Security Research
Deep-dive technical analysis, CVE breakdowns, threat actor profiles, and mobile security research. Written by practitioners, for practitioners.
CVE-2026-0006: Heap Buffer Overflow Enabling Unauthenticated RCE
A heap buffer overflow in a cross-platform parsing component allows unauthenticated remote code execution via crafted network input. No user interaction required; CVSS 9.8.
CVE-2025-20658: MediaTek Download Agent Logic Flaw Enables Local Privilege Escalation via Physical Access
A logic error in MediaTek's Download Agent permits permission bypass and local privilege escalation on affected devices. Organizations managing shared or high-value endpoints should treat this as an urgent patching priority.
CVE-2026-27289: Out-of-Bounds Read in Adobe Photoshop Desktop Enables Code Execution via Malicious File
A high-severity memory corruption flaw in Adobe Photoshop Desktop allows attackers to achieve code execution by tricking victims into opening a crafted file. CVSS score: 7.8.
CVE-2026-27284: Critical Memory Corruption Vulnerability in Adobe InDesign Desktop
Adobe InDesign Desktop suffers from an out-of-bounds read vulnerability that could allow attackers to execute arbitrary code. User interaction required through malicious file opening.
CVE-2026-27283: Critical Use-After-Free Vulnerability in Adobe InDesign Desktop
Adobe InDesign Desktop contains a high-severity Use-After-Free vulnerability allowing arbitrary code execution. User interaction required through malicious file opening.
CVE-2026-27238: Critical Heap Buffer Overflow in Adobe InDesign Desktop Enables Remote Code Execution
Adobe InDesign Desktop versions 20.5.2 and 21.2 contain a heap-based buffer overflow vulnerability allowing arbitrary code execution. Exploitation requires opening malicious files.
CVE-2026-38527: Critical SSRF Vulnerability in Webkul Krayin CRM Webhook Component
A high-severity Server-Side Request Forgery vulnerability in Krayin CRM's webhook creation endpoint allows attackers to scan internal infrastructure. The flaw affects version 2.2.x installations.
CVE-2026-23708: Critical Authentication Bypass in Fortinet FortiSOAR Through 2FA Replay Attack
A high-severity vulnerability allows unauthenticated attackers to bypass two-factor authentication in FortiSOAR platforms. The flaw enables replay attacks against captured 2FA requests.
CVE-2026-22828: Critical Heap Buffer Overflow in Fortinet Cloud Management Platforms
A high-severity heap buffer overflow in FortiAnalyzer and FortiManager Cloud allows remote code execution. ASLR and segmentation provide some protection.
Critical Authentication Bypass in Siemens Industrial Edge Management Exposes OT Networks
CVE-2026-33892 allows unauthenticated attackers to bypass authentication in Siemens Industrial Edge Management systems. Industrial organizations must patch immediately to prevent unauthorized access to critical infrastructure devices.
CVE-2026-33892: Critical Authentication Bypass in Industrial Edge Management Systems
A high-severity vulnerability allows unauthenticated attackers to impersonate legitimate users in Industrial Edge Management systems. Remote exploitation possible through header manipulation.
Critical Memory Corruption in Qualcomm Firmware Exploited in Wild: CVE-2026-21385 Analysis
A critical memory alignment vulnerability in Qualcomm firmware is being actively exploited, allowing attackers to achieve arbitrary code execution. Security teams must prioritize patching immediately.
Get new research delivered weekly. Join security professionals getting the CypherByte digest.