cve 2026

The vulnerability described as CVE-2026-27448 appears to be centered on a subtle but important failure mode in pyOpenSSL: if an application’s set_tlsext_servername_callback throws an exception that is not handled correctly, the TLS handshake can be bypassed or left in an unsafe state. In...

Microsoft’s Security Update Guide has become one of the clearest ways to track how upstream open-source flaws travel into the enterprise software supply chain, and CVE-2026-3934 is a good example of why that matters. In this case, Microsoft is surfacing a Chromium-era ChromeDriver issue that can...

A malicious tarball can now quietly escape the bounds of a safe extraction and overwrite files on the host: a newly tracked vulnerability in the widely used Node.js tar library (node‑tar) — identified as CVE‑2026‑29786 — allows a specially crafted hardlink entry whose linkpath uses a...

Microsoft’s advisory for CVE-2026-26113, labeled as a “Microsoft Office Remote Code Execution Vulnerability,” has sparked confusion across security teams because the published CVSS vector lists the Attack Vector as Local (AV:L) — a seeming contradiction that deserves a careful, technical...