01
10 July 2026 · 9 min read
CVE-2026-0300: critical PAN-OS portal root RCE flaw
CVE-2026-0300 enables unauthenticated root RCE in a specific PAN-OS Authentication Portal configuration. Check exposure, patches and mitigations.
Topic · 17 articles
Vulnerabilities
Analyses of critical vulnerabilities and CVEs: how they work, who is affected and how to patch before attackers exploit them.
PUBLISHING STANDARD TECHNICAL RESEARCH AND ANALYSIS
- AuthorNamed technical practitioner
- BasisDate and primary sources
- PurposeConcrete defensive action
FIELD NOTES
TOPIC INDEX
Latest research
02
10 July 2026 · 8 min read
CVE-2026-10520: critical Ivanti Sentry root RCE flaw
CVE-2026-10520 is an actively exploited CVSS 10 unauthenticated root RCE in Ivanti Sentry. Check affected versions, patches and response steps.
03
10 July 2026 · 8 min read
CVE-2026-11645: actively exploited Chrome V8 zero-day
CVE-2026-11645 in Chrome V8 is actively exploited. Check fixed Chrome and Edge versions and the response steps for users and administrators.
04
10 July 2026 · 7 min read
CVE-2026-28318: exploited SolarWinds Serv-U DoS flaw
CVE-2026-28318 lets an unauthenticated attacker crash SolarWinds Serv-U with a crafted POST request. Review affected versions, Hotfix 1 and mitigations.
05
10 July 2026 · 8 min read
CVE-2026-41089: critical Windows Netlogon RCE flaw
CVE-2026-41089 is an actively exploited unauthenticated Netlogon RCE on Windows domain controllers. Review affected systems and response steps.
06
10 July 2026 · 8 min read
CVE-2026-42897: exploited XSS flaw in Exchange OWA
CVE-2026-42897 executes JavaScript after a crafted email is opened in on-premises OWA with user interaction. Check scope, fixes and mitigations.
07
30 June 2026 · 7 min read
Critical CVEs of 2026: when exploits beat the patch
2026 confirms a worrying trend: vulnerabilities are exploited faster than vendors ship patches. What it means for defence and how to keep up.
08
18 June 2026 · 7 min read
New critical vulnerabilities — how not to drown in CVEs
Dozens of new vulnerabilities are published every day. We show how to tell the ones that actually affect you from the noise.
09
17 May 2026 · 12 min read
Vulnerability management: how to build the process
The scanner is the easy part. How to build the full process: inventory, risk-based prioritisation, remediation SLAs and metrics that matter.
10
20 April 2026 · 9 min read
CVE-2026-35616: critical Fortinet FortiClient EMS flaw
CVE-2026-35616 in FortiClient EMS is actively exploited and listed in CISA KEV. Check affected releases, the hotfix and investigation steps.
11
16 April 2026 · 9 min read
CVE-2026-33827: remote RCE in Windows TCP/IP
CVE-2026-33827 is a network race condition in Windows TCP/IP. Review confirmed scope, attack conditions and a defensible patching plan.
12
15 April 2026 · 9 min read
CVE-2026-32201: actively exploited SharePoint flaw
CVE-2026-32201 scores 6.5 but appears in CISA KEV. Check affected SharePoint Server editions and follow a defensible response plan.
13
30 January 2026 · 9 min read
CVE-2026-1281 and 1340: active attacks on Ivanti EPMM
CVE-2026-1281 and CVE-2026-1340 enable unauthenticated RCE in Ivanti EPMM. Review advisory facts, KEV status and response steps.
14
22 July 2025 · 10 min read
ToolShell: the mass SharePoint 0-day attack (2025)
In summer 2025, CVE-2025-53770 in SharePoint Server let attackers take over servers with no login. We analyse the ToolShell chain and its lessons.
15
25 June 2025 · 9 min read
CitrixBleed 2 (CVE-2025-5777): a gateway memory leak
CVE-2025-5777 let attackers pull session tokens from Citrix NetScaler gateways, bypassing MFA. We analyse CitrixBleed 2 and the defence.
16
29 April 2025 · 9 min read
SAP NetWeaver (CVE-2025-31324): a login-free web shell
CVE-2025-31324 in SAP NetWeaver let attackers upload a web shell with no login and take over the ERP. We analyse attacks on a company's heart.
17
8 April 2025 · 9 min read
Windows CLFS (CVE-2025-29824): an escalation 0-day
CVE-2025-29824 is another 0-day in the Windows CLFS driver, used by ransomware to seize SYSTEM. Why this class of flaw returns and how to limit the risk.
BR / NEXT STEP
Prefer a specialist to check it for you?
Book a free consultation. We'll talk about your infrastructure and real priorities.
NDA · clear scope · direct communication