SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Vendor Security Posture Report Card: Oracle - Q2 2026
Explore Oracle's Q2 2026 security posture, including disclosed vulnerabilities, critical CVEs, security updates, patch management trends, exploitation risks, and key recommendations for enterprise security teams.
CVE Research
Critical Atlassian Flaw Exploited Within Hours of Disclosure, Affects Multiple Products
Atlassian has disclosed CVE-2026-21589, a critical unauthenticated arbitrary file access flaw affecting Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. Attackers need the exact file path; directory listing is not possible. Cloud is already patched. This article covers impact, fixed versions, and temporary mitigations.
CVE Research
Critical SonicWall SMA 1000 Flaw Lets Unauthenticated Attackers Reach Internal Functionality
SonicWall has disclosed CVE-2026-102255, a critical pre-authentication SSRF vulnerability in SMA 1000 Work Place that can let unauthenticated attackers reach internal functionality and perform unauthorized operations. The advisory also covers three additional SMA 1000 issues. Fixed platform-hotfixes are available; SonicWall reports no evidence of in-the-wild exploitation at publication.
CVE Research
New NetScaler SAML Zero-Day Exploited in Targeted Attacks, Causes Denial of Service
Citrix has disclosed CVE-2026-88779, a high-severity memory overflow in NetScaler ADC and NetScaler Gateway that can cause denial of service when the appliance is configured as a SAML service provider or identity provider. Targeted attacks on unmitigated deployments have been observed. This article covers impact, affected versions, configuration checks, temporary Global Deny List guidance, and fixed builds.