vulnerability management

CISA has added five actively exploited vulnerabilities in JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS to its watch list this week.

A maximum-severity path traversal flaw in GitLab’s repository commits API is being scanned within hours of disclosure. Here’s what happened and what self-managed users need to check.

IT teams drown in critical CVSS scores every month. Here’s what the score actually measures, how to read the severity bands, and how to prioritise patching when everything looks urgent.

A practical order for tackling this month’s 974 Patch Tuesday vulnerabilities, from the two already-exploited bugs to your e-commerce platform.

A zero-day vulnerability is a flaw attackers exploit before a fix exists. Here is what that means in practice and how UK businesses should respond.

SAP has patched a maximum-severity kernel vulnerability that lets attackers run commands on SAP servers without logging in. Here is what OVERPASS affects and how to respond.

CVE-2026-58048 is being downplayed as low risk because it needs an existing account. On shared hosting, that’s exactly the wrong conclusion to draw.

An unpatched Magento vulnerability is being exploited to backdoor stores with no login needed. Here’s how to check for compromise and cut your risk before a patch exists.

Citrix called CVE-2026-8452 a memory overflow. It turned out to be an unauthenticated root exploit, and that gap says something about how patch priority gets set.

A CVE identifies a vulnerability, nothing more. Here is why treating the number itself as a severity signal leads to the wrong patch order, and what should drive it instead.