🧩 CVEs
Apache HTTP/2 RCE Flaw CVE-2026-119618: Upgrade to 2.4.71 Advised
A critical mod_http2 flaw in Apache 2.4.55 to 2.4.70 lets unauthenticated attackers take over the server process. Upgrade to 2.4.71 or disable HTTP/2.
🧩 Vulnerabilities & CVEs
Zero-days, critical CVEs and patch alerts: actively exploited vulnerabilities, CISA KEV additions and fixed versions.
🧩 CVEs
Citrix Fixes Critical NetScaler ADC and Gateway Vulnerabilities
Citrix patched critical NetScaler ADC, Gateway and Console flaws that can cause denial of service or authentication bypass, including CVE-2026-120868 (9.3).
🧩 CVEs
PostgreSQL Fixes 52 Flaws, Including RCE Bug CVE-2026-6460
PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 flaws, led by CVE-2026-6460 (CVSS 8.8), which lets a database user run code on the server.
🧩 CVEs
UnrealIRCd Flaw CVE-2026-114713 Exploited for Command Injection
CISA lists an exploited UnrealIRCd flaw (CVSS 8.6): any user on a network of linked servers can inject commands that run with server privileges.
🧩 CVEs
Outlook Zero-Day CVE-2026-124194 Leaks NTLM Hashes: Patch Advised
November Patch Tuesday fixes an exploited Outlook zero-day: a crafted message file silently connects to an attacker's server and leaks the user's NTLMv2 hash.
🧩 CVEs
Chrome Zero-Day CVE-2026-125350 Under Attack: Update Advised
Chrome 157.0.8103.50 fixes an exploited use-after-free flaw in an XML component, now listed in CISA KEV. Edge, Opera and other Chromium browsers are at risk.