Vulnerabilities
EPSS Percentiles: Prioritise Patching by Real-World Exploit Risk
EPSS percentiles reveal that most vulnerabilities never see wild exploitation, allowing teams to ignore low-risk CVEs and focus finite resources on genuine threats.
Vulnerabilities
Vulnerabilities coverage from DarkWeb Dispatch holds 36 articles, 25 of them reference guides. The newest was published on October 16, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include National Vulnerability Database and CVE Program.
Vulnerabilities
How Citrix NetScaler Flaws Work: The Attack Chain Explained
NetScaler breaches often bypass perimeter defences by exploiting how the application delivery controller processes untrusted input before authentication occurs.
Vulnerabilities
How to Spot JWT Vulnerabilities Before They Breach Your System
Weak signing algorithms and missing expiry times often hide in plain sight, allowing attackers to forge tokens without triggering standard security alerts.
Vulnerabilities
Prevent Microsoft Exchange Vulnerabilities: Priority Measures
Segmentation stops lateral movement faster than patching because attackers exploit the gap between update and restart.
Vulnerabilities
Browser Extension Vulnerabilities: Risks and Protection for Small Businesses
Browser extensions often possess deeper system privileges than the websites they visit, turning a simple productivity tool into a vector for persistent data theft.
Vulnerabilities
Runtime Application Self-Protection (RASP): Definition and Purpose
Runtime Application Self-Protection sits inside your code to see attacks in real time, stopping threats that external tools miss by understanding context.
Vulnerabilities
How Disputed and Rejected CVEs Affect Your Patching Strategy
Rejected CVEs often indicate misclassification rather than safety, requiring manual validation before you skip a vendor patch.
Vulnerabilities
Broken Object Level Authorisation: Response and Recovery Steps
Broken object level authorisation fails because the application trusts the client to define access rights, allowing lateral data theft without further authentication.
Vulnerabilities
Wormable Vulnerabilities: What Small Businesses Need to Know
Wormable flaws bypass human interaction to spread automatically, turning a single unpatched device into a rapid network-wide crisis within minutes rather than days.
Vulnerabilities
How ReDoS Works: Step-by-Step Attack Mechanics
Regular expression denial of service exploits catastrophic backtracking in pattern matching engines to freeze application threads indefinitely.
Vulnerabilities
Fuzz Testing Misconceptions: What Automated Inputs Actually Reveal
Fuzz testing finds crashes by breaking inputs, not by understanding business logic or validating security policies against known attack vectors.
Vulnerabilities
Mitigations and Workarounds: How to Secure Systems When Patches Fail
Technical controls often provide stronger protection than code fixes by blocking the attack path regardless of whether the underlying bug remains unpatched.
Vulnerabilities
WordPress Plugin Update Policy Mistakes and How to Fix Them
Automating updates without verifying digital signatures exposes your server to supply-chain attacks that mimic legitimate software releases.
Vulnerabilities
Verify OAuth Secrets After Researcher Exposes Google Dev Site RCE Flaw
A security researcher demonstrates unauthenticated remote code execution on Google developer sites via a leaked signing key in session cookies.
Vulnerabilities
Apply Fixes for IBM i HTTP Server Admin to Mitigate Critical CVE-2026-96119 Authenticated RCE Threat
A critical vulnerability in IBM i allows remote attackers to execute code via the HTTP Server Administration web application, affecting versions 7.3 through 7.6.
Vulnerabilities
Update AhsayCBS 10.3.4: Huntress finds chained CVEs still allow webshells and miners on unpatched systems
Huntress researchers report that threat actors are chaining two vulnerabilities in AhsayCBS to deploy webshells and disguised cryptocurrency miners on unpatched systems.
Vulnerabilities
Difference between session fixation and session hijacking
Attackers force you to use their chosen identifier before login, bypassing the randomisation that usually protects your active connection to a web application.
Vulnerabilities
Remediate BIND, Struts, Strapi, ONLYOFFICE, ProFTPD flaws by Oct 11, 2026 CISA KEV deadline
CISA added five exploited vulnerabilities to its catalog. Each entry lists a due date of 11 October 2026 for remediation.
Vulnerabilities
Secure AhsayCBS Backup Servers Against Active Zero-Day Exploits
Threat actors are exploiting two unpatched vulnerabilities in Ahsay Cloud Backup Server to gain SYSTEM-level access and deploy malicious payloads on exposed infrastructure.
Vulnerabilities
Patch Privasys Go Before v0.5.1 to Block Critical Enclave Impersonation via CVE-2026-108267
A critical vulnerability in Privasys Go allows attackers to relay attestation certificates, enabling them to impersonate secure enclages on remote servers.
Vulnerabilities
Upgrade Apache Camel Karavan to 4.22.1 Immediately to Mitigate Critical RCE via Path Traversal
Authenticated users can exploit CVE-2026-103412 in Apache Camel Karavan to execute remote code via path traversal, requiring an immediate upgrade to version 4.22.1.
Vulnerabilities
Update Vikunja to 2.4.0 now to prevent attackers from hijacking accounts via leaked database tokens
Open-source task manager Vikunja patched a high-severity flaw where database leaks allowed attackers to hijack accounts using exposed password-reset tokens.
Vulnerabilities
Fix Protection Mechanism Failure in IBM Identity to Stop Authenticated RCE via CVE-2026-16916
A protection mechanism failure in IBM identity products allows authenticated attackers to run arbitrary code, posing a severe risk to enterprise access controls.
Vulnerabilities
Zero-Day Vulnerabilities: Risks and Protection for Small Businesses
Small firms face disproportionate risk from zero-days because they lack the specialised teams that large enterprises use to manage unpatched software flaws.