Security advisories, explained
New security updates for widely used software and devices, written for three readers at once: everyday users, junior developers and the people who run servers. Each page covers what went wrong, which versions are affected, how to check yours, and how to update using commands from official documentation only.
Versions come from the vendor advisory, CVSS scores and weakness types from NVD, and exploitation status only from the CISA Known Exploited Vulnerabilities (KEV) catalog. Pages are checked automatically against those sources before they go live. Advisories for Korea-only products are kept on the Korean edition.
- Network & security appliancesSophosSophos UTM Path Traversal Allows Root Code ExecutionA critical Sophos UTM flaw can let an unauthenticated attacker run code as root when email proxy scanning is enabled.
- Servers & enterprise softwareAtlassianKnown exploitedBitbucket Data Center File Access Flaw ExplainedAtlassian's file access flaw affects Bitbucket Data Center and other products, with confirmed exploitation and fixes available.
- Servers & enterprise softwareOracleKnown exploitedOracle Payments flaw allows unauthenticated takeoverOracle Payments and Oracle Application Object Library need security patches for critical flaws, including a known exploited vulnerability.
- Servers & enterprise softwareVMwareKnown exploitedVMware ESX Logging Flaw Is Known to Be ExploitedVMware ESX has a logging flaw that can hide certain administrator actions, and CISA lists it as known to be exploited.
- Servers & enterprise softwareLinuxLinux Kernel Use-After-Free Flaw ExplainedA critical Linux Kernel networking flaw involves freed memory. Learn which fixes are listed and how to check your running kernel.
- Network & security appliancesCiscoKnown exploitedCisco Secure Firewall ASA and FTD Denial of ServiceCisco's Secure Firewall ASA and Secure Firewall FTD have a known exploited VPN flaw that can restart affected devices.
- NASSynologySynology DSM flaws allow file access and disruptionSynology DSM updates fix critical and high-severity flaws that can expose files, allow file changes, or disrupt service.
- Network & security appliancesPalo Alto NetworksKnown exploitedPAN-OS Memory Corruption Flaws: Exploitation and FixesPalo Alto Networks PAN-OS has critical memory corruption flaws known to be exploited. Check affected releases and fixes.
- NASSynologyKnown exploitedSynology Calendar and PHP Memory Corruption FlawsSynology Calendar, Mail Station and PHP updates address critical memory flaws that CISA lists as known to be exploited.
- Servers & enterprise softwareSambaSamba Access Control Bypass Exposes Restricted FilesA Samba flaw can let signed-in users read or overwrite restricted files when the experimental vfs_ceph_rgw module is configured.
- Network & security appliancesJuniper NetworksSession Smart Router path traversal and other flawsJuniper Networks has fixes for Session Smart Router and Session Smart Conductor flaws. Check affected releases and update.
- Servers & enterprise softwareLinuxKnown exploitedLinux Kernel Memory Corruption: Fixes and ImpactLinux Kernel CVE-2026-46300 can corrupt memory during network processing, and CISA lists it as known to be exploited.
- Desktop softwareAdobeKnown exploitedAdobe Commerce and Connect Code Execution FlawsAdobe Commerce and Connect have critical code execution flaws, and CISA confirms known exploitation of the Commerce vulnerability.
- Servers & enterprise softwareJFrogKnown exploitedJFrog Artifactory Authentication Flaw ExplainedA known-exploited JFrog Artifactory flaw can grant administrative access without a login. Check affected versions and update.
- Network & security appliancesSplunkSplunk AI Toolkit: SSRF and Deserialization FlawsSplunk lists security fixes across AI Toolkit and related apps, with different affected versions and update targets to check.
- Network & security appliancesCiscoCisco Expressway Series: Multiple Security FlawsCisco's advisory covers security flaws in Expressway Series and related products, with release-specific updates and migration guidance.
- Servers & enterprise softwareRedisRedis RESTORE Flaw Can Corrupt Server MemoryA Redis memory corruption flaw can allow code execution through RESTORE. Patched releases and command restrictions address the risk.
- Servers & enterprise softwareGoogleKnown exploitedGoogle Brotli Memory Corruption: Updates ExplainedGoogle Brotli has a critical decoder flaw known to be exploited. Learn which versions are affected and how to verify an update.
- Servers & enterprise softwareNode.jsNode.js Fixes DNS and TLS Verification FlawsNode.js updates address DNS hostname handling and TLS certificate checks that can cause applications to trust the wrong destination.
- Servers & enterprise softwareLaravelLaravel Framework Flaw Allows Authentication BypassLaravel Framework updates fix a TokenGuard flaw that can let unauthenticated attackers access an existing user's account.
- Servers & enterprise softwareOracleOracle Java SE Flaw Puts Sensitive Data at RiskOracle Java SE, GraalVM and OpenJDK updates address a critical security flaw that can expose data or allow unauthorized changes.
- Servers & enterprise softwareGitLabGitLab CE/EE Flaws Allow Server Code ExecutionGitLab CE/EE fixes address server code execution, account takeover, and sign-in redirection risks across affected releases.
- Network & security appliancesFortinetFortiSIEM Path Traversal Flaw Can Allow Code ExecutionFortinet FortiSIEM 7.5.0 has a critical path traversal flaw that may allow unauthorized code execution. Upgrade to 7.5.1 and later.
- Servers & enterprise softwarePHPKnown exploitedPHP Memory Corruption Flaws: Fixes and ExploitationPHP has critical memory corruption flaws known to be exploited. Learn which releases are affected and how to verify an update.
- Servers & enterprise softwareAhsayKnown exploitedAhsayCBS Authentication and Command Injection FlawsAhsayCBS flaws are known to be exploited, according to CISA. Updated releases address authentication and command injection issues.
Explainers are written with AI from official data and published only after automated fact checks. They are general guidance, not a substitute for the vendor's advisory.