THREAT WATCH

Critical Progress LoadMaster: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability Critical JetBrains TeamCity: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Critical IBM Langflow: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability High Apache Tomcat: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability High N-able N-central: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Actively Exploited N-able N-central: CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Medium Cisco Secure Firewall Management Center (FMC): CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Critical Arista VeloCloud Orchestrator: CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability Critical Progress LoadMaster: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability Critical JetBrains TeamCity: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Critical IBM Langflow: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability High Apache Tomcat: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability High N-able N-central: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Actively Exploited N-able N-central: CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Medium Cisco Secure Firewall Management Center (FMC): CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Critical Arista VeloCloud Orchestrator: CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Category: Vulnerability Management

10 Aug
2026

Metabase zero-day exploited in the wild, with no CVE to track it by

Vulnerability Management

Key takeaways Metabase has confirmed a maximum-severity flaw in its business intelligence platform was exploited as a zero-day, first against its own hosted service. An unauthenticated attacker could reach administrator access, then take the stored credentials for every database the tool connects to. The flaw scores 10.0, the highest possible rating, and has no CVE […]

29 Jul
2026

Reading a CVE: CVSS, EPSS and KEV explained

Vulnerability Management

Key takeaways A CVE record is an identifier and a description. It is not, on its own, a judgement about how urgent the vulnerability is for you. CVSS answers how bad exploitation would be, EPSS answers how likely exploitation is in the next 30 days, and CISA’s KEV catalog answers whether exploitation has actually been […]

11 Nov
2025

Microsoft’s November 2025 Security Update: What You Need to Know

Vulnerability Management

Microsoft’s November 2025 Patch Tuesday fixes 63 security flaws across Windows, Office, .NET, and developer tools, five of them rated critical. The most urgent is an actively exploited Windows Kernel zero-day, CVE-2025-62215, which attackers are already using to gain full control of affected machines. The single most important action, for home users and businesses alike, […]