Complete article archive
668 published articles · Showing 361–372 · Newest first
SmarterMail Remote Command Execution via ConnectToHub API
Analysis of CVE-2026-24423, a missing authentication vulnerability in SmarterTools SmarterMail that allows remote command execution and has been linked to ransomware campaigns.
Read article →GitLab CI Lint API SSRF (CVE-2021-39935)
Analysis of a known exploited Server-Side Request Forgery vulnerability in GitLab Community and Enterprise Editions affecting the CI Lint API.
Read article →OS Command Injection in Sangoma FreePBX Endpoint Manager (CVE-2025-64328)
Analysis of CVE-2025-64328, an OS command injection vulnerability in the Sangoma FreePBX Endpoint Manager that allows authenticated users to gain remote system access as an asterisk user.
Read article →Sangoma FreePBX Administrative Authentication Bypass (CVE-2019-19006)
Analysis of CVE-2019-19006, an improper authentication vulnerability in Sangoma FreePBX that may allow unauthorized access to administrative services.
Read article →SolarWinds Web Help Desk Remote Code Execution (CVE-2025-40551)
Analysis of a deserialization vulnerability in SolarWinds Web Help Desk that allows unauthenticated remote code execution, including remediation priorities and validation methods.
Read article →Ivanti EPMM Unauthenticated Remote Code Execution (CVE-2026-1281)
A code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allows for unauthenticated remote code execution. Defenders must prioritize vendor mitigations and conduct compromise assessments on internet-facing instances.
Read article →Fortinet Authentication Bypass via FortiCloud SSO (CVE-2026-24858)
An authentication bypass vulnerability in multiple Fortinet products allows attackers with a FortiCloud account to access devices registered to other accounts when SSO is enabled.
Read article →Linux Kernel Integer Overflow (CVE-2018-14634) Privilege Escalation
An integer overflow in the Linux Kernel's create_elf_tables() function may allow local unprivileged users to escalate privileges via SUID binaries. This analysis focuses on identifying affected assets and verifying vendor-specific remediation.
Read article →SmarterMail Unauthenticated Arbitrary File Upload (CVE-2025-52691)
Analysis of CVE-2025-52691 in SmarterTools SmarterMail, a vulnerability allowing unauthenticated arbitrary file upload and potential remote code execution currently utilized in ransomware campaigns.
Read article →SmarterMail Administrative Account Takeover (CVE-2026-23760)
An authentication bypass in the SmarterMail password reset API allows unauthenticated attackers to reset administrator passwords, leading to full system compromise. This vulnerability is currently leveraged by ransomware campaigns.
Read article →GNU InetUtils telnetd Authentication Bypass (CVE-2026-24061)
A critical argument injection vulnerability in GNU InetUtils telnetd allows remote authentication bypass via the USER environment variable. This analysis details exposure paths and verification of remediation.
Read article →Microsoft Office Security Feature Bypass (CVE-2026-21509)
Analysis of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office affecting multiple versions, including those nearing or at end-of-life.
Read article →Page 31 of 56. This archive includes every published article; drafts and articles still processing are not public.
From government advisory to practical action
Vulnerability Assurance turns government cybersecurity reporting into original articles written for the people responsible for fixing vulnerabilities. Each analysis connects the source information to the decisions, corrective actions, and verification steps that matter in an affected environment.
Latest analysis
What our articles cover
- What happened: the vulnerability, the affected technology, and what the available evidence establishes.
- Who needs to act: relevant versions, configurations, exposure conditions, and operational dependencies.
- How to mitigate it: applicable patches, configuration changes, or compensating controls, with important limitations.
- How to verify the result: checks and retesting that can demonstrate whether the affected condition or exposure remains.
- What remains unresolved: uncertainty, residual risk, and follow-up work.
Analysis you can use here
Government advisories provide the evidence behind our reporting. Our articles explain that evidence in context and add practical mitigation and validation guidance. Source citations support the analysis; they do not replace it.
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