Tag
CVE-2026-9198 chains two Langflow API endpoints into unauthenticated remote code execution on default deployments. IBM rates it CVSS 9.8, CISA calls it exploited, and the fix is a version bump plus three configuration
Manu Shukla 
The fix for a padding-oracle bug in Apache Tomcat's cluster encryption moved super.messageReceived() outside its try block. On the affected versions, a decrypt failure now forwards attacker bytes to a bare
Manu Shukla 
N-able's N-central hotfix closes an authentication bypass that was exploited as a zero-day from 31 July 2026. It does not remove the tunnel service the attacker registered on your managed endpoints. Here is the order
Manu Shukla 
CISA added SharePoint RCE CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog with a July 4, 2026 federal deadline. Here is the defensive patch-and-harden checklist for on-premises SharePoint Server.
Manu Shukla 