VULNERABILITY 357
- CVE-2026-119285 - Fiber CORS Vulnerability
- Yamaha YMS-VPN8 and YMS-VPN8-CP Register Windows Services with Unquoted File Paths
- CVE-2026-82411 - Objects API Cross-object-type Authorization Bypass
- The Pwn Request Reckoning What Still Works Against GitHub Actions
- CVE-2026-2270 - StatefulSet and ControllerRevision Vulnerability
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- Pleasanter LDAP Authentication Bypass Vulnerability
- Abandoned Popcorn Time App Exposed Millions of Devices to RCE Attacks
- New BlackX UEFI Bootkit Exploiting Baton Drop
- CVE-2026-76268 | Splunk Enterprise Patroni REST API Missing Authentication Vulnerability
- Signal Bug Could Let Someone Keep Listening After You Hang Up
- Pwnescape A Critical Linux Kernel Vulnerability
- ARMORY CASTLE Exploits BeyondTrust
- CVE-2026-102298 - Insufficient Authorization and User Boundary Validation in Omada Controller MSP
- CVE-2026-102298 - Insufficient Authorization and User Boundary Validation in Omada Controller MSP
- A Series of Unauthenticated Events Chained Exploitation of Ivanti Connect Secure Zero-Days
- CVE-2026-108978 - Samsung rlottie Heap-based Buffer Overflow
- CVE-2026-108769 - zhayujie CowAgent Markdown Rendering Denial of Service
- Nvidia Monitoring Bug Could Have Knocked AI Offline
- Critical Telegram Desktop Bug Hackers Can Steal Accounts with a Single Click
- CVE-2026-107284 - AsyncHttpClient Vulnerability Discovered
- CVE-2026-105816 - Vault Vulnerable to Arbitrary Code Execution
- Hitachi Energy SOI Vulnerability Alert
- Rejetto HFS Servers Actively Scanned for Critical RCE Flaw
- Dutch Institute for Vulnerability Disclosure Breached via Zammad 0-Days
- Improper Limitation of a Pathname to a Restricted Directory
- Teltonika RutOS Command Injection Vulnerability
- MikroTik RouterOS Flaw Lets Attackers Run Code as Root
- CVE-2026-86344 - 389-ds-base Vulnerability Report
- Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
- CVE-2026-94204 - Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
- CVE-2026-93853 - Barman Snapshot Backup Deletion Vulnerability
- Baicells Nova 430H Vulnerability Advisory
- Imminent Zero-Day Attack KiteWorks Urges Customers to Shut Down Servers
- CVE-2026-97368 - chillzhuang SpringBlade Vulnerability
- CVE-2026-85491 - CatalystSeal Vulnerability Details
- F5 Fixes Actively Exploited Zero-Day Flaw in BIG-IP APM
- Siemens WTV676 and WTV776 Vulnerability Advisory
- CVE-2026-61852 - Chartbrew SQL Injection Vulnerability
- CVE-2026-94090 - JusticeRage Manalyze PE Parser Vulnerability
- Mitsubishi Electric GX Works3 and Motion Control Settings Vulnerability
- Google Pixel Phones Vulnerable to Zero-Click Attacks
- Siemens Teamcenter Vulnerability Advisory
- Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
- CVE-2026-90824 - GPAC MP4Box Stack-Based Overflow Vulnerability
- CVE-2026-88002 - Open WebUI Vulnerability Exposes Server to Hang
- CVE-2026-15460 - Missing Channel-State Validation in Zephyr Bluetooth Classic L2CAP Receive Path
- ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control
- CVE-2026-86148 - Tenda CP3 Kylin System Command Injection
- Plex Issues Urgent Patch Warning for 300,000 Media Servers
- Signature Optional - Analysis of CVE-2026-28323
- CVE-2026-84482 - WWBN AVideo Cross-Site Request Forgery
- Traefik Vulnerability Discovered in Version Through 3.7.11
- Hackers Target PaperCut Servers 47% Unpatched
- CVE-2026-82343 - Gimp Vulnerability Details
- CVE-2026-82306 - StarRocks Query Detail Endpoint Vulnerability
- CVE-2026-82291 - HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
- Installer for Rakuten Kobo Desktop Application Vulnerability
- AI Girlfriend Review Site's Secrets Exposed for Three Weeks
- CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File
- Half-click Unauthenticated Remote Code Execution on Horde Groupware IMP
