[?] Related tags:
A crafted regular expression in a CI/CD configuration overflows an integer in Ruby's Onigmo regex engine and turns a GitLab Puma worker into a shell as the git user. CVSS 10.0, listed in CISA KEV on October 29, 2026, exploitation attempted against Alpine Linux's GitLab.
Citrix patched eight NetScaler CVEs on a Sunday, two of them already exploited as zero-days. CVE-2026-88771 affects every ADC and Gateway on an affected build -- default configuration included -- and the August builds most teams installed do not contain the fix.
One crafted request to an unauthenticated API endpoint hands an attacker the box that decides who is allowed on your network -- and then root on it. CVSS 10.0, exploited as a zero-day, in CISA KEV on September 16 with a three-day federal deadline, and no workaround that does not involve an ACL.
Two concurrent multipart requests to an unauthenticated Struts action hand an attacker Jetty's live configuration, and from there a root-adjacent shell on the box that manages every endpoint an MSP touches. CVSS 10.0, exploited before disclosure, in CISA KEV on September 8 -- the fourth N-central hotfix in five weeks.
A default-configuration authentication weakness in JFrog Artifactory lets an unauthenticated attacker mint administrator tokens. Patched on August 28, exploited in the wild by September 1, in CISA KEV by September 2 -- and the box it compromises is the one your entire build pipeline trusts.
Citrix shipped the fix on June 30 and called it a denial of service. Seven weeks later watchTowr turned the same heap overflow into pre-auth root, and web shells landed on unpatched NetScaler appliances within days -- CISA added it to KEV on August 26 with a three-day deadline.
Four separate failures in SharePoint's JWT validation pipeline let an unauthenticated attacker forge a token for any user -- including a site administrator -- and CISA added it to the KEV catalog on August 18 after exploitation followed the public PoC within a day.
A deserialization flaw in Microsoft SharePoint Server lets an authenticated low-privilege user run code on the server -- now added to the CISA KEV catalog under confirmed active exploitation
A missing-authentication flaw in Splunk Enterprise's PostgreSQL sidecar service lets unauthenticated attackers create and overwrite arbitrary files -- chained into remote code execution, actively exploited in the wild, and the first Splunk bug ever added to CISA KEV
An unauthenticated SQL injection in Drupal core's PostgreSQL EntityQuery handler -- anonymous attackers turn JSON object keys and JSON:API filter parameters into raw SQL fragments. Drupal-rated 23/25 'Highly Critical', CISA KEV, 15,000+ exploit attempts in 48 hours
A buffer overflow in the PAN-OS User-ID Authentication Portal lets a remote, unauthenticated attacker pop a root shell on PA-Series and VM-Series firewalls -- CVSS 9.3, CISA KEV, actively exploited by a likely state-sponsored cluster (CL-STA-1132)
A nine-year-old logic bug in the Linux kernel's algif_aead crypto module lets any local user write 4 bytes into the page cache of any readable file -- root, container escape, no race condition, public PoC
root@sekurity:~# echo "End of results for tag: CISA KEV"
End of results for tag: CISA KEV
root@sekurity:~# _