Skip to main content

Langflow Unauthenticated Authentication Bypass and Remote Code Execution (CVE-2026-93680 / CVE-2026-110186)

Scope: Langflow, versions 1.0.0 through 1.12.8, fixed in 1.13.0

“KeyDrift” Malware Stole Cisco SD-WAN Encryption Keys for Years Before Detection (CVE-2026-20127)

Scope: Cisco Catalyst SD-WAN Controller, Manager, and Validator (patched since February 20

Cisco Patches Actively Exploited ASA and FTD Firewall Crash Vulnerability (CVE-2026-76418)

Scope: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat

Attackers Chain Three Ivanti Connect Secure Flaws to Achieve Unauthenticated Root Access (CVE-2026-111357 / CVE-2026-118527)

Scope: Ivanti Connect Secure (ICS), versions prior to the latest patched release covering

Drupal Commerce Core Authorization Bypass Exploited in the Wild, Over 42,000 Stores Exposed (CVE-2026-118539)

Scope: Drupal Commerce Core, versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13

16-Year-Old EDK II UEFI Firmware Flaw Allows Code Execution Before Secure Boot on Network-Booting Servers

Scope: EDK II (TianoCore) UEFI firmware implementations supporting PXE network boot, acros

Attackers Already Scanning for Recently Patched Oracle E-Business Suite Flaw (CVE-2026-101767)

Scope: Oracle E-Business Suite, Application Object Library component (patched in Oracle’s

Subscribe to Advisories