- Critical Vulnerability in PayRange API Disclosed
- Simple Scans for Cloud Metadata Service
- NASA Ground Control Software Flaw Enables Unauthenticated Commands
- CVE-2026-52854 - mediawiki/maps Stored XSS Vulnerability
- UNISOC Modem Flaw Enables Remote Code Execution via Video Calls
- CVE-2026-75531 - Stored Cross-Site Scripting Vulnerability in Pandora
- CVE-2026-69148 - MLflow Vulnerability Exposes User Artifacts
- GeoServer Zero-Day Is Already Being Probed. That's the Problem
- Siemens Parasolid Vulnerability Advisory
- Siemens Desigo DXR and PXC Controllers Vulnerability Alert
- CVE-2026-73249 - calibre Content Server Vulnerability
- CVE-2026-11812 - UpdateHub Vulnerability Causes DoS
- CVE-2026-12372 - Server-Side Request Forgery (SSRF) in nltk/nltk
- CVE-2026-7406 - BMP File Parsing Untrusted Pointer Dereference in Autodesk Products
- Don't Revoke That Token Yet Inside the keyv/cacheable npm Worm
- CVE-2026-11836 - Production Debug-Unlock Token Verification Missing Device Binding
- Hackers Exploit N-able N-central Flaw After Initial Fix Falls Short
- CVE-2026-10848 - Out-of-bounds Read in Zephyr OCPP 1.6 RPC Message Parser
- Watchfire Controller Software Vulnerability Alert
- Schneider Electric IGSS Vulnerability Advisory
- NASA Core Flight System Health & Safety Application Vulnerability Advisory
- CosmosEscape Taking Over Every Database in Azure Cosmos DB
- CVE-2026-68563 - Information Disclosure in Ansible Collection Redhat Leapp
- Cleaning Out Inboxes TA488 Comes for Outlook with Another Half-Click Exploit
- CVE-2026-14643 undici Vulnerable to Cross-User Information Disclosure
- Siemens Mendix Runtime Vulnerability Advisory
- igloohome Smart Lock Mobile Application Vulnerability Alert
- MikroTik RouterOS and Cloud Hosted Router Vulnerability Advisory
- Java Spring Boot Heapdump Scans Expose Sensitive Data
- CVE-2026-17497 - NoteGen Arbitrary OS Command Execution via Tauri Shell
- CVE-2026-10681 - SMP Race in Thread Index Allocation
- WhatsApp Web Chats Exposed by Adobe's Acrobat Extension Flaw
- Millions of Cars Could Be Tracked and Unlocked by a Hidden Security Flaw
- Critical Vulnerability CVE-2026-60324 in MySQL Server
- CVE-2026-47134 - ClearanceKit Vulnerability Exposed
- CVE-2026-64186 - Fixing Latent Out-of-Bounds Access in IOMMU Debugfs
- CVE-2026-16195 - Sipeed PicoClaw Group Message Authorization Flaw
- CVE-2026-10130 - QueryWeaver Authentication Bypass Vulnerability
- HollowByte DDoS Flaw Bloats OpenSSL Server Memory
- HollowByte DDoS Flaw Bloats OpenSSL Server Memory with 11-Byte Payload
- SALTO ProAccess Space Vulnerability Alert
- CVE-2026-44436 - Quicly Vulnerability Exposed
- CVE-2026-63175 - Cross-Capture Session Data Leakage in Looklyloo
- CVE-2026-62314 - Anubis Policy Bypass via Client Controlled X-Original-URI Header
- CVE-2026-58408 - ChurchCRM Vulnerability Exposes PII
- CVE-2026-15506 - SecureAge CatchPulse Driver Vulnerability
- CVE-2026-10660 - Memory Corruption in Bluetooth BAP Broadcast Assistant
- OpenPLC v3 Vulnerability Advisory
- CVE-2026-55428 - Coder Vulnerability Route Hijacking Risk
- Backdoor Found in the Firmware for These Wi-Fi Routers. And There's No Patch
- Opera GX Flaw Lets Sites Auto-Install Mods to Steal Data
- MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation
- Confidential Computing's Core Trust Mechanism is Broken
- New CitrixBleed-like NetScaler Flaw Sees Exploit Attempts in the Wild
- WinRAR Flaw Could Allow Attackers to Take Control of Your Computer
- CVE-2026-13768 - Gardyn IoT Hub Use of Hard-coded Credentials
- RPG Maker MV and MZ Vulnerable to OS Command Injection
- The Red Agent POV Exploiting Broken Object-Level Authorization in an Airline GraphQL API
- CVE-2026-10648 - Critical NULL-pointer Dereference Vulnerability in MCUmgr
- macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools
- Critical Vulnerability in Delta Electronics DTM Soft
