CVE-2025-9491: Windows Shortcut Vulnerability Exploited by Armored Likho
CVE-2025-9491 is a now-patched Windows shortcut vulnerability (ZDI-CAN-25373) that allows remote code execution. Addressed by Microsoft in November 2025 Patch Tuesday, it…
Category: Critical CVEs
Critical and exploited CVEs, vulnerability intelligence and remediation guidance.
CVE-2026-41106 — Critical vulnerability brief
CVSS 9.3Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials Ravie LakshmananJul 02, 2026Malware / Cyber Attack Threat actors associated…
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories Ravie LakshmananJul 02, 2026Hacking News / Cybersecurity News This week’s…
CVE-2026-55116 — Critical vulnerability brief
CVSS 9A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in…
CVE-2026-55115 — Critical vulnerability brief
CVSS 9.9A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application…
CVE-2021-29441: Nacos Authentication Bypass
An old vulnerability in Nacos configuration server allowing authentication bypass by faking a web header. Used by WP-SHELLSTORM in an earlier campaign…
CVE-2025-64446: FortiWeb Path Traversal Vulnerability
A path traversal vulnerability in FortiWeb exploited via fake PoC repos in the ChocoPoC campaign. Allows attackers to read arbitrary files on…
CVE-2025-14847: MongoBleed Vulnerability
A vulnerability in MongoDB, exploited via fake PoC repos in the ChocoPoC campaign.
CVE-2024-49113 — Vulnerability brief
CVE-2024-49113 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…