Posts, advisories, playbooks, and memes for modern vulnerability management.https://vuln.management/en-ushttps://vuln.management/advisories/cve-2026-64849-mlflow/https://vuln.management/advisories/cve-2026-64849-mlflow/An unauthenticated MLflow webhook test can follow redirects into internal services or cloud metadata endpoints and return their responses.Wed, 19 Aug 2026 00:00:00 GMTAdvisoryMLflowKnown exploitedhttps://vuln.management/advisories/cve-2026-33824-windows-ike/https://vuln.management/advisories/cve-2026-33824-windows-ike/A critical double-free flaw in the Windows IKE service can allow an unauthenticated network attacker to execute code on a reachable system.Tue, 18 Aug 2026 00:00:00 GMTAdvisoryMicrosoftKnown exploitedhttps://vuln.management/advisories/cve-2026-55040-sharepoint/https://vuln.management/advisories/cve-2026-55040-sharepoint/A critical JWT authentication weakness can let an unauthenticated network attacker bypass SharePoint security controls and access protected data.Tue, 18 Aug 2026 00:00:00 GMTAdvisoryMicrosoftKnown exploitedhttps://vuln.management/advisories/cve-2026-59310-vcenter/https://vuln.management/advisories/cve-2026-59310-vcenter/A critical directory-traversal flaw in the vCenter Syslog server can allow an unauthenticated network attacker to execute arbitrary code.Tue, 18 Aug 2026 00:00:00 GMTAdvisoryBroadcomKnown exploitedhttps://vuln.management/advisories/cve-2026-65400-macos-screen-sharing/https://vuln.management/advisories/cve-2026-65400-macos-screen-sharing/A critical state-management flaw can let a network attacker authenticate to macOS Screen Sharing without valid credentials.Tue, 18 Aug 2026 00:00:00 GMTAdvisoryAppleKnown exploitedhttps://vuln.management/posts/agentic-vulnerability-management-field-guide/https://vuln.management/posts/agentic-vulnerability-management-field-guide/A practical operating model for introducing agents without confusing automation, authority, and accountability.Sat, 08 Aug 2026 00:00:00 GMTAgentsOperating modelhttps://vuln.management/posts/finding-is-cheap/https://vuln.management/posts/finding-is-cheap/AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.Sat, 08 Aug 2026 00:00:00 GMTAI & agentsPrioritizationhttps://vuln.management/posts/vulnerability-ticket-interface/https://vuln.management/posts/vulnerability-ticket-interface/A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.Sat, 08 Aug 2026 00:00:00 GMTWorkflowRemediationhttps://vuln.management/advisories/ghsa-vwf4-m7j8-wcjf-metabase/https://vuln.management/advisories/ghsa-vwf4-m7j8-wcjf-metabase/An unauthenticated SQL-injection path can lead to Metabase administrator access, exposed database credentials, and data theft.Thu, 06 Aug 2026 00:00:00 GMTAdvisoryMetabaseActive exploitationhttps://vuln.management/advisories/cve-2026-63077-jetbrains-teamcity/https://vuln.management/advisories/cve-2026-63077-jetbrains-teamcity/CISA reports that unsafe deserialization in the TeamCity agent polling protocol can permit unauthenticated remote code execution.Mon, 27 Jul 2026 00:00:00 GMTAdvisoryJetBrainsKnown exploitedhttps://vuln.management/advisories/cve-2026-9198-ibm-langflow/https://vuln.management/advisories/cve-2026-9198-ibm-langflow/CISA says default Langflow deployments may permit unauthenticated attackers to achieve full remote code execution.Thu, 02 Jul 2026 00:00:00 GMTAdvisoryIBMKnown exploitedhttps://vuln.management/advisories/cve-2026-8037-progress-loadmaster/https://vuln.management/advisories/cve-2026-8037-progress-loadmaster/CISA says an unauthenticated attacker can execute arbitrary commands through unsanitized input in multiple LoadMaster command endpoints.Mon, 01 Jun 2026 00:00:00 GMTAdvisoryProgressKnown exploited