vulnerability

CVE-2026-3854 let any authenticated user run code on GitHub's backend with a single git push. GitHub patched github.com in two hours on March 4; public disclosure on April 28 found most Enterprise Server instances still vulnerable.

CISA added CVE-2026-32202 and CVE-2024-1708 to the Known Exploited Vulnerabilities catalog on April 28, giving federal agencies until May 12 to patch a zero-click NTLM coercion flaw whose Patch Tuesday entry carried no exploitation marker.

An unauthenticated WebSocket flaw in the popular Marimo notebook (CVE-2026-39987, CVSS 9.3) was weaponized within 9 hours 41 minutes of disclosure, with credential theft completed in under three minutes. CISA has since added the bug to its KEV catalog with a May 7 federal deadline.

A researcher's protest disclosure turned Microsoft Defender's remediation engine into an attack vector, with two of three zero-days remaining unpatched as ransomware actors move in.

A missing authentication check on a Model Context Protocol endpoint in nginx-ui exposes roughly 2,600 servers to full takeover, and unauthenticated exploitation is practical when paired with a second flaw that leaks a required node secret.

Adobe says CVE-2026-34621 is under active exploitation in Acrobat and Reader; the flaw can lead to arbitrary code execution and prompted a CISA KEV deadline.

CISA added CVE-2026-34197, a 13-year-old remote code execution flaw in Apache ActiveMQ Classic, to its Known Exploited Vulnerabilities catalog on April 16 as Horizon3.ai's Naveen Sunkavally described finding the chain with Anthropic's Claude in about ten minutes.

Cisco discloses four critical vulnerabilities across ISE and Webex, with the most severe allowing unauthenticated attackers to impersonate any user via a broken SSO certificate check.

A pre-authentication SQL injection in Fortinet's endpoint management server has been exploited since late March, with federal agencies facing an April 16 remediation deadline.

Check Point and BeyondTrust disclose two distinct vulnerabilities in OpenAI products that allowed covert data theft through DNS queries and GitHub token compromise via branch name injection.

CVE-2026-3055, a CVSS 9.3 memory overread in NetScaler ADC and Gateway, echoes the 2023 CitrixBleed vulnerability that led to mass exploitation, with over 30,000 instances exposed online.

Security researchers disclose a critical deserialization flaw and two high-severity bugs in the most widely downloaded AI framework on PyPI, with patches now available.