Advisories
Critical Vulnerability in Cisco Catalyst SD-WAN Controller Under Active Exploitation (CVE-2026-20182, CVE-2026-20245)
Updated 06/05/2026 to include additional CVEs disclosed by Cisco affecting the same product line. On May 14th, Cisco published an advisory detailing a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN controller infrastructure. The vulnerability, tracked as CVE-2026-20182, is a peering authentication bypass between SD-WAN infrastructure components and is similar to a vulnerability discovered 3 months prior. Active exploitation has been confirmed in the wild, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Line the vulnerability reported in late February, this flaw allows an unauthenticated attacker the ability to bypass authentication and create a rogue peer to a victim’s SD-WAN controller. Through creating a rogue peer, an attacker can advance to gain high privileged access into the ecosystem and manipulate configurations via NETCONF.
May 14, 2026 - 5 Min Read
Critical 18-Year-Old RCE Vulnerability in NGINX aka “NGINX Rift” (CVE-2026-42945, CVE-2026-9256)
05/26/26 Update: On May 22nd, F5 published another advisory for an additional but different vulnerability found in the same ‘ngx_http_rewrite_module’ system. The new vulnerability (tracked as CVE-2026-9256) can allow an unauthenticated attacker to corrupt system memory and potentially achieve RCE. Discovery of the bug was credited to various research groups, and there were no reports of active exploitation in the wild at time of writing. On May 13th, 2026, F5 released an advisory regarding a flaw that under specific non-default conditions, could allow unauthenticated remote code execution (RCE) in NGINX Open Source and NGINX Plus. Tracked as CVE-2026-42945 and nicknamed “NGINX Rift”, the vulnerability stems from a heap buffer overflow in the ‘ngx_http_rewrite_module’ that has been present in the codebase since 2008.
May 14, 2026 - 5 Min Read
Critical Auth Bypass Vulnerability in FortiAuthenticator (CVE-2026-44277)
On May 12th, Fortinet publicly released a critical vulnerability affecting Fortinet FortiAuthenticator which handles Identity and Access Management (IAM) within some Fortinet architectures. The flaw is tracked as CVE-2026-44277 and classified as an improper access control vulnerability allowing unauthenticated attackers the ability to execute unauthorized code remotely.
May 12, 2026 - 2 Min Read
Critical Supply Chain Attack targeting TanStack affecting multiple NPM & PyPi Packages
Another TeamPCP NPM supply-chain attack hitting TanStack and worming to other dependencies across NPM and other package managers, affecting over 200 affected versions of widely distributed packages.
May 11, 2026 - 3 Min Read
Critical Vulnerability in PaloAlto PAN-OS Authentication Portal (CVE-2026-0300)
On May 6th, Palo Alto Networks announced CVE-2026-0300, an authentication bypass vulnerability in their PAN-OS which allows an unauthenticated attacker to bypass authentication and remotely execute code as root on PAN-OS PA-Series and VM-Series firewalls.
May 5, 2026 - 4 Min Read
Critical Vulnerability in Apache HTTP Server Disclosed (CVE-2026-23918)
On May 4th, 2026 Apache released an advisory regarding a flaw that under certain conditions, could allow unauthenticated remote code execution (RCE) in Apache HTTP Server version 2.4.66. Tracked as CVE-2026-23918, the vulnerability stems from a memory corruption bug within the version’s implementation.
May 5, 2026 - 3 Min Read
Critical Vulnerability in Progress MOVEit Automation (CVE-2026-4670)
On April 30th, Progress Software published an alert bulletin regarding a critical vulnerability in their widely used file share product MOVEit Automation. The flaw, tracked as CVE-2026-4670, could allow unauthenticated, remote attackers access to affected systems.
Apr 30, 2026 - 2 Min Read
Critical Vulnerability in cPanel and WHM Under Active Exploitation (CVE-2026-41940)
On April 29th, cPanel published an emergency advisory concerning CVE-2026-41940, a security issue in “various authentication paths” in all supported versions of the cPanel software. cPanel provided security updates along with their public advisory. Well known hosting providers have confirmed that an exploit is already being used in-the-wild and some have taken the extreme step to firewall off access to the software until security patches could be deployed. Additionally, a few hours after the official cPanel advisory security researchers published a blog with details to produce proof-of-concept exploit code.
Apr 29, 2026 - 5 Min Read
Critical Remote Code Execution Vulnerability in FortiClient EMS Under Active Exploitation (CVE-2026-21643)
On April 13th, CISA added a critical remote code execution vulnerability in FortiClient Enterprise Management Server to its Known Exploited Vulnerability (KEV) database. The vulnerability is being tracked as CVE-2026-21643 and is under active exploitation.
Apr 13, 2026 - 3 Min Read
Critical Auth Bypass Vulnerability in FortiClient EMS Under Active Exploitation (CVE-2026-35616)
On April 6th, CISA added a critical remote code execution vulnerability in FortiClient Enterprise Management Server to its Known Exploited Vulnerability (KEV) database. The vulnerability is being tracked as CVE-2026-35616 and is under active exploitation.
Apr 6, 2026 - 3 Min Read