrary code through insecure deserialization in the check_connection endpoint with no authentication or user interaction required. This represents a severe risk to any organization using kotaemon, with potential for full system compromise and lateral movement within IT infrastructure. IT leaders must immediately assess deployment scope and implement urgent patching or isolation measures to mitigate potential breach scenarios.
CVE-2026-69263 is a high-severity vulnerability (CVSS 8.7) in Flowise LLM platform versions prior to 3.1.3 that allows authenticated users to execute arbitrary code by bypassing security controls through environment variable manipulation. Organizations using Flowise for custom LLM workflows face significant risk of unauthorized package installation and code execution, potentially compromising data integrity and system confidentiality. This vulnerability highlights the importance of environment variable validation in supply chain security and requires immediate patching across all Flowise deployments.
CVE-2026-70471 is a critical authorization bypass vulnerability in Flowise (versions prior to 3.1.3) that allows users with limited permissions to access sensitive workspace variables including database passwords, API keys, and other secrets through an unprotected API endpoint. This poses significant data breach and credential compromise risks for organizations using Flowise in production environments to manage LLM workflows. IT organizations must immediately assess their Flowise deployments and upgrade to version 3.1.3 to prevent unauthorized access to critical infrastructure credentials.
SnailJob 1.7.0 contains a critical denial of service vulnerability (CVSS 7.1) that allows authenticated users to crash servers through malformed data payloads, potentially causing significant downtime and service disruption for organizations using this job scheduling component. IT leaders must immediately assess whether SnailJob 1.7.0 is deployed in their infrastructure, particularly in systems handling critical batch jobs or task processing, and prioritize upgrading to version 2.0.0 or later to eliminate this unrecoverable memory exhaustion risk. This vulnerability highlights the importance of securing authenticated access controls and implementing robust input validation in serialization/deserialization operations across the enterprise technology stack.
CVE-2026-47764 is a critical path traversal vulnerability (CVSS 8.4) in PDM, a widely-used Python dependency manager, that allows attackers to write arbitrary files to systems through malicious wheel packages prior to version 2.27.0. This vulnerability directly impacts software supply chain security and poses significant risk to any organization using PDM for Python package management, particularly in development and CI/CD pipelines. Organizations must urgently assess their dependency management infrastructure and update to PDM 2.27.0 to prevent potential system compromise and unauthorized file placement.
Zammad versions 7.1.0 and earlier contain a HIGH severity (CVSS 7.1) authenticated authorization bypass vulnerability in ticket attachment cloning that could allow authenticated users to access sensitive attachments they shouldn't have permission to view. Organizations using Zammad for ticketing and customer support need to immediately upgrade to version 7.1.2 or later to prevent potential data exposure and compliance violations. This vulnerability requires existing system access but poses a significant insider threat risk, particularly for organizations handling confidential or regulated data.
CVE-2026-69703 is a critical vulnerability (CVSS 9.8) in Atlas-Livre that allows unauthenticated attackers to bypass authentication controls and execute destructive administrative actions such as record deletion through improperly implemented session checks. This represents a severe data integrity and confidentiality risk for any organization using this application, requiring immediate assessment and remediation to prevent unauthorized data manipulation and potential system compromise. IT organizations must urgently identify affected instances, implement compensating controls, and coordinate with development teams on patching this authentication bypass flaw.
CVE-2017-20241 is a critical remote code execution vulnerability (CVSS 9.8) in Keysight IxChariot Endpoint versions before 9.5.102 that allows unauthenticated attackers to crash systems or execute arbitrary code via a specially crafted packet, posing severe risk to network testing and monitoring infrastructure. Organizations using affected IxChariot endpoints face immediate exposure to complete system compromise without requiring user interaction or authentication. IT leaders must prioritize immediate patching to version 9.5.102 or later to eliminate this high-severity attack vector from their network security posture.
