CVE Cybersecurity News

Atlassian CVE-2026-21589: Critical File Access Vulnerability Affects 8 Data Center Products

RedSide Security October 06, 2026 CVE 123 views

Atlassian has disclosed critical vulnerability CVE-2026-21589 affecting eight self-hosted Data Center products, allowing unauthenticated attackers to read specific files from application root directories. Rated CVSS 9.3, the flaw affects Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye, with Atlassian urging customers to patch immediately.

Adobe ColdFusion Critical Vulnerabilities Enable Unauthenticated Remote Code Execution

RedSide Security August 12, 2026 CVE 184 views

Adobe has released urgent security updates for ColdFusion 2025 and 2023, fixing multiple critical vulnerabilities including a CVSS 10.0 unauthenticated OS command injection flaw that could enable remote code execution and full server compromise. Organizations should patch exposed ColdFusion deployments immediately.

15-Year-Old NGINX Vulnerability (CVE-2026-42533) Enables Pre-Auth Remote Code Execution

RedSide Security July 20, 2026 CVE 345 views

A newly disclosed NGINX vulnerability, CVE-2026-42533, has reportedly been exploitable since 2011 and allows unauthenticated attackers to achieve remote code execution through a flaw in the NGINX script engine. The bug affects both NGINX Open Source and NGINX Plus and has now been patched in versions 1.30.4 and 1.31.3.

Critical Linux Kernel Flaw Allows Unprivileged Users to Gain Root Access

RedSide Security June 28, 2026 CVE 228 views

Critical Linux kernel vulnerability CVE-2026-46331 allows unprivileged users to gain root access by exploiting a page-cache corruption flaw in the net/sched act_pedit subsystem. The issue affects Linux kernels 5.18 through 7.1-rc6 and has been successfully demonstrated against RHEL, Debian, and Ubuntu systems.

Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions

RedSide Security May 27, 2026 CVE 200 views

NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

RedSide Security May 17, 2026 CVE 241 views

A critical NGINX vulnerability tracked as CVE-2026-42945 is now being actively exploited in the wild, just days after public disclosure. The flaw allows attackers to crash NGINX worker processes and potentially achieve remote code execution under specific conditions. At the same time, threat actors have also begun weaponizing multiple critical vulnerabilities in openDCIM to deploy PHP web shells and gain remote access to exposed systems.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

RedSide Security May 10, 2026 CVE 175 views

A newly disclosed Linux kernel vulnerability chain, dubbed **Dirty Frag**, enables unprivileged local users to gain root access across major Linux distributions. The flaw combines two page-cache write issues in the xfrm-ESP and RxRPC subsystems, creating a deterministic and highly reliable privilege escalation method. Limited in-the-wild exploitation has already been observed, with attackers using it in post-SSH compromise scenarios.

cPanel & WHM Patches Three Vulnerabilities Including RCE and Privilege Escalation Flaws

RedSide Security May 09, 2026 CVE 180 views

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

RedSide Security April 08, 2026 CVE 196 views

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

RedSide Security April 04, 2026 CVE 1751 views