- Siemens WinCC Certificate Manager Vulnerability Advisory
- Cordyceps CI/CD Flaw Exposes Major Repos to Pipeline Hijacking
- FFmpeg Fixes PixelSmash Flaw in Widely Used Video Decoder
- 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
- Apple Patches High-Severity Eavesdropping Vulnerability in Beats Studio Buds
- I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
- AzeoTech DAQFactory Vulnerability Advisory
- The Red Agent POV How it Reasoned its Way to SSRF
- CVE-2026-48764 - TypeBot SSRF Vulnerability Exploited via DNS Rebinding
- Rockwell Automation RSLinx Vulnerability Advisory
- How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers
- CVE-2026-44587 - CarrierWave Bypass Vulnerability
- CVE-2026-12191 - Vulnerability in Comma AI Openpilot
- Alert Exploitation of CVE-2026-34197 in Apache ActiveMQ
- How to Defend ARM64 Cloud Infrastructure from ITScape
- A Tale of Two Eras
- Expanded JDY IoT and SOHO Botnet Enables Rapid Vulnerability Exploitation
- Schneider Electric Modicon Network Managed Switches Vulnerability
- CVE-2026-9746 - Server Crashes Due to Exchange Option
- CISA Flags Fresh SolarWinds Serv-U Flaw as Actively Exploited
- CVE-2026-11459 - SecureAge CatchPulse IOCTL Vulnerability Disclosed
- NAVTOR NavBox Vulnerability Advisory
- Microsoft Backs Off Legal Threats Against Windows Security Researchers After BitLocker Backlash
- HP Poly VoIP Vulnerability Sets the Stage for Executive Voice Deepfakes
- CVE-2026-44825 | Apache Solr AuthTool Hardcoded Credentials Vulnerability
- Windows Server Vulnerability Can Grant System Privileges
- Critical WP Maps Pro Plugin Flaw Leads to 3,600 Attacks in One Day
- CISA Adds Critical Palo Alto Networks Firewall Flaw to KEV
- CVE-2026-10199 - Assimp glTF2Asset.h LazyDict Null Pointer Dereference
- ChatGPhish The Page Is the Payload
- CVE-2026-48810 - FreeScout Thread Edit Authorization Bypass via Missing Mailbox Check
- Wide-ranging 7-zip Vulnerability Exposes Millions to Code Execution Risks
- CVE-2026-35616 FortiClient EMS Flaw Actively Exploited in Malware Attacks
- Scramble Remote Code Execution Vulnerability Discovered
- EspoCRM 9.3.3 - SSRF Vulnerability Discovered
- ABB LVS MConfig Vulnerability Advisory
- Eppendorf BioFlo 320 Vulnerability Alert
- Zero-Click WhatsApp Account Takeover Hits iPhone Users Running iOS 16
- Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
- Detecting CVE-2026-0265 at Scale PAN-OS CAS Authentication Bypass
- Hitachi Energy GMS600 Vulnerability Advisory
- Critical Pre-Auth RCE in ChromaDB Threatens AI Infrastructure
- Drupal Admins Rush to Patch Critical SQL Injection Vulnerability
- The Expendable Extension Name Azure VMAccess Naming Chaos, Password Resets, and a Detection Gap
- Hackers Actively Exploiting Critical NGINX RCE Vulnerability in the Wild
- Microsoft Rejects Critical Azure Vulnerability Report, No CVE Issued
- Security Update Guide - Loading
- PraisonAI Vulnerability Gets Scanned Within 4 Hours of Disclosure
- Quest KACE SMA Flaw CVE-2025-32975 Exposes 60 Organizations
- Glances 4.5.2 Command Injection Vulnerability
- Coreruleset 4.21.0 - Firewall Bypass
- New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
- Critical Vulnerability in ABB AC500 V3 PLCs
- Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak
- Active Attack Dirty Frag Linux Vulnerability Expands Post-Compromise Risk
- LuaJIT 2.1.1774638290 - Arbitrary Code Execution
- Critical Vulnerability in MAXHUB Pivot Client Application
- Bludit CMS 3.18.4 - RCE Vulnerability Discovered
- Google Fixes CVSS 10 Gemini CLI Vulnerability Enabling GitHub Issue-Based RCE
- A Single 732-Byte Python Script Can Obtain Root on Linux Time to Update Your Kernel
- The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026)
- Copy Fail Vulnerability in Major Linux Distributions
- Microsoft Won't Patch PhantomRPC - Feature or Bug?