CVE-2026-70552 is a critical authentication bypass vulnerability (CVSS 9.8) in MaxSite CMS 109.5 and earlier that allows unauthenticated attackers to access admin-only endpoints by exploiting a flaw in the AJAX dispatcher, potentially enabling unauthorized data manipulation and system compromise. This vulnerability poses significant business risk as it affects content management systems that may store sensitive customer data and require immediate patching to prevent unauthorized access and potential data breaches. IT organizations must prioritize inventory and remediation of affected MaxSite CMS instances to prevent exploitation, as the vulnerability is easily exploitable and automatable by threat actors.
CVE-2026-18656 is a critical arbitrary code execution vulnerability (CVSS 8.5) in Kiro IDE versions before 1.0.228 that allows unauthenticated attackers to bypass workspace trust protections by crafting malicious project directories, posing significant risk to development environments and potentially compromising source code and build infrastructure. IT organizations must immediately identify and patch all Kiro IDE installations, particularly in Windows environments where developers may inadvertently open untrusted project directories. This vulnerability highlights the broader security risk of integrated development tools and underscores the need for robust application whitelisting, endpoint protection, and developer security awareness training.
CVE-2026-18657 is a critical arbitrary code execution vulnerability (CVSS 8.5) affecting Kiro CLI versions before 2.10.0 on Windows, where attackers can exploit uncontrolled search paths to execute malicious code by bypassing workspace trust protections. This poses significant risk to organizations using Kiro CLI, as remote unauthenticated actors can compromise systems through maliciously crafted project directories opened by local users. IT organizations must prioritize immediate patching and implement stricter directory trust controls to prevent supply chain and local execution attacks.
CVE-2026-70485 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Open WebUI versions 0.9.0-0.11.0 that allows authenticated users to bypass URL validation filters and access internal network resources and cloud metadata through NAT64 gateway exploitation. Organizations running vulnerable versions face potential data exposure of sensitive internal systems and cloud infrastructure details. IT leaders must immediately inventory Open WebUI deployments and prioritize upgrades to version 0.11.0 or later, particularly in environments with NAT64 gateways or cloud-hosted infrastructure.
CVE-2026-65986 is a critical stored cross-site scripting (XSS) vulnerability (CVSS 8.5) in CVAT annotation software that allows attackers to inject malicious scripts through annotation guide assets, potentially compromising user sessions and data integrity across the platform. This vulnerability poses significant risk to organizations using CVAT for data labeling and computer vision tasks, as it could enable unauthorized access to sensitive training data and manipulation of annotation workflows. IT organizations must prioritize patching this flaw and implementing security controls around annotation asset uploads to protect their machine learning infrastructure and compliance posture.
A high-severity authorization flaw (CVSS 7.1) in ERPNext v16.25.0 exposes the Prospect opportunities API to unauthorized access, potentially allowing attackers to view, modify, or delete sensitive business opportunity data without proper credentials. This vulnerability poses a significant risk to organizations using ERPNext for CRM and sales pipeline management, requiring immediate patching to prevent unauthorized data access and potential business disruption. IT leaders must prioritize inventory and remediation of affected ERPNext instances to protect critical sales and customer data.
A critical vulnerability (CVSS 9.1) in HUMANIST Digital Human Resources allows attackers to remotely extract sensitive cryptographic keys embedded in the application, posing severe risks to HR data confidentiality and system integrity for organizations using version 26.0. This remotely exploitable flaw requires immediate patching to version 26.1 or later, and IT organizations must audit affected systems for unauthorized access or credential compromise. The vulnerability's high exploitability and potential for lateral movement make this a top priority for security remediation and access control review.
CVE-2026-14838 is a high-severity vulnerability (CVSS 7.4) in Bilin Software's HUMANIST Digital Human Resources platform (versions 26.0 before 26.1) that exposes sensitive data through unencrypted GET request query strings, enabling session hijacking attacks with network-level access. This vulnerability poses significant risk to organizations using this HR system, as attackers can intercept and hijack user sessions without authentication, potentially compromising employee data and system integrity. IT organizations must immediately assess deployment scope and prioritize patching to version 26.1 or later to mitigate exposure to credential theft and unauthorized access.