Skip to main content

Exim "Dead.Letter" – Unauthenticated RCE via BDAT Use-After-Free in GnuTLS Builds (CVE-2026-45185)

Scope: Exim Versions 4.97 – 4.99.2 (GnuTLS Builds Only – Debian/Ubuntu Default)

NGINX Rift – 18-Year-Old Heap Buffer Overflow in Rewrite Module Enables Unauthenticated RCE (CVE-2026-42945)

Scope: NGINX Open Source 0.6.27 – 1.30.0 / NGINX Plus R32 – R36

Fragnesia – Linux Kernel Local Privilege Escalation via XFRM ESP-in-TCP (CVE-2026-46300)

Scope: Linux Kernel (All Distributions – Kernels Released Before May 13, 2026)

YellowKey – BitLocker Bypass via Windows Recovery Environment (WinRE) Zero-Day

Scope: Windows 11, Windows Server 2022 and 2025

Severity: Red

GreenPlasma – Windows CTFMON Arbitrary Section Creation Zero-Day LPE

Scope: Windows 11, Windows Server 2022, 2025, and 2026

Severity: High

"Mini Shai-Hulud" Supply Chain Worm Compromises TanStack, Mistral AI, and 170+ npm/PyPI Packages (CVE-2026-45321)

Scope: npm (@tanstack, @mistralai, @uipath, @squawk, and others) / PyPI (mistralai, guardrails-ai)

Checkmarx Jenkins AST Plugin Backdoored by TeamPCP in Third Supply Chain Attack

Scope: Checkmarx Jenkins AST Plugin (Version 2026.5.09)

Severity: Red

Subscribe to Advisories