CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial of service under specific deployment conditions. The issue affects customer-managed NetScaler deployments running affected supported versions when the required preconditions are met. Customers should review their deployed versions and configurations, then install the relevant updated versions as soon as possible. Vendor details https://community.citrix.com/techzone-bl…

August 21, 2026. CVSS 10.0. Deserialization. Microsoft patched a remote code execution vulnerability in Entra ID, its cloud identity service — and told customers to do nothing. The flaw, CVE-2026-69836, is rated CVSS 10.0, the maximum score, and stems from the deserialization of untrusted data that let an unauthenticated attacker execute code over the network. The line to remember is not technical. It sits in Microsoft’s advisory: “This vulnerability has already been fully mitigated by Microsof…

There is an interesting connection between this vulnerability and CVE-2026-13230, which affects the same TP-Link Kasa EC70/EC71 devices. Recent research indicates that LG TVs send UDP/9999 discovery broadcasts approximately every 25 seconds. UDP/9999 is also used by the Kasa local discovery mechanism affected by CVE-2026-13230, which can disclose precise GPS coordinates without authentication. This suggests that, on a local network containing both an LG TV and an unpatched Kasa EC70/EC71, the …

[https://discourse.ifin.network/t/cve-2026-59309-critical-auth-bypass-in-broadcom-vmware-vcenter/746](https://discourse.ifin.network/t/cve-2026-59309-critical-auth-bypass-in-broadcom-vmware-vcenter/746)

I am the finder and reporter credited in the CVE record for CVE-2026-14440. This vulnerability concerns Cloudflare Universal SSL’s automatic management of the effective CAA RRset. On affected Universal SSL zones, the CAA RRset served by Cloudflare authoritative DNS can supersede customer-configured CAA records. Consequently, RFC 8657 `accounturi` and `validationmethods` constraints may not be visible to the Certificate Authority and are not preserved end-to-end. Successful exploitation is non-…

The CPE should be the following https://cpe.gcve.eu/products/247ca129-a593-5b5c-bca8-d120330743ad cpe:2.3:a:realtek:jungle_sdk:*:*:*:*:*:*:*:*

Note: If MISP.disableUserSelfManagement is enabled on the instance, non-admin users can not use the vulnerable endpoint. Admins = org admins or site admins

[https://arxiv.org/abs/2504.17473](https://arxiv.org/abs/2504.17473) The digital economy runs on Open Source Software (OSS), with an estimated 90\% of modern applications containing open-source components. While this widespread adoption has revolutionized software development, it has also created critical security vulnerabilities, particularly in essential but under-resourced projects. This paper examines a sophisticated attack on the XZ Utils project (CVE-2024-3094), where attackers exploited …

For more details [https://security.paloaltonetworks.com/CVE-2026-0300](https://security.paloaltonetworks.com/CVE-2026-0300)

# Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama | Cyera Research TL;DR ----- Ref: [https://www.cyera.com/research/bleeding-llama-critical-unauthenticated-memory-leak-in-ollama](https://www.cyera.com/research/bleeding-llama-critical-unauthenticated-memory-leak-in-ollama) We discovered a critical vulnerability (CVE-2026–7482, CVSS 9.1) in Ollama that enables unauthenticated attackers to leak the entire Ollama process memory, potentially impacting **300,000** servers globally. …