cisa-kev

A Joomla Editor and a Magento Cache Warmer Both Delivered Unauthenticated RCE at 9.8

Widget Factory's JCE editor and Mirasvit's Full Page Cache Warmer reached identical maximum severity through completely different root causes — a missing permission check and a PHP deserialization flaw.

Two D-Link Router CVEs, Both on End-of-Life Hardware, Both Feeding Mirai-Style Botnets

A 9.8 buffer overflow in Go-RT-AC750 routers and a command injection in the DIR-823X, both confirmed exploited, both on hardware D-Link has already moved past.

LiteLLM's AI Gateway Shipped a Critical SQL Injection and a Command Injection in the Same Patch Cycle

An unauthenticated SQL injection in API key checks and an authenticated command injection via MCP preview endpoints both hit BerriAI's LiteLLM proxy, fixed together in v1.83.7.

Three Linux Kernel Privilege Escalation Bugs, Three Unrelated Subsystems, One Shared Trust Boundary

A netfilter heap overflow, an ELF-loading integer overflow, and a crypto API resource-transfer bug all reached CISA's KEV within a year — each a fresh failure of the same local privilege boundary.

Eighteen Minutes: The Nx Console Supply Chain Compromise Timeline

A malicious Nx Console extension harvested developer credentials from disk and memory before being pulled from two marketplaces, in windows as short as 18 and as long as 36 minutes.

A 2017 Hikvision Camera Bug Is Still Getting Exploited in 2026

CVE-2017-7921 spans seven Hikvision camera product families and grants unauthenticated privilege escalation — confirmed exploited nearly nine years after its original disclosure.

Craft CMS's Perfect-Score CVE Was the Fix Behind an Older Fix

CVE-2025-32432 scores a maximum 10.0 and is confirmed exploited — and NVD's own record calls it an additional fix for a 2023 vulnerability that wasn't fully closed the first time.

cPanel, Gogs, and Adminer: When Convenience Tools Become the Attack Path

Three unrelated self-hosted admin tools — a hosting control panel, a Git server, and a database manager — each had a confirmed-exploited vulnerability targeting the same convenience-over-process tradeoff.

When the Perimeter Device Is the Vulnerability: Juniper and SonicWall Confirmed Exploited

A decade-old Juniper ScreenOS backdoor-style auth bypass and a current SonicWall SMA1000 authorization gap both let attackers seize control of the appliance meant to enforce access control.

A Decade Apart: GNU Bash and InetUtils Both Land on KEV for the Same Root Cause

A 2014 Shellshock-family Bash bug and a fresh telnetd argument injection in InetUtils both reached CISA's KEV catalogue, both driven by untrusted input crossing a privilege boundary.

SmarterMail's Triple Threat: Three Unauthenticated Roads to Full Compromise

In eleven days, SmarterMail picked up three confirmed-exploited CVEs, all unauthenticated, all tied to known ransomware use — file upload, password-reset bypass, and an API missing authentication.

Broadcom's VMware Stack: Three Confirmed-Exploited CVEs Across the Management Plane

vCenter Server, Aria Operations, and VMware Tools each contributed a confirmed-exploited vulnerability, spanning an unauthenticated RCE, a migration-time command injection, and a local privilege escalation.