Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Key findings • Apple patched three iPadOS vulnerabilities on August 25, 2026, including a high-severity Safari CSP bypass. • CVE-2026-43670 allows bypassing Content Security Policy in AudioWo…
Key findings • Apple patched three iOS and iPadOS vulnerabilities on August 25, 2026. • A high-severity Safari CSP bypass (CVE-2026-43670) was among the disclosed flaws. • Other vulnerabi…
Multiple vulnerabilities in the Bendix EC80 Brake ECU could allow attackers to disable critical safety features like ABS and steering assist, or even crash the system.
CISA has issued an advisory for two critical vulnerabilities in the FURUNO FA-50 Class B AIS Transponder, which could allow attackers to alter device settings. No patches will be provided as the product is end-of-life.
A critical missing authentication vulnerability in Siemens SIMATIC IoT2050 Advanced devices allows unauthenticated remote attackers to execute arbitrary code with maximum privileges.
CISA has issued an advisory for ZoneMinder versions 1.37.48 and 1.38.3, detailing CVE-2026-76060, a critical OS Command Injection vulnerability that allows authenticated users to execute arbitrary commands.
CISA has issued an advisory for CVE-2026-18965 affecting PayRange API, a vulnerability that could allow remote attackers to disclose sensitive information or cause denial of service.
CISA has issued an advisory for Rently Smart Home devices, detailing CVE-2026-75960, a vulnerability that could allow attackers to retrieve sensitive pins, including the Master Pin.
CISA has issued an advisory detailing several critical vulnerabilities in Ebyte NE2-D11 devices, potentially allowing unauthenticated attackers to gain administrative access and disrupt operations.
CISA has added CVE-2026-60004, a Gitea code injection vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog, citing active exploitation.
Employee benefits platform Paylogix has disclosed a data breach that resulted in the theft of sensitive financial and health data belonging to tens of thousands of individuals.
Joshua Culver has been arrested for allegedly impersonating top officials from the NSA's elite hacking unit and the Supreme Court Chief Justice to influence legal proceedings and obtain information.
Key findings • Three vulnerabilities in Adobe CAI Content Credentials disclosed on August 25, 2026. • Two high-severity Integer Underflow flaws and one medium-severity Improper Input Validati…
Wordfence's AI agent, Argus, has identified a critical six-step remote code execution vulnerability in the Avada WordPress theme, impacting over one million sales.
Key findings • Five vulnerabilities disclosed together in Zephyr RTOS, including a high-severity virtio driver flaw. • Two vulnerabilities in the ext2 filesystem driver related to bitmap and …
A CISA red team exercise found a government organization vulnerable to undetected domain compromise, while a water sector organization successfully detected and contained a similar simulated attack.
The Linux Foundation will govern TRACE, an open standard for verifying the integrity and security of AI systems during operation, developed by AMD, Intel, Microsoft, OPAQUE, and TII.
Key findings • Three vulnerabilities in JFrog Artifactory disclosed on August 25, 2026. • Two high-severity flaws impact VCS repository handling and migration operations. • Medium-severit…
A novel attack bypassed Oracle's July patch release by using SQL injection to deploy a post-exploitation toolkit directly into an Oracle database via its embedded Java Virtual Machine.
Microsoft highlights the shrinking gap between vulnerability disclosure and exploitation, advocating for network-based controls as a critical layer of defense.
AI trust, safety, and security company Alice has raised $140 million in a funding round led by Apax Digital Funds, signaling strong investor confidence in specialized AI security solutions.
A new survey reveals that early-stage AI adoption in Security Operations Centers (SOCs) is already delivering significant improvements in incident response and remediation, with platform-oriented security architectures accelerating these gains.
A critical unauthenticated account takeover vulnerability (CVE-2026-19632) in the TranslatePress WordPress plugin allows attackers to reset administrator passwords and gain full site control.
Threat actors are increasingly using dynamically generated and obfuscated hostnames to bypass security controls targeting cloud metadata service IP addresses, complicating detection and mitigation efforts.