CVE-2026-41613: Microsoft Visual Studio Code MCP Install Dialog Flaw (Envade)
A vulnerability in Microsoft Visual Studio Code's MCP install dialog (CVSS 8.8, aka Envade) enables full code execution or MCP tool call…
Category: Critical CVEs
Critical and exploited CVEs, vulnerability intelligence and remediation guidance.
CVE-2026-36425: Vulnerable OPSWAT Driver Exploited in Spark RAT Campaign
CVE-2026-36425 is a vulnerability in the OPSWAT AppRemover driver (ardrv.sys) that is exploited via a bring your own vulnerable driver (BYOVD) technique…
GPUThor Rowhammer Attack Bypasses ECC on NVIDIA RTX A6000 to Achieve Host Root Access
Academic researchers at the University of Toronto have disclosed a new Rowhammer attack, dubbed GPUThor, that defeats error correction codes (ECC) on…
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of…
CVE-2026-53362 — Linux Kernel Unspecified Vulnerability
Linux Kernel Unspecified Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on…
CVE-2023-49105 — ownCloud Improper Authentication Vulnerability
ownCloud Improper Authentication Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on…
CVE-2026-66384 — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with…
CVE-2019-19781: Citrix ADC Vulnerability
An N-day vulnerability in Citrix ADC exploited by QTFY.
CVE-2020-5902: F5 BIG-IP Vulnerability
An N-day vulnerability in F5 BIG-IP exploited by QTFY.
CVE-2019-10068: Kentico CMS Vulnerability
An N-day vulnerability in Kentico CMS used by QTFY.