Your source for exposure management research, product news, and security insights.
A cryptographic signature verification flaw in ASP.NET Core’s Data Protection library lets an unauthenticated attacker forge authentication cookies and other protected payloads, allowing impersonation of privileged users on Linux-hosted applications running Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6.
Read more about Emerging Threat: (CVE-2026-40372) ASP.NET Core Privilege Escalation via Signature BypassAn authentication bypass vulnerability in Apache Tomcat and Tomcat Native can allow unauthorized access to CLIENT_CERT-protected resources when OCSP soft-fail is disabled, bypassing the mutual TLS access control that the certificate validation policy was intended to enforce.
Read more about Emerging Threat: (CVE-2026-29145) Apache Tomcat Authentication BypassA denial of service vulnerability in React Server Components allows an unauthenticated remote attacker to send a specially crafted HTTP request that triggers excessive CPU consumption.
Read more about Emerging Threat: (CVE-2026-23869) React Server Components Denial of ServiceThe instinctive reaction to Mythos is: we need to patch faster. That instinct is understandable. It is also exactly the wrong frame. The real question isn’t how many CVEs are in your queue. It’s how many of your exposed assets can actually be exploited right now, by anyone with an API key and an afternoon.
Read more about Mythos, MOAK, CTEM and the End of CVE ChasingTwo critical pre-authentication code injection flaws in Ivanti EMM, exploited as zero-days since before their disclosure.
Read more about Emerging Threat: (CVE-2026-1281 & CVE-2026-1340) Ivanti EPMM Unauthenticated RCE via Code InjectionA remote code execution vulnerability in Apache ActiveMQ Classic’s Jolokia JMX-HTTP bridge allows an authenticated attacker to load a malicious Spring XML configuration and execute arbitrary commands.
Read more about Emerging Threat: (CVE-2026-34197) Apache ActiveMQ Remote Code Execution via Jolokia APIA critical unauthenticated arbitrary file upload flaw in the Ninja Forms – File Uploads WordPress plugin allows attackers to bypass extension validation and upload PHP webshells, enabling full remote code execution on the underlying web server.
Read more about Emerging Threat: (CVE-2026-0740) Ninja Forms File Upload Unauthenticated RCEA critical improper access control flaw in Fortinet FortiClient EMS allows unauthenticated attackers to bypass API authentication and execute unauthorized code or commands on the management server, with active exploitation observed in the wild.
Read more about Emerging Threat: (CVE-2026-35616) Fortinet FortiClient EMS Improper Access ControlAn authentication bypass in the Cisco Integrated Management Controller allows an unauthenticated remote attacker to reset any user’s password via a single crafted HTTP request, granting full administrative control over the server hardware below the operating system layer.
Read more about Emerging Threat: (CVE-2026-20093) Cisco IMC Authentication BypassA critical arbitrary file write vulnerability in Grafana’s SQL expressions feature can be chained with a Grafana Enterprise plugin to achieve full remote code execution on the underlying host.
Read more about Emerging Threat: (CVE-2026-27876) Grafana Remote Code Execution via SQL Expressions