Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The …
Every CISA KEV addition, plus critical-severity flaws in the kit that sits at the edge of a network: firewalls, VPN gateways, load balancers, routers, switches and management consoles.
Colour on the left of each entry is the CVSS severity. A pink CISA KEV badge means the flaw is being exploited right now — treat those first, whatever the score says. How each post is sourced and checked is set out in the methodology.
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
An unauthenticated, network-reachable flaw in NetScaler ADC and Gateway lets attackers crash or disrupt the appliance without logging in, and it’s already listed as exploited in the wild.
Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Improper limitation of a pathname to a restricted directory
An unauthenticated attacker can send crafted HTTP or HTTPS requests to write arbitrary files onto a Fortinet device, bypassing path restrictions and NULL-byte filtering, with no login required.
Fortinet FortiMail Path Traversal Vulnerability
An unauthenticated attacker can send crafted requests to FortiMail’s web interface and write arbitrary files onto the underlying system, with no login required and active exploitation already confirmed.
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
A hex-encoding trick in URI handling lets an unauthenticated attacker slip past an access restriction on a Catalyst SD-WAN Manager API endpoint and operate with full admin rights.
Apple Multiple Products Out-of-Bounds Write Vulnerability
A memory-corruption bug in Apple’s CoreGraphics image-parsing framework lets a crafted file trigger arbitrary code execution on iPhones, iPads and Macs, with a known targeted-exploitation report.
Citrix NetScaler Improper Input Validation Vulnerability
An unauthenticated attacker can run arbitrary commands on NetScaler ADC and Gateway devices below the listed fixed builds, and CISA confirms this is already being exploited in the wild.
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
An unauthenticated, network-reachable memory buffer flaw in NetScaler ADC and Gateway can crash the appliance or let an attacker run code on it, and it’s already being exploited in the wild.