Security Advisories
Disclosure bulletins
Dated advisories from research and client engagements — severity, affected products, technical root cause, and remediation guidance, published under coordinated disclosure.
96 advisories published
CVE-2025-25249: Analyzing Fortinet's FortiOS Heap Buffer Overflow
Fortinet has issued fixes for CVE-2025-25249, a high-severity heap buffer overflow affecting FortiOS, FortiSASE, and FortiSwitchManager.
Citrix NetScaler Auth Bypass (CVE-2026-19490): Technical Risk & Remediation
An unauthenticated remote attack path in Citrix NetScaler ADC and Gateway (CVE-2026-19490) allows threat actors to bypass perimeter authentication.
CVE-2026-85880: Microsoft Windows ALPC Heap Overflow Enables Local Privilege Escalation
Microsoft has addressed CVE-2026-85880, a high-severity ALPC heap buffer overflow allowing local attackers to escalate privileges to SYSTEM on Windows.
N-able N-central Critical Pre-Auth RCE Vulnerability (CVE-2026-86218)
Urgent patch required for N-able N-central CVE-2026-86218, a critical pre-authentication static code injection flaw enabling full server takeover.
CVE-2026-81963: Windows Update Stack Link Following LPE
An analysis of CVE-2026-81963, a high-severity local privilege escalation vulnerability in the Microsoft Windows Update Stack reaching SYSTEM access.
Unauthenticated RCE in Adobe Commerce and Magento (CVE-2026-75650)
Adobe Commerce and Magento face a critical CVSS 10.0 template engine vulnerability (CVE-2026-75650) allowing unauthenticated remote code execution.
Google Chromium V8 Type Confusion Vulnerability (CVE-2026-85046): Risk Analysis
Google Chromium V8 type confusion vulnerability CVE-2026-85046 allows arbitrary code execution inside the browser sandbox via crafted HTML pages.
SonicWall Fixes OS Command Injection Flaw CVE-2026-83549 in SMA1000 Series
SonicWall has released patches for CVE-2026-83549, an OS command injection flaw affecting SMA1000 Series appliances that allows remote root execution.
SonicWall Patches Critical Maximum-Severity SSRF Flaw in SMA1000 Series
A critical CVSS 10.0 SSRF vulnerability (CVE-2026-83548) in SonicWall SMA1000 appliances allows unauthenticated remote attackers to bypass security boundaries.
Sangoma Switchvox SQL Injection (CVE-2026-9586): Critical Unauthenticated RCE Risk
A critical SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) allows unauthenticated attackers to execute remote code on vulnerable PBX systems.
No advisories match your search.