#Exploited

Arista has released fixes for CVE-2026-114625, an exploited SQL injection flaw that lets any logged-in VeloCloud Orchestrator user, down to the lowest built-in tenant role, gain operator privileges.…

Terra Security found that 2.3% of GitHub security fixes in 2026 needed a follow-up advisory for a failed patch within 90 days, up from about 0.2% in 2019-2025.…

CERT-In says internet-facing or critical systems should be patched, mitigated, or cut off within half a day where feasible

MetInfo CMS is actively exploited via CVE-2026-29014, a critical PHP code injection vulnerability that allows unauthenticated attackers to gain full remote control of servers.…

From MakeUseOf: Not every security vulnerability means you need to update right now — here's how to know which ones do

CVE-2026-31431 lets attackers escalate to root on Linux systems and is actively exploited, forcing urgent security fixes across major distros.

From Dev.to - cybersecurity: Pre-Auth SQLi Flaw in LiteLLM Gateway Actively Exploited to Steal AI Credentials

From The Register: Microsoft's patch for a 0-day exploited by Russian spies fell short. Another Windows flaw is under attack

From Dev.to - cybersecurity: LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure

From Reddit - r/cybersecurity: CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV

CISA has added CVE-2025-48700, an actively exploited XSS vulnerability in Zimbra Collaboration Suite's Classic UI, to its Known Exploited Vulnerabilities Catalog.…