Topic

Critical Vulnerabilities

Flaws in widely used software and hardware: who is exposed, what is fixed, and what remains open.

30 Oct 2026

Reported News

CVE-2026-111497 crosses libraries, runtimes and managed deployments. Verify the decoder in the actual workload.

1 Jul 2024

Technical Advisory · Retrospective 2024

A pre-authentication race condition showed why SSH keys, package backports and server patch state belong in separate checks.

19 Feb 2024

Technical Advisory · Retrospective 2024

The February 2024 ScreenConnect flaws put server ownership, administrative reach and tenant boundaries in the response scope.

31 Oct 2023

Technical Advisory · Retrospective 2023

CVE-2023-4966 linked a memory-disclosure flaw to reusable sessions that needed a separate recovery decision.

10 Oct 2023

Technical Advisory · Retrospective 2023

CVE-2023-44487 made request churn and protocol termination more useful questions than a connection count alone.

11 Sep 2023

Analysis · Retrospective 2023

CVE-2023-4863 required inventory of browsers, embedded renderers and image-processing workers.

2 Jun 2023

Analysis · Retrospective 2023

The 2023 campaign separated two jobs that incident tickets often collapse: closing the vulnerability and investigating earlier access.

31 Mar 2022

Technical Advisory · Retrospective 2022

Assess CVE-2022-22965 using the actual runtime, Spring dependencies, packaging and servlet container.

11 Dec 2021

Analysis · Retrospective 2021

A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.

2 Mar 2021

Analysis · Retrospective 2021

Exchange patch state, earlier exploitation and persistent access need separate evidence in a ProxyLogon response.