vuln.managementPosts, advisories, playbooks, and memes for modern vulnerability management.https://vuln.management/en-usA field guide to agentic vulnerability management (with an actual off switch)https://vuln.management/posts/agentic-vulnerability-management-field-guide/https://vuln.management/posts/agentic-vulnerability-management-field-guide/A practical operating model for introducing agents without confusing automation, authority, and accountability.Sat, 08 Aug 2026 00:00:00 GMTAgentsOperating modelFinding vulnerabilities is getting cheaper. The backlog has noticed.https://vuln.management/posts/finding-is-cheap/https://vuln.management/posts/finding-is-cheap/AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.Sat, 08 Aug 2026 00:00:00 GMTAI & agentsPrioritizationThe vulnerability ticket is an interface, not a filing cabinethttps://vuln.management/posts/vulnerability-ticket-interface/https://vuln.management/posts/vulnerability-ticket-interface/A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.Sat, 08 Aug 2026 00:00:00 GMTWorkflowRemediationGHSA-vwf4-m7j8-wcjf: Metabase says its critical zero-day was actively exploitedhttps://vuln.management/advisories/ghsa-vwf4-m7j8-wcjf-metabase/https://vuln.management/advisories/ghsa-vwf4-m7j8-wcjf-metabase/An unauthenticated SQL-injection path can lead to Metabase administrator access, exposed database credentials, and data theft.Thu, 06 Aug 2026 00:00:00 GMTAdvisoryMetabaseActive exploitationCVE-2026-63077: TeamCity unauthenticated RCE is in CISA KEVhttps://vuln.management/advisories/cve-2026-63077-jetbrains-teamcity/https://vuln.management/advisories/cve-2026-63077-jetbrains-teamcity/CISA reports that unsafe deserialization in the TeamCity agent polling protocol can permit unauthenticated remote code execution.Mon, 27 Jul 2026 00:00:00 GMTAdvisoryJetBrainsKnown exploitedCVE-2026-9198: Unauthenticated Langflow code injection is in CISA KEVhttps://vuln.management/advisories/cve-2026-9198-ibm-langflow/https://vuln.management/advisories/cve-2026-9198-ibm-langflow/CISA says default Langflow deployments may permit unauthenticated attackers to achieve full remote code execution.Thu, 02 Jul 2026 00:00:00 GMTAdvisoryIBMKnown exploitedCVE-2026-8037: Progress LoadMaster command injection is in CISA KEVhttps://vuln.management/advisories/cve-2026-8037-progress-loadmaster/https://vuln.management/advisories/cve-2026-8037-progress-loadmaster/CISA says an unauthenticated attacker can execute arbitrary commands through unsanitized input in multiple LoadMaster command endpoints.Mon, 01 Jun 2026 00:00:00 GMTAdvisoryProgressKnown exploited