The Weakest Link: Breaching Enterprise Infrastructure Through Contractor Misconfigurations

msrc disc. (placeholder)

You've Got Mail(ware): Chaining Stored XSS and Arbitrary File Read to Wormable Pre-Auth RCE in Horde Groupware

Failing the Audit: Java Deserialization RCE Across Higher Education Infrastructure (CVE-2026-94109)

Wide Area Network, Narrow Attack Surface: Authenticated Heap Buffer Overflow in Cisco Catalyst SD-WAN (CSCwu48719)

A Hole in the Perimeter: Blind XPath Injection and Credential Extraction in OPNsense (CVE-2026-53582)

Dead Code Walking: Unauthenticated RCE via a Deprecated Cisco ASA Upload Endpoint

End of Life, Not End of Risk: Privilege Escalation Through Forgotten Enterprise Infrastructure

Curl Up and Die: OS Command Injection in the Tenda G300-F WAN Diagnostic Interface (CVE-2026-25857)

Return to Sender: Hijacking Reserved Outlook Addresses and Abusing Domain Control Validation

Insufficient Funds (for Security): Chaining CORS Misconfiguration, IDOR, and SSRF in a Consumer Payment Processor