Security Notices
CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
NetScaler memory overread requires SAML identity-provider configuration, not the gateway prerequisite of the neighboring CVE. Match standard or FIPS/NDcPP update branches and investigate suspected disclosure separately; CISA's exploitation listing does not establish appliance compromise.
CVE-2025-53521: F5 BIG-IP APM unauthenticated remote code execution
A stack-based buffer overflow in BIG-IP APM can permit remote code execution. Match the APM configuration and release branch, install the supported fix, and follow F5's additional mitigation and compromise-review guidance.
CVE-2025-43520: Apple kernel memory write or system crash
A malicious application can exploit this Apple kernel buffer overflow to terminate the system or write kernel memory. Match the device's operating-system branch and install its supported security update.
CVE-2025-43510: Apple shared-memory kernel corruption
Improper locking in the Apple kernel can let a malicious application alter memory shared between processes. Inventory each device's operating-system branch and install the matching update; this is not a separate application-package fix.
CVE-2025-31277: Apple WebKit memory corruption
Malicious web content can corrupt memory through this Apple WebKit flaw. Update the applicable operating system and Safari, checking Safari separately on the cited Mac branches; the reviewed description does not establish arbitrary code execution.
CVE-2026-20131: Cisco FMC unauthenticated Java deserialization RCE as root
Unauthenticated Java deserialization in Cisco FMC's web management interface can execute code as root. Cisco's SCC SaaS fix does not update independently managed FMC; use the Software Checker and preserve evidence before remediation.
CVE-2026-20963: SharePoint unauthenticated deserialization RCE
Microsoft's corrected SharePoint FAQ describes unauthenticated network code execution. Its March revision clarified prerequisites and scoring without changing the January update requirement; apply the applicable farm-wide fix and preserve evidence of possible earlier access.
CVE-2026-3909: Skia out-of-bounds write exploited through crafted web content
Crafted web content can trigger an out-of-bounds write in Skia. Update Chrome and check other Skia consumers through their own vendors; a fixed desktop browser does not certify Android, Flutter or embedded products as fixed.
CVE-2025-60710: Windows link-following privilege escalation
Improper link resolution in Host Process for Windows Tasks can elevate a local authorized attacker to SYSTEM. Microsoft's December 2025 re-release requires revised updates; November-only patch records do not establish protection against this ransomware-associated flaw.
CVE-2023-36424: Windows Common Log File System privilege escalation
Windows CLFS exploitation can elevate a local attacker from Medium to High Integrity Level; the source does not establish SYSTEM access. Use a supported superseding update, not an expired historical package, and investigate suspicious privilege transitions.