What is being exploited right now
Short, sourced briefings on actively exploited vulnerabilities and notable security developments. Every item is a plain-language summary of public reporting, with links to the authoritative source.
Curated from public advisories — the CISA Known Exploited Vulnerabilities (KEV) catalog, the NIST National Vulnerability Database (NVD) and GitHub Security Advisories (GHSA). Summaries are our own; follow the source links for the full, authoritative detail.
-
Six new entries added to the exploited-vulnerabilities catalog this week
The CISA KEV catalog (version 2026.07.10) passed 1,637 tracked vulnerabilities, with six entries added between 7 and 10 July 2026 — spanning Langflow, Adobe ColdFusion and several CMS page-builder components exploited through unrestricted file upload. The common thread: internet-facing software with weak upload or authorization controls.
Exposure Management flags KEV-listed CVEs on your internet-facing assets first. →Sources: CISA KEV catalog ↗ -
File Browser authentication bypass via forged proxy-auth header
GitHub Security Advisory GHSA-xqp3-jq6g-x3qm (CVE-2026-54089) describes an authentication bypass in File Browser, a popular self-hosted file-management tool. Where proxy authentication is enabled, a forged proxy-auth header can be trusted, letting an unauthenticated request act as an authenticated user. Self-hosted tools reachable from the internet are common initial footholds; review exposure and update per the advisory.
-
A second Langflow flaw lands in CISA's exploited-vulnerabilities catalog
CISA added CVE-2026-55255, an authorization-bypass in Langflow, to its Known Exploited Vulnerabilities catalog on 7 July 2026. According to the catalog, an authenticated attacker can run a flow belonging to another user by supplying the victim's flow ID in the request. It follows the unauthenticated RCE (CVE-2025-3248) that made Langflow a repeat target in 2025.
Our Langflow write-up covers why AI-tooling endpoints keep getting hit. → -
Adobe ColdFusion path-traversal flaw added to KEV
A path-traversal vulnerability in Adobe ColdFusion, CVE-2026-48282, was added to the CISA KEV catalog on 7 July 2026. The catalog notes it can lead to arbitrary code execution in the context of the current user. ColdFusion has a long history of internet-facing exploitation, so exposed instances should be patched or taken offline per vendor guidance.
-
SharePoint Server deserialization bug under active exploitation
CVE-2026-45659, a deserialization-of-untrusted-data flaw in Microsoft SharePoint Server, was added to KEV on 1 July 2026. Per the catalog, an authorized attacker can execute code over the network. On-premises SharePoint remains a high-value internet-facing target; organizations running it should confirm the current update is applied.
-
SimpleHelp OIDC bypass lets forged tokens grant technician sessions
CVE-2026-48558 is an authentication-bypass in SimpleHelp's OIDC login flow, added to KEV on 29 June 2026. The catalog states that identity tokens are accepted without verifying their signature, so in a vulnerable configuration a remote, unauthenticated attacker can submit a forged token to obtain a fully authenticated technician session — in some setups bypassing MFA. Remote-support tools are prime footholds; patch urgently.
-
LiteLLM AI-gateway auth bypass via a Host-header parsing flaw
NVD published CVE-2026-49468 (CVSS 9.8) in LiteLLM, a widely used proxy that fronts LLM APIs in OpenAI format. Before version 1.84.0, the auth layer derived the request route from the Host header, so under specific conditions an unauthenticated request could reach protected management routes. AI gateways sit in front of model traffic, which makes an auth bypass here especially consequential. Upgrade to 1.84.0 or later.
SDefender reaches models only through its own MCP gateway, with data masked at the perimeter. →Sources: NVD ↗ -
n8n automation platform can be coerced into exfiltrating stored credentials
CVE-2026-56348 (CVSS 9.1), published on NVD, affects the n8n workflow-automation platform before 2.20.0. An authenticated user can bypass the Allowed HTTP Request Domains restriction through the dynamic-node-parameters endpoint, causing the server to send requests carrying stored credentials to unauthorized hosts. Automation platforms hold broad credentials, so a bypass like this turns one account into a credential-exfiltration path.
Sources: NVD ↗
No briefings match that search. Try a CVE number, a vendor, or a broader term.
We keep the most recent briefings here; older items age off this page. Full history always remains in the linked catalogs.
See these on your own attack surface
SDefender Exposure Management surfaces KEV-listed vulnerabilities on your internet-facing assets, worst-risk first.