#Vulnerability Management
All CosmicBytez Labs articles tagged #Vulnerability Management, across news, security advisories, how-to guides, and projects.
- News
Microsoft Drops an Actively Exploited Zero-Day Among Record High of 1,413 Vulnerabilities
Microsoft patched a record 1,413 flaws in October, including an actively exploited Windows Shell zero-day that bypasses Mark of the Web warnings.
- News
Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles
UTA0576 chained CVE-2026-104935 with two more flaws for root-level RCE on patched Ivanti Connect Secure VPNs after a July fix missed the full bypass.
- News
Dell Asks Admins to Patch Max-Severity CSM Flaws as Soon as Possible
Dell fixed six critical CSM flaws, two with a perfect CVSS 10.0, letting unauthenticated attackers seize admin control of Kubernetes storage arrays.
- News
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical CSM flaws, including two CVSS 10.0 bugs, letting attackers steal storage admin credentials and gain root on Kubernetes nodes.
- News
Google: AI Is Changing the Pace and Profile of Vulnerability Discovery
Google's GTIG found AI-discovered vulnerabilities are twice as likely to enable remote code execution, as monthly CVE disclosures more than doubled in 2026.
- News
SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
SolarWinds fixed two unauthenticated RCE flaws in Observability Self-Hosted — CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8) — in version 2026.2.3.
- News
InfraTrust Report Warns Network Management Systems Under Attack
Eclypsium's InfraTrust Pulse finds 158 advisories across 17 vendors as attackers target network management consoles before or at disclosure.
- News
AI Changed the Exposure Problem. Validation Needs to Change With It.
AI has sped up vulnerability discovery, but only 1.4% of H1 2026's 35,853 published CVEs were ever exploited. Why triage has to shift to continuous validation.
- HOWTO
Software Bill of Materials (SBOM) Generation with Syft and Grype
Generate a complete inventory of every package, library, and dependency in your containers and codebases with Syft, then scan that inventory for known...
- News
Your Critical Vulnerabilities Might Not Be Your Biggest Risk
Severity scores alone don't measure risk — autonomous penetration testing is shifting prioritization toward exploitable attack paths, not CVSS scores.
- News
AI Is Accelerating Vulnerability Discovery — Can Defenders Keep Up?
Disclosed vulnerabilities jumped 92% in a year as AI accelerates discovery, but enrichment and remediation infrastructure hasn't kept pace.
- News
Microsoft Plugs Nearly 400 Security Holes in August 2026 Patch Tuesday
Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including a WinSock zero-day actively exploited in the wild and two publicly disclosed flaws.
- News
Records Are Made to Be Broken: Patch Tuesday July 2026 Raises Triage Stakes
Microsoft's July 2026 Patch Tuesday set a new record with 622 CVEs addressed in a single release, including three actively exploited zero-days and more...
- Project
OWASP DefectDojo: Self-Hosted Vulnerability Management Platform
Aggregate, deduplicate, and track security findings from 100+ scanners in a unified dashboard. Build a production-grade vulnerability management pipeline...
- News
Federal Audit Reveals NIST's NVD Is Plagued by Poor Planning and Duplication
A Commerce Inspector General report exposes how mismanagement allowed a backlog of more than 27,000 unprocessed security flaws to grow unchecked in the...
- Newsletter
May 20 Digest: Exchange Zero-Day, Verizon DBIR, GitHub
A Microsoft Exchange zero-day is being exploited with no patch in sight; Verizon DBIR 2026 marks a landmark shift — vulnerability exploitation now...
- News
Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No
Microsoft's May 2026 Patch Tuesday delivers security updates for 120 vulnerabilities across Windows, Edge, Office, Azure, and more — with no zero-days...
- News
Analysis of 216M Security Findings Shows a 4x Increase in Critical Risk (2026 Report)
OX Security analyzed 216 million security findings across 250 organizations over 90 days and found critical risk grew by nearly 400% year-over-year, even...
- News
NIST to Stop Rating Non-Priority Flaws Due to Volume
The National Institute of Standards and Technology will stop assigning CVSS severity scores to lower-priority vulnerabilities in the NVD as CVE submission...
- News
1 Billion CISA KEV Records Reveal Human-Scale Security Has
A Qualys analysis of over one billion CISA Known Exploited Vulnerabilities remediation records shows that most critical flaws are being actively exploited...
- News
The Zero-Day Scramble Is Avoidable: Why Attack Surface
Security teams racing to patch every new zero-day are fighting the symptom, not the cause. Intruder's Head of Security argues that most organizations have...
- Checklist
Vulnerability Management Checklist
Structured checklist for building and maintaining a vulnerability management program — scan cadence, patching SLAs, risk acceptance workflows, remediation...