- GitHub Rushed to Fix a Critical Vulnerability in Less Than Six Hours
- DragonBreath A Critical 0-Day Vulnerability in the Kernel
- Firefox Bug CVE-2026-6770 Enables Cross-Site Tracking and Tor Fingerprinting
- Microsoft Entra Agent ID Flaw Enabled Tenant Takeover via Privilege Escalation
- Critical Bug in CrowdStrike LogScale Lets Attackers Access Files
- Apache ActiveMQ Series Improper Validation of MQTT Packets
- More Ancient Linux Device Support Faces the Chop
- Intrado 911 Emergency Gateway Vulnerability Disclosed
- Compromised DVRs and Finding Them in the Wild
- wolfSSL Vulnerability Hits IoT, Routers and Military Systems, Update to 5.9.1 Now
- wolfSSL Vulnerability Hits IoT, Routers and Military Systems, Update to 5.9.1 Now
- The Mythos Inflection Point - Dealing With the Upcoming Vulnerability Disclosure Avalanche
- The Mythos Inflection Point - Dealing With the Upcoming Vulnerability Disclosure Avalanche and Compressed Exploitation Window
- React Server 19.2.0 - Remote Code Execution
- Contemporary Controls BASC 20T Vulnerability Advisory
- FortiWeb 8.0.2 - Remote Code Execution Exploit Disclosed
- CVE-2026-23226 How a Missing Lock in ksmbd's Channel List Exposes Your Linux SMB3 Server
- GrafanaGhost Exploit Bypasses AI Guardrails for Silent Data Exfiltration
- Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
- 10 Minutes with Claude Remote Code Execution in Apache ActiveMQ (CVE-2026-34197)
- MCP Isn't a Protocol Problem An Identity Crisis
- is-localhost-ip 2.0.0 - SSRF Vulnerability Discovered
- Desktop Window Manager Core Library 10.0.10240.0 - Privilege Escalation
- PX4 Autopilot Vulnerability Exposed
- GIGABYTE Control Center Vulnerable to Arbitrary File Write Flaw
- Anritsu Remote Spectrum Monitor Vulnerability Advisory
- LangChain Path Traversal Bug Exposes AI Pipeline Vulnerabilities
- OpenAI Patches ChatGPT Flaw That Smuggled Data Over DNS
- 15-Year-Old strongSwan Flaw Lets Attackers Crash VPNs via Integer Underflow
- LangChain Path Traversal Bug Exposes AI Pipeline Vulnerabilities
- OpenAI Patches ChatGPT Flaw That Smuggled Data Over DNS
- 15-Year-Old strongSwan Flaw Lets Attackers Crash VPNs via Integer Underflow
- File Read Flaw in Smart Slider Plugin Impacts 500K WordPress Sites
- File Read Flaw in Smart Slider Plugin Impacts 500K WordPress Sites
- Critical Vulnerability in Grassroots DICOM (GDCM) Detected
- Critical Vulnerability in Pharos Controls Mosaic Show Controller
- Critical Vulnerability in Grassroots DICOM (GDCM) Detected
- Critical Vulnerability in Pharos Controls Mosaic Show Controller
- Critical Vulnerability CVE-2025-32975 Exploited in Quest KACE Systems
- Critical Vulnerability CVE-2025-32975 Exploited in Quest KACE Systems
- CVE-2026-31979 The Symlink Trap - Root Privilege Escalation in Himmelblau
- CVE-2026-31979 The Symlink Trap - Root Privilege Escalation in Himmelblau
- Critical Ubiquiti UniFi Security Flaw Allows Potential Account Hijacking
- New 'PolyShell' Flaw Allows Unauthenticated RCE on Magento E-Stores
- Critical Ubiquiti UniFi Security Flaw Allows Potential Account Hijacking
- New 'PolyShell' Flaw Allows Unauthenticated RCE on Magento E-Stores
- New Ubuntu Flaw Enables Local Attackers to Gain Root Access
- Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access
- Schneider Electric SCADAPack and RemoteConnect Vulnerability Advisory
- Researchers Find Data Leak Risk in AWS Bedrock AI Code Interpreter
- This Android Vulnerability Can Break Your Lock Screen in Under 60 Seconds
- Hewlett Packard Enterprise Fixes Critical Authentication Bypass in Aruba AOS-CX
- Hewlett Packard Enterprise Fixes Critical Authentication Bypass in Aruba AOS-CX
- Honeywell IQ4x BMS Controller Vulnerability Advisory
- Improper File Access Permission Settings in Digital Arts Products
- Critical Zero-Click Command Injection in AVideo Platform Allows Stream Hijacking
- Delta Electronics CNCSoft-G2 Vulnerability Advisory
- High-severity Qualcomm Bug Hits Android Devices in Targeted Attacks
- Critical Juniper Networks PTX Flaw Allows Full Router Takeover
- Critical Cisco SD-WAN Bug Exploited in Zero-Day Attacks 🚨
- RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN
- Welker OdorEyes EcoSystem Pulse Bypass System Vulnerability Alert
- Critical Grandstream VoIP Bug Highlights SMB Security Blind Spot
- Chinese APT Group Exploits Dell Zero-Day for Two Years
- Delta Electronics ASDA-Soft Vulnerability Advisory
- RoguePilot - Exploiting GitHub Copilot for a Repository Takeover
- Full Disclosure Authenticated RCE Vulnerabilities in Netgate pfSense
- Siemens Siveillance Video Management Servers Vulnerability Advisory
- Critical Vulnerability in Airleader Master Exposed
- Were Telcos Warned About the Ancient Telnet Bug?
