18 of the latest 27 advisories are rated critical

Review the write-ups below and prioritise patching for anything you run.

Security Advisories

Live threat intelligence from NIST NVD, CISA KEV, and security news feeds

Security News & Analysis

(CosmicBytez Labs)

SECURITYhighSep 30, 2026

CVE-2026-76718: HPE OneView Cross-Site Scripting Flaw Enables Session Hijacking

High-severity CVSS 8.2 XSS flaw in HPE OneView (versions before 11.40) enables remote session hijacking of admin consoles; patched in OneView 11.40.

CVE-2026-76718

Read Analysis

SECURITYcriticalSep 29, 2026

Critical Stack Overflow in FAST FAC1200R Routers Has Public Exploit

CVE-2026-101037 lets remote attackers crash or hijack FAST FAC1200R routers via the devdiscover service; a public exploit exists and no patch is available.

CVE-2026-101037

Read Analysis

SECURITYcriticalSep 29, 2026

CVE-2026-101074: Netcore NR289-GE Pre-Authentication Stack Buffer Overflow

A critical pre-auth stack buffer overflow in Netcore NR289-GE routers lets remote attackers crash the device or potentially achieve RCE.

CVE-2026-101074

Read Analysis

SECURITYcriticalSep 29, 2026

CVE-2026-101075: Netcore NR289-GE Unauthenticated OS Command Injection

A critical OS command injection in Netcore NR289-GE routers lets unauthenticated attackers execute root commands via location_time.cgi.

CVE-2026-101075

Read Analysis

SECURITYcriticalSep 29, 2026

CVE-2026-101076: Netcore NR289-GE Router Unauthenticated OS Command Injection

A critical, unauthenticated OS command injection in Netcore NR289-GE routers has a public exploit, letting remote attackers run commands as root.

CVE-2026-101076

Read Analysis

SECURITYcriticalSep 29, 2026

CVE-2026-101077: Netcore NR289-GE Authentication Bypass in the boa_temp Handler

A critical, CVSS 10 missing-authentication flaw in Netcore NR289-GE routers has a public exploit and an unresponsive vendor, with no patch in sight.

CVE-2026-101077

Read Analysis

SECURITYcriticalSep 29, 2026

CVE-2026-12342: SailPoint IdentityIQ Unauthenticated Remote Code Execution

A critical, unauthenticated RCE in SailPoint IdentityIQ's web service API lets attackers execute code with no credentials.

CVE-2026-12342

Read Analysis

SECURITYhighSep 29, 2026

CVE-2026-86950: Apple CoreGraphics Out-of-Bounds Write Enables Arbitrary Code Execution

An out-of-bounds write in Apple CoreGraphics lets a malicious file trigger code execution on iOS, iPadOS, and macOS; CVSS 8.8, patched September 28.

CVE-2026-86950

Read Analysis

SECURITYcriticalSep 29, 2026

CVE-2026-102268: PyJWT is_pem_format PEM Validation Bypass

A PEM-detection gap in PyJWT lets mutated public-key PEMs slip past its HMAC guard, enabling JWT signature forgery.

CVE-2026-102268

Read Analysis

Showing 27 of 1,146 security articles. Search all articles

Loading security feeds...