THREAT WATCH

Critical Progress LoadMaster: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability Critical JetBrains TeamCity: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Critical IBM Langflow: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability High Apache Tomcat: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability High N-able N-central: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Actively Exploited N-able N-central: CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Medium Cisco Secure Firewall Management Center (FMC): CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Medium Fortinet FortiOS: CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Critical Progress LoadMaster: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability Critical JetBrains TeamCity: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Critical IBM Langflow: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability High Apache Tomcat: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability High N-able N-central: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Actively Exploited N-able N-central: CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability Medium Cisco Secure Firewall Management Center (FMC): CVE-2026-20316 — Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Medium Fortinet FortiOS: CVE-2025-68686 — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Tag: sql-injection

10 Aug
2026

Metabase zero-day exploited in the wild, with no CVE to track it by

Vulnerability Management

Key takeaways Metabase has confirmed a maximum-severity flaw in its business intelligence platform was exploited as a zero-day, first against its own hosted service. An unauthenticated attacker could reach administrator access, then take the stored credentials for every database the tool connects to. The flaw scores 10.0, the highest possible rating, and has no CVE […]