CISA warned today that hackers are now actively exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers. [...]
### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the p...
### Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes durin...
### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted `data-mce-*` attributes, which are executed when content is rendered. Impacts users of TinyM...
### Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and e...
## Impact `skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attacker to: 1. **Exfiltrate arbitrary files on the operator's machine** by publishing ...
All three proof-of-concept exploits weaponized in the wild since April 10, 2026. A TOCTOU race condition in Windows Defender's threat remediation engine enables local privilege escalation to SYSTEM. Two of three variants remain UNPATCHED. Full kill chain, MITRE ATT&CK mapping, IOCs, YARA rules, and SIEM queries inside.
Unauthenticated remote attackers can execute arbitrary commands with elevated privileges on FortiClient EMS servers (versions 7.4.5–7.4.6). Exploited as a zero-day since March 31, 2026. CISA added to KEV catalog April 6. Full patch (7.4.7) still pending. Internet-exposed EMS instances at critical risk.
73% of production enterprise AI deployments vulnerable. 67% of successful attacks go undetected for 72+ hours. The rise of agentic AI with tool access transforms prompt injection from a content moderation problem into a full-stack data breach vector. Real-world government breach: 150GB exfiltrated. Full technical breakdown and enterprise defensive playbook inside.
Critical double-free memory corruption (CWE-415) in Windows IKE Service Extensions. Unauthenticated network-based RCE via UDP 500/4500 — affects every Windows 10/11 and Server variant. All internet-exposed VPN gateways at immediate risk. Microsoft patches released April 14, 2026.
Microsoft's April 2026 Patch Tuesday delivers patches for 163 CVEs including 2 actively exploited zero-days. SharePoint Server spoofing vulnerability (CVE-2026-32201) added to CISA KEV with April 28 federal deadline. Full breakdown of all 8 Critical CVEs inside.