Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,736 stories synthesized.
Car manufacturer Škoda disclosed that attackers exploited a vulnerability in its online shop software, gaining unauthorized access to customer data including names, addresses, and hashed passwords.
Apple and Google have begun beta-testing end-to-end encrypted Rich Communication Services (RCS) messaging between iOS 26.5 and Google Messages, closing a long-standing security gap in cross-platform chats.
HiddenLayer discovered a malicious Hugging Face repository typosquatting OpenAI's Privacy Filter that drops a Rust-based infostealer, stealing browser passwords, session cookies, Discord tokens, and crypto wallets.
Edtech giant Instructure has reached an agreement with the ShinyHunters extortion group to prevent the leak of 3.6TB of data stolen from its Canvas LMS platform, affecting over 30 million users.
Instructure, the company behind the Canvas learning management system, confirmed that stolen data from a breach attributed to the ShinyHunters extortion group was 'returned' after reaching an agreement with the attackers.
The UK ICO fined South Staffordshire Water nearly £1m for a phishing attack that went undetected for two years, exposing data of over 633,000 individuals.
Instructure, the parent company of Canvas, has paid an undisclosed ransom to the ShinyHunters extortion group to prevent the leak of 3.65TB of data stolen from nearly 9,000 educational institutions.
Fortinet has disclosed a denial-of-service vulnerability in the API of FortiAnalyzer and FortiManager that allows an authenticated attacker to cause a system hang via specially crafted HTTP requests.
Fortinet has disclosed a critical out-of-bounds write vulnerability in the FortiOS CAPWAP daemon that could allow an attacker controlling an authenticated FortiAP, FortiExtender, or FortiSwitch to gain execution privileges on the FortiGate device.
Fortinet has disclosed an SQL injection vulnerability (FG-IR-26-134, CWE-89) in its FortiNDR network detection and response platform that could allow an authenticated attacker to execute arbitrary SQL commands on backend databases.
Fortinet disclosed a missing authorization vulnerability in FortiClient for Windows that allows an authenticated local attacker to decrypt a logged-in user's VPN password via an unprotected DLL function.
Fortinet disclosed a vulnerability in FortiTokenAndroid where an exported Content Provider URI allows other apps on the same device to read OTP codes, with a CVSS score of 5.0.
Fortinet has disclosed an SQL injection vulnerability in FortiMail's administrative portal, allowing authenticated privileged attackers to execute unauthorized code or commands.
Fortinet disclosed a critical missing authorization vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS that could allow unauthenticated attackers to execute arbitrary code.
Fortinet has released security updates for two critical remote code execution vulnerabilities in FortiAuthenticator and FortiSandbox that could allow unauthenticated attackers to take over unpatched systems.
Fortinet disclosed a high-severity OS command injection vulnerability in the CLI of FortiAP, FortiAP-U, and FortiAP-W2 devices, allowing authenticated privileged attackers to execute arbitrary commands.
Fortinet has disclosed an argument injection vulnerability (FG-IR-26-138) in the FortiDeceptor web interface that allows authenticated read-only admins to read arbitrary log files via crafted HTTP requests.
Apple's iOS 26.5 introduces default end-to-end encryption for RCS messaging between iPhone and Android, marking a major step in cross-platform messaging security.
Meterian has released HEIDI, a free IDE plugin that integrates real-time open-source vulnerability intelligence into development environments and AI coding assistants.
Ivanti has patched a vulnerability (CVE-2026-8109) in Endpoint Manager's RemoteControlAuth module that could allow remote attackers to bypass authentication and disclose stored credentials.
Apple has released a security update to address CVE-2026-28940, a critical out-of-bounds write vulnerability in the macOS USD library that could allow remote code execution via a crafted USD file.
Apple has patched a critical heap-based buffer overflow vulnerability in Safari's regular expression handling that could allow remote code execution when users visit malicious pages.
Apple has patched CVE-2026-28955, a use-after-free vulnerability in Safari's Web Inspector WebCore style resolver that could allow remote code execution when a user visits a malicious page.
A memory corruption vulnerability in Siemens Simcenter Femap's IPT file parsing (CVE-2025-12659) allows remote code execution, requiring user interaction to open a malicious file.