Tag: cve-2026-21262

soc

CVE-2026-38526 in Krayin CRM Enables RCE

21.04.2026

CVE-2026-38526 in Krayin CRM Enables RCE CVE-2026-38526 is a critical authenticated remote code execution (RCE) vulnerability affecting Webkul Krayin CRM / Krayin Laravel CRM v2.2.x. The issue is in the admin-side TinyMCE media upload feature and allows a logged-in user to upload a server-executable file, such as PHP, and then execute it via a normal […]

Mehr lesen →
soc

CVE-2026-34486: Apache Tomcat Tribes Regression Creates Unauthenticated RCE Path

14.04.2026

CVE-2026-34486: Apache Tomcat Tribes Regression Creates Unauthenticated RCE Path Apache Tomcat users running Tribes clustering should pay attention to CVE-2026-34486, an important-severity regression that can turn an exposed cluster receiver into an unauthenticated remote code execution (RCE) opportunity. The flaw was introduced by a prior security fix for CVE-2026-29146, where a small control-flow change caused […]

Mehr lesen →
soc

CVE-2026-35616: FortiClient EMS API Auth Bypass Enables Command Execution

06.04.2026

CVE-2026-35616: FortiClient EMS API Auth Bypass Enables Command Execution Fortinet disclosed a critical vulnerability in Fortinet FortiClient EMS (Enterprise Management Server) tracked as CVE-2026-35616. Fortinet also says it has observed in-the-wild exploitation and released out-of-band hotfix guidance for affected builds. This post breaks down what CVE-2026-35616 is, who is affected, and what defenders should do […]

Mehr lesen →
security

CVE-2026-21385: Google Patches Qualcomm Zero-Day Exploited in Targeted Android Attacks

06.04.2026

Steady cadence of Android zero-days marked as exploited in the wild makes its path to 2026. Following CVE-2025-48633 and CVE-2025-48572, two Android Framework bugs Google flagged for active exploitation, defenders keep seeing the same familiar pattern. Mobile-chain vulnerabilities can move fast from limited attacks to real enterprise risk when patching lags.  In March 2026, that […]

Mehr lesen →
security

CVE-2026-20643: Vulnerability in WebKit Navigation API May Bypass Same Origin Policy

06.04.2026

Just a little over a month after fixing the actively exploited CVE-2026-20700 zero-day, Apple has now issued its first Background Security Improvements release to address CVE-2026-20643, a WebKit vulnerability that could allow maliciously crafted web content to bypass the Same Origin Policy, one of the browser’s core security boundaries. The issue in the limelight adds […]

Mehr lesen →
security

CVE-2026-3910: Chrome V8 Zero-Day Used for In-the-Wild Attacks

06.04.2026

Chrome zero-days continue to pose a major risk for cyber defenders. Earlier this year, Google patched CVE-2026-2441, the first actively exploited Chrome zero-day of 2026. Now, another emergency update has been released, fixing two more flaws already exploited in the wild, CVE-2026-3910 in Chrome’s V8 JavaScript and WebAssembly engine and CVE-2026-3909, an out-of-bounds write bug […]

Mehr lesen →
security

CVE-2026-21262: SQL Server Zero-Day Fixed in Microsoft’s March Patch Tuesday Release

06.04.2026

The beginning of 2026 has brought a wave of zero-day vulnerabilities affecting Microsoft products, including the actively exploited Windows Desktop Window Manager flaw (CVE-2026-20805), the Microsoft Office zero-day (CVE-2026-21509) that prompted an out-of-band fix, and the Windows Notepad RCE bug (CVE-2026-20841). Microsoft’s March Patch Tuesday release keeps defenders busy again, this time shifting attention to […]

Mehr lesen →
soc

Progress ShareFile Flaws CVE-2026-2699 & CVE-2026-2701 RCE

03.04.2026

Progress ShareFile Flaws CVE-2026-2699 & CVE-2026-2701 RCE A newly disclosed Progress ShareFile pre-auth RCE chain is drawing attention after researchers showed how CVE-2026-2699 and CVE-2026-2701 can be combined to compromise exposed Storage Zones Controller 5.x servers. The issue affects customer-managed ShareFile deployments that rely on the older 5.x branch, not every ShareFile environment. watchTowr publicly […]

Mehr lesen →
soc

CVE-2026-20093: Critical Cisco IMC Flaw Allows Unauthenticated Admin Access to UCS Servers

03.04.2026

CVE-2026-20093: Critical Cisco IMC Flaw Allows Unauthenticated Admin Access to UCS Servers CVE-2026-20093, is an authentication bypass flaw found in the change password functionality of Cisco Integrated Management Controller (IMC). It could allow an unauthenticated, remote attacker to bypass authentication mechanisms and gain unauthorized access to the system with Administrator privileges. What Is CVE-2026-20093? CVE-2026-20093 […]

Mehr lesen →