NGINX Heap Buffer Overflow Could Enable Code Execution: CVE-2026-42533 and Two Companion Flaws
F5 shipped three out-of-band NGINX patches on July 15, 2026, alongside the 1.31.3 mainline release. The headline flaw, CVE-2026-42533, is a heap buffer…
CATEGORY
CYBERSECURITY
Security research, penetration testing, CVE analysis, PCI-DSS compliance, and defensive programming techniques for web applications.
79 ARTICLES
Adobe ColdFusion Gets Second July Patch Wave: 8 Critical CVEs Including CVE-2026-48318 Path Traversal (CVSS 9.9)
Adobe shipped a second Priority 1 ColdFusion advisory in two weeks, fixing 13 flaws - eight of them Critical. The lead bug, CVE-2026-48318, is a path traversal…
SharePoint Hidden RCE Setup: CVE-2026-55040 JWT Authentication Bypass
Microsoft patched CVE-2026-55040 on July 14, 2026 - a SharePoint Server flaw that lets an unauthenticated attacker forge JWT tokens and impersonate any user,…
SonicWall SMA 1000 Zero-Days Actively Exploited: CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (Code Injection, CVSS 7.2)
SonicWall confirmed that two zero-day flaws in SMA 1000 remote access appliances are under active exploitation. CVE-2026-15409 is a CVSS 10.0 unauthenticated…
Microsoft July 2026 Patch Tuesday: Three Zero-Days, Critical SharePoint RCE, and 570 CVEs
Microsoft shipped fixes for 570 vulnerabilities in July 2026, including three zero-days - two already exploited in the wild and one publicly disclosed.…
No Patch for This 9.8-Severity WordPress SSO Plugin Flaw That Hands Attackers Admin Keys - CVE-2026-57807
CVE-2026-57807 is a CVSS 9.8 authentication bypass in the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin, versions up to and including…
SAP July 2026 Patch Day: CVSS 9.9 Memory Corruption in NetWeaver ABAP, Plus HTTP Smuggling and Default Credentials - CVE-2026-44747
SAP released 16 fixes on July 2026 Patch Day, three of them Critical. CVE-2026-44747 is a CVSS 9.9 memory corruption flaw in NetWeaver AS ABAP that any…
VMware Avi Load Balancer Critical Auth Bypass Lets Attackers Seize Control Plane - CVE-2026-47865
Broadcom patched seven vulnerabilities in VMware Avi Load Balancer on July 14, 2026, led by CVE-2026-47865 - a Critical CVSS 9.8 authentication bypass that…
CISA Deadline Today: CVSS 10.0 Zero-Days in Joomla iCagenda and Balbooa Forms Allow Unauthenticated File Upload RCE
Two CVSS 10.0 Joomla extension flaws - CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Forms - let any anonymous visitor upload a PHP web shell and…
Critical Zimbra Web Client XSS Lets Attackers Hijack Email Sessions - Patch to ZCS 10.1.19 Now
Zimbra shipped Collaboration Suite 10.1.19 to fix a critical stored XSS in the Classic Web Client, the default Ajax webmail interface on millions of…
CitrixBleed 2 Is Now Ransomware Infrastructure: CVE-2025-5777 Fueling DragonForce Attacks
CVE-2025-5777 (CitrixBleed 2, CVSS 9.3) lets attackers dump live session tokens from unpatched Citrix NetScaler appliances without logging in — bypassing MFA…
WP-SHELLSTORM: Exposed Hacker Server Reveals Mass WordPress Backdoor Operation Targeting 1.4M Sites
An exposed hacker C2 server revealed WP-SHELLSTORM, a webshell access-brokerage crew that used 27 known, already-patched CVEs to backdoor WordPress, Joomla and…