- BeyondTrust Fixes Critical Pre-Auth Bug Allowing Remote Code Execution
- Nearly 5 Million Web Servers Found Exposing Git Metadata – Study Reveals Widespread Risk of Code and Credential Leaks
- APT28 - Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)
- Vulnerability Alert Mitsubishi Electric FREQSHIP-mini for Windows
- Critical Vulnerability in Synectix LAN 232 TRIO Exposed
- Mutagen Astronomy From Discovery to CISA Recognition—A Seven-Year Journey
- Mutagen Astronomy - From Discovery to CISA Recognition—A Seven-Year Journey
- Moltbook AI Vulnerability Exposes Email Addresses, Login Tokens, and API Keys
- Pyodide Sandbox Escape Enables Remote Code Execution in Grist-Core
- Critical sandbox escape flaw found in popular vm2 NodeJS library
- Ticket to Shell - Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200)
- Delta Electronics DIAView Vulnerability Advisory
- Critical TP-Link VIGI camera flaw allowed remote takeover of surveillance systems
- New StackWarp Hardware Flaw Breaks AMD SEV-SNP Protections on Zen 1–5 CPUs
- Fast Pair, loose security - Bluetooth accessories open to silent hijack
- A single click mounted a covert, multistage attack against Copilot
- CVE-2025-64155 | Fortinet FortiSIEM
- CVE-2026-22200
- Public PoC prompts Cisco patch for ISE, ISE-PIC vulnerability
- Hackers actively exploit critical RCE flaw in legacy D-Link DSL routers
- High-Severity Flaw in Open WebUI Affects AI Connections
- Hackers attack WatchGuard Firebox firewalls 120K IPs exposed and vulnerable
- New React Rsc Vulnerabilities Enable.Html
- CISA Warns of Windows Cloud Files Mini Filter 0-Day Vulnerability Exploited in Attacks
- Multiple India-based CCTV Cameras
- King Addons flaw lets anyone become WordPress admin
- Weaponized file name flaw makes updating glob an urgent job
- Critical Vulnerability in Azure Bastion Let Attackers Bypass Authentication and Escalate privileges
- Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
- Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage
- U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog
- Patch now Samsung zero-day lets attackers take over your phone
- Exploited ‘Post SMTP’ Plugin Flaw Exposes WordPress Sites to Takeover
- OpenAI Atlas Browser Vulnerability Allows Malicious Code Injection into ChatGPT
- Hackers exploiting Windows updates Microsoft urges users to patch
- 706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released
- Hackers exploiting critical vulnerability in Windows Server Update Service
- Anomali Cyber Watch - Nimbus Manticore, Spoofed IC3 Portals, a Record-Breaking DDoS Attack, and More
- PoC Exploit Released for Windows Server Update Services Remote Code Execution Vulnerability
- WatchGuard VPN Vulnerability Let Remote Attacker Execute Arbitrary Code
- New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login
- The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn
- 13-year-old Critical Redis RCE Vulnerability Let Attackers Gain Full Access to Host System
- Microsoft Critical GoAnywhere bug exploited in ransomware attacks
- New WireTap Attack Breaks Server SGX to Exfiltrate Sensitive Data
- Critical CVSS 10 Flaw in GoAnywhere File Transfer Threatens 20,000 Systems
- Cisco warns of IOS zero-day vulnerability exploited in attacks
- CISA Details That Hackers Gained Access to a U.S. Federal Agency Network Via GeoServer RCE Vulnerability
- Microsoft Fixed Entra ID Vulnerability Allowing Global Admin Impersonation
- Microsoft Entra ID flaw allowed hijacking any company's tenant
- Google Chrome 0-Day Vulnerability Actively Exploited in the Wild – Patch Now
