Author

Samir Haddad

Vulnerability analyst

Analyzes exploit development, patch windows, and disclosure timelines.

ExploitsPatch watchResearch

Coverage by Samir Haddad (8)

Fragnesia CVE-2026-46300 Linux kernel page cache local privilege escalation path

Fragnesia Linux Kernel Flaw Gives Local Attackers a Public Path to Root

Fragnesia, tracked as CVE-2026-46300, is a Linux kernel local privilege escalation flaw involving ESP/IPsec page-cache corruption, with public proof-of-concept code increasing patch urgency.

React Server Components CVE-2026-23870 denial-of-service path affecting Next.js App Router

Web Framework Security Exploits

CVE-2026-23870: React Server Components DoS Flaw Hits Next.js App Router Apps; How to Reproduce Safely and Patch

A high-severity React Server Components denial-of-service flaw can let unauthenticated attackers degrade vulnerable Next.js App Router apps through crafted Server Function requests.

FortiVoice CVE-2025-32756 zero-day RCE credential theft and network scanning diagram

Edge Appliances Exploits

Fortinet Patches Critical FortiVoice Zero-Day Exploited for Credential Theft and Network Scanning

Fortinet patched CVE-2025-32756, a critical unauthenticated RCE flaw exploited against FortiVoice systems for credential theft, FastCGI debugging and network scanning.

Intel Branch Privilege Injection CVE-2024-45332 speculative execution mitigation bypass diagram

CPU Security Exploits

Intel Branch Privilege Injection Flaw Undermines Six Years of Spectre v2 Hardware Defenses

Intel issued microcode mitigations for CVE-2024-45332, a Branch Privilege Injection flaw that can bypass Spectre v2 hardware defenses and leak privileged memory from affected systems.

SAP NetWeaver Visual Composer chained zero-day attack path for CVE-2025-31324 and CVE-2025-42999

Enterprise Apps Exploits

SAP Patches Second Critical NetWeaver Flaw After Researchers Link It to Chained Zero-Day Attacks

SAP patched CVE-2025-42999, a critical NetWeaver Visual Composer deserialization flaw linked to chained attacks that followed exploitation of CVE-2025-31324.

NGINX Rift CVE-2026-42945 rewrite module vulnerability diagram

Web Server Security Exploits

NGINX “Rift” Rewrite Module Flaw Confirmed as CVE-2026-42945

CVE-2026-42945 is now tracked as a heap-based buffer overflow in NGINX's rewrite module, affecting NGINX Open Source and NGINX Plus under specific rewrite-rule conditions.

Microsoft Exchange OWA CVE-2026-42897 zero-day mitigation diagram

Microsoft Exchange Exploits

Microsoft Confirms Exploited Exchange OWA Vulnerability as CVE-2026-42897

Microsoft has disclosed CVE-2026-42897, a high-severity Exchange Server Outlook Web Access vulnerability affecting on-premises deployments, with mitigation available while a permanent fix is pending.

Cisco SD-WAN zero-day CVE-2026-20182 authentication bypass poster

Network Security Exploits

Cisco Patches Critical SD-WAN Zero-Day Exploited by Sophisticated Threat Actor

Cisco patched CVE-2026-20182, a critical Catalyst SD-WAN Controller and Manager zero-day that can let remote attackers bypass authentication and manipulate SD-WAN fabric configuration.

Desks covered

Exploits

Latest

Jul 27, 2026, 5:44 AM EDT · Research · Cloud Security6 minEnterprise LLM Pricing Model Performance Comparison: The Economics of Model Migration

As cheaper tiers reach benchmark parity on standard corporate workloads, the migration question becomes governance and availability, not raw capability.

Jul 27, 2026, 5:42 AM EDT · Research · Cloud Security6 minBeyond Standard Scaling: Architectural Shifts, Agentic Vectors, and the Enterprise Security Risk of GPT-6

For CISOs and architects, the line between manageable infrastructure evolution and uncontained systemic risk runs through agentic vectors, not model size.

Jul 24, 2026, 3:25 PM EDT · Research · Cloud Security6 minAI Supply Chain Security Risks: How OpenAI Integrations and Hugging Face Flaws Expose Enterprise Infrastructure

Hugging Face flaws and OpenAI integration paths have produced remote code execution, secret harvesting and cross-tenant exfiltration in real deployments.

Jul 24, 2026, 3:21 PM EDT · Research · Cloud Security6 minOpus 5 Enterprise AI Pricing Reshapes Security Compute: High-Reasoning LLM Economics and the Cybersecurity Routing Catch

For vulnerability auditing, incident response and threat hunting, the routing catch matters as much as the price — and it is not visible in the pricing table.