Vulnerability Roundup

August 2026 produced one genuine zero-day and eight vulnerabilities that were, in most cases, old news by the time anyone outside the vendor noticed them.

A finance employee at Arup, the London-based engineering and design firm behind projects like the Sydney Opera House’s structural design, joined a video call with

June 2026 was defined by a new enforcement regime colliding with an old credential problem: CISA’s Binding Operational Directive 26-04 replaced its flat six-month patching

May 2026 was defined by two parallel stories running at the same time: a historically clean Microsoft Patch Tuesday, the first with no actively exploited

April 2026 put authentication and management-plane failures at the centre of enterprise risk. Microsoft’s largest-ever Patch Tuesday by CVE count landed alongside a flurry of

March 2026 saw the release of several high impact vulnerabilities affecting enterprise applications, cloud platforms, and developer tools. This month’s incidents highlight the growing risks

Every month, a new set of vulnerabilities reveals how quickly the threat landscape continues to evolve. February 2026 exposed several critical weaknesses across widely used

January 2026 was a reminder that foundational security failures are still driving real-world compromises. This month’s disclosures cut across firewalls, identity systems, collaboration platforms, and

December 2025 saw the disclosure of several high-impact vulnerabilities affecting enterprise applications, cloud platforms, and developer tools. This month’s incidents highlight the growing risks in

November 2025 revealed a series of critical cybersecurity vulnerabilities affecting enterprise systems, cloud frameworks, and productivity applications. From remote code execution (RCE) in React Server