- How a Plaintext File On Users’ Desktops Exposed Secrets Leads to Akira Ransomware Attacks
- IBM QRadar SIEM Vulnerability Let Attackers Perform Unauthorized Actions
- New HybridPetya Weaponizing UEFI Vulnerability to Bypass Secure Boot on Outdated Systems
- DELMIA Factory Software Vulnerability Exploited in Attacks
- Microsoft Patch Tuesday, September 2025 Edition
- Windows Defender Vulnerability Allows Service Hijacking and Disablement via Symbolic Link Attack
- Severe Hikvision HikCentral Product Flaws What You Need to Know
- CMS Provider Sitecore Patches Exploited Critical Zero Day
- Hidden Commands in Images Exploit AI Chatbots and Steal Data
- Critical Next.js Framework Vulnerability Let Attackers Bypass Authorization
- WhatsApp patches vulnerability exploited in zero-day attacks
- Critical Docker Desktop flaw lets attackers hijack Windows hosts
- Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in
- Critical RCE Vulnerability in Cisco Firewall Management Software Under Active Exploitation
- Update WinRAR tools now RomCom and others exploiting zero-day vulnerability
- New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP
- OWASP AIVSS targets agentic AI risk
- Critical Vulnerability Impacting Over 100K Sites Patched in Everest Forms Plugin
- SonicWall investigates possible zero-day amid Akira ransomware surge
- Cursor IDE Persistent Code Execution via MCP Trust Bypass
- Critical Vulnerability in NestJS Devtools Localhost RCE via Sandbox Escape
- AI-powered Cursor IDE vulnerable to prompt-injection attacks
- Attackers Actively Exploiting Critical Vulnerability in Alone Theme
- Account Takeover Vulnerability Affecting Over 400K Installations Patched in Post SMTP Plugin
- How We Accidentally Discovered a Remote Code Execution Vulnerability in ETQ Reliance
- BIDI Swap Unmasking the Art of URL Misleading with Bidirectional Text Tricks
- The Internet Red Button a 2016 Bug Still Lets Anyone Kill Solar Farms in 3 Clicks
- Microsoft Fix Targets Attacks on SharePoint Zero-Day
- Flaw in Signal App Clone Could Leak Passwords — GreyNoise Identifies Active Reconnaissance and Exploit Attempts
- Zyxel security advisory for path traversal vulnerability in APs
- eSIM Vulnerability in Kigen's eUICC Cards Exposes Billions of IoT Devices to Malicious Attacks
- Critical RCE Vulnerability in mcp-remote CVE-2025-6514 Threatens LLM Clients
- Count(er) Strike – Data Inference Vulnerability in ServiceNow
- Critical Sudo bugs expose major Linux distros to local Root exploits
- Cl0p cybercrime gang's data exfiltration tool found vulnerable to RCE attacks
- Critical Vulnerability in Microsens Devices Exposes Systems to Hackers
- Zero-day Bluetooth gap turns millions of headphones into listening stations
- Gogs Remote Command Execution Vulnerability (CVE-2024-56731)
- Cisco ISE Vulnerability Allows Remote Attackers to Execute Malicious Commands
- Realtek Bluetooth Flaw Allows Attackers to Launch DoS Attacks During Pairing
- Why a Classic MCP Server Vulnerability Can Undermine Your Entire AI Agent
- Don't panic, but it's only a matter of time before critical 'CitrixBleed 2' is under attack
- Acer Control Center Flaw Lets Attackers Run Malicious Code as Elevated User
- Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
- EchoLeak Zero-Click AI Attack in Microsoft Copilot Exposes Company Data
- Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited
- NTLM reflection is dead, long live NTLM reflection! – An in-depth analysis of CVE-2025-33073
- iMessage Zero-Click Attacks Suspected in Targeting of High-Value Individuals
- Qualcomm fixes three Adreno GPU zero-days exploited in attacks
- Bypassing MTE with CVE-2025-0072