Track the current KEV landscape, jump into the newest year, and read analysis that explains why certain vendors and products keep getting hit.
Copy Fail demonstrated that Linux kernel privilege escalation flaws can sit undetected for nearly a decade. The Kernel Self Protection Project provides a systematic hardening baseline that raises the cost of exploitation across entire vulnerability classes — not just individual CVEs.
Cisco Secure Firewall Management Center (FMC) — Unauthenticated Remote Code Execution via Java Deserialization
CVSS 10Cisco Catalyst SD-WAN — CVSS 10.0 Peering Authentication Bypass Enabling Fabric-Wide NETCONF Access, Exploited by UAT-8616 Since 2023
CVSS 10Dell RecoverPoint for Virtual Machines (RP4VMs) — Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
CVSS 10WebPros cPanel & WHM — Pre-Auth CRLF Injection Grants Unauthenticated Root WHM Access
CVSS 9.8Marimo — Pre-Auth RCE via Unauthenticated Terminal WebSocket
CVSS 9.8Fortinet FortiClient EMS — Pre-Auth SQL Injection via Site HTTP Header
CVSS 9.8From Shellshock to MOVEit, seventeen named vulnerabilities tell the same story over and over: a forgotten service, a trusted dependency, a perimeter device, or a broken authentication assumption becomes the way in. This is a guide for anyone new to cybersecurity who wants to understand what real attacks look like and why they keep succeeding.
📰 Threat ClusterSeven Zimbra XSS CVEs across four years — all hitting the same Classic UI HTML sanitizer — exploited by Greek, Belarusian, Russian, Vietnamese, and Pakistani nation-state actors for email intelligence collection. Why the vulnerability keeps recurring, and what the exploitation pattern reveals about webmail as intelligence infrastructure.
📰 Threat ClusterFifteen Ivanti CVEs across EPMM, EPM, EPM CSA, and Sentry — plus sustained parallel exploitation in Fortinet FortiClient EMS and LANSCOPE endpoint management platforms — show a management-plane attack pattern spanning six years.
📰 Threat ClusterFive CVEs across two exploitation waves — a CVSS 10.0 zero-day active since 2023, a re-weaponised four-year-old privilege escalation, and a three-CVE zero-credential-to-admin chain added with a three-day CISA deadline — document an adversary with protocol-level knowledge of Cisco SD-WAN systematically compromising enterprise WAN management planes.