Ivanti, Fortinet, SAP, VMware Patch Critical Vulnerabilities
Multiple vendors release fixes for remote code execution, SQL injection and privilege escalation flaws.
Category: Vulnerabilities
Weekly Security Roundup Highlights Multiple Attack Vectors
Security researchers document exchange server vulnerabilities, npm supply chain attacks, and cloud infrastructure compromise patterns.
Zero-day exploit bypasses Windows 11 BitLocker encryption protection
YellowKey exploit requires physical access but reliably defeats default BitLocker deployments on Windows 11 systems.
Windows Zero-Day Vulnerability Grants SYSTEM Privileges on Patched Systems
Security researcher releases proof-of-concept for MiniPlasma flaw affecting Windows Cloud Files Mini Filter Driver.
NGINX CVE-2026-42945 Under Active Exploitation, Causes Crashes
Heap buffer overflow vulnerability affects NGINX versions 0.6.27 through 1.30.0 with possible remote code execution.
18-Year-Old NGINX Rewrite Module Vulnerability Enables Remote Code Execution
Critical heap buffer overflow in ngx_http_rewrite_module affects both NGINX Plus and NGINX Open Source installations.
Microsoft Exchange Server vulnerability CVE-2026-42897 under active exploitation
Cross-site scripting flaw in on-premise Exchange servers enables spoofing attacks via crafted emails.
Cisco Releases Updates for Exploited SD-WAN Controller Authentication Bypass
Maximum-severity vulnerability CVE-2026-20182 with CVSS 10.0 score has been exploited in limited attacks.
CISA adds Cisco SD-WAN authentication bypass to KEV catalog
Critical vulnerability CVE-2026-20182 in Cisco Catalyst SD-WAN Controller allows admin access, must be patched by…
Microsoft patches 30 critical vulnerabilities in May update
Patch Tuesday delivers significant workload for administrators but no zero-day exploits reported