Security advisories

Plain-English explanations of software security problems: who should care and what to do. Each one is written from the sources; ones a Securelyn engineer has not reviewed yet are labelled.

2026 in numbers

Advisories on the site, January to October 2026.

10
Advisories on the site
2
In the CISA Known Exploited catalogue
7.6
Average CVSS score (2 scored)
1%
Highest EPSS probability

Scored advisories by severity: High 2

High 2

8 not yet scored

Looking for every CVE, not just the ones we review? See the CVE tracker: an automatic list of every CVE published this year.

React Server Components remote code execution (CVE-2025-55182, React2Shell)

CVE-2025-55182, widely called React2Shell, is a critical remote code execution vulnerability in React Server Components.

CVE-2025-55182Meta ReactChecked 15 April 2026

Automated summary, not yet reviewed by a Securelyn engineer
CVSS severity: High 7.7Known exploited (CISA KEV)
nginx resolver off-by-one (CVE-2021-23017)

A security issue in the nginx resolver allows an off-by-one error. The CISA catalogue sample lists it as an off-by-one in the nginx resolver, and the required action is to apply…

CVE-2021-23017F5 nginxChecked 1 June 2024

Automated summary, not yet reviewed by a Securelyn engineer
PHP (CVE-2024-4577)

CVE-2024-4577 is a published vulnerability record for PHP. This draft does not describe the flaw yet.

CVE-2024-4577PHPChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer
CVSS severity: High 7.5Known exploited (CISA KEV)
HTTP/2 Rapid Reset denial of service (CVE-2023-44487)

HTTP/2 Rapid Reset is a denial of service weakness: an attacker can use the protocol's reset feature to overload a server.

CVE-2023-44487IETF HTTP/2Checked 1 June 2024

Automated summary, not yet reviewed by a Securelyn engineer
Joomla (CVE-2023-23752)

CVE-2023-23752 is a published vulnerability record for Joomla. This draft does not describe the flaw yet.

CVE-2023-23752JoomlaChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer
Microsoft Exchange Server (CVE-2021-26855)

CVE-2021-26855 is a published vulnerability record for Exchange Server. This draft does not describe the flaw yet.

CVE-2021-26855Microsoft Exchange ServerChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer
Apache HTTP Server (CVE-2021-41773)

CVE-2021-41773 is a published vulnerability record for HTTP Server. This draft does not describe the flaw yet.

CVE-2021-41773Apache HTTP ServerChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer
jQuery (CVE-2020-11022)

CVE-2020-11022 is a published vulnerability record for jQuery. This draft does not describe the flaw yet.

CVE-2020-11022jQueryChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer
Drupal (CVE-2018-7600)

CVE-2018-7600 is a published vulnerability record for Drupal. This draft does not describe the flaw yet.

CVE-2018-7600DrupalChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer
OpenSSL (CVE-2014-0160)

CVE-2014-0160 is a published vulnerability record for OpenSSL. This draft does not describe the flaw yet.

CVE-2014-0160OpenSSLChecked 11 October 2026

Automated summary, not yet reviewed by a Securelyn engineer

How to read an advisory

KEV: The US cyber agency CISA keeps a catalogue of vulnerabilities it knows have been exploited. Listed ones deserve attention first.
EPSS: A probability from 0 to 1, published by FIRST, that exploitation activity is seen in the next 30 days. It describes the vulnerability, not your business.
Data as at: The date the facts on the page were current. Always check the vendor's own advisory before you act.