Stories

Every story we’ve synthesized.

Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,158 stories synthesized.

advisory1 source

Fortinet FortiManager Vulnerability Allows Workflow Approval Bypass

A critical access control flaw in Fortinet's FortiManager allows administrators to bypass workflow session approvals through crafted HTTP requests.

Sep 8, 2026

advisory1 source

FortiSOAR Vulnerability Allows Unauthorized Access to Websocket Streams

Fortinet has disclosed a broken access control vulnerability in its FortiSOAR platform that could allow authenticated attackers with no permissions to access sensitive data and inject messages.

Sep 8, 2026

advisory1 source

Fortinet FortiSIEM Vulnerable to Open Redirect Flaw

Fortinet has issued an advisory for an open redirect vulnerability in its FortiSIEM product, allowing authenticated attackers to redirect users to arbitrary websites.

Sep 8, 2026

patch2 sources · 1 CVE

FortiSandbox Vulnerable to Command Injection via Crafted HTTP Requests

A critical command injection vulnerability in FortiSandbox allows privileged attackers to execute arbitrary code through malicious HTTP requests.

Sep 8, 2026 · updated Sep 9, 2026

advisory2 sources

Fortinet FortiPAM Server Chrome Extension Vulnerable to Traffic Proxying

Fortinet has issued a security advisory for an improper authentication vulnerability in the FortiPAM Server's Chrome Extension, potentially allowing attackers to proxy user traffic.

Sep 8, 2026 · updated Sep 9, 2026

advisory1 source

Fortinet FortiAnalyzer Vulnerability Allows Denial of Service via SNMP

A critical vulnerability in Fortinet's FortiAnalyzer SNMP daemon could allow authenticated attackers to cause a denial of service by sending specific SNMP requests.

Sep 8, 2026

advisory2 sources · 1 CVE

Fortinet FortiSandbox Flaw Exposes Sensitive Information via Unauthenticated NAT Rule Control

A critical improper access control vulnerability in Fortinet's FortiSandbox products allows unauthenticated attackers to access sensitive information by manipulating NAT rules.

Sep 8, 2026 · updated Sep 9, 2026

trend1 source

Ransomware Negotiation Tactics Evolve into Structured Business Processes

Ransomware groups are professionalizing their negotiation tactics, treating them as a structured business process to maximize profits and efficiency.

Sep 8, 2026

advisory1 source · 19 CVEs

Code Projects: 19 Vulnerabilities Including SQLi and Info Disclosure Disclosed Together

Key findings • 19 vulnerabilities disclosed in Code Projects applications between September 3-8, 2026. • Batch includes SQL injection, information disclosure, and XSS flaws across multiple pr…

Sep 8, 2026

patch1 source · 1 CVE

Microsoft Windows IKEv2 Vulnerability Allows Remote Code Execution

A critical integer underflow vulnerability in Microsoft Windows' IKEv2 component, tracked as CVE-2026-50696, permits unauthenticated remote code execution on systems with specific IPsec configurations.

Sep 8, 2026

patch4 sources · 1 CVE

Microsoft Windows UMPDDrvRealizeBrush Vulnerability Allows Local Privilege Escalation

A local privilege escalation vulnerability in Microsoft Windows, tracked as CVE-2026-62712, allows attackers with initial low-privileged access to gain elevated system privileges.

Sep 8, 2026

research1 source

Zero Day Initiative Discloses Critical Code Execution Vulnerability in Koha Library Software

A critical vulnerability in the Koha library management system allows authenticated remote attackers to execute arbitrary code, posing a significant risk to institutions relying on the software.

Sep 8, 2026

patch1 source · 1 CVE

Microsoft Windows MIDI Service Vulnerability Allows Local Privilege Escalation

A local privilege escalation vulnerability in Microsoft Windows' MIDI service, ZDI-26-617 (CVE-2026-66804), allows attackers with low-privileged code execution to gain higher privileges.

Sep 8, 2026

1 source

Itsourcecode: 17 SQLi Flaws with Public Exploits Disclosed Together

Key findings • 17 SQL injection vulnerabilities disclosed for Itsourcecode products between September 6-8, 2026. • All vulnerabilities have publicly available exploits, increasing immediate r…

Sep 8, 2026

research1 source

InjectEave Attack Leverages Electromagnetic Signals to Eavesdrop on Headphones from 30 Meters

Researchers have developed a novel electromagnetic attack, dubbed InjectEave, capable of eavesdropping on audio played through wired and wireless headphones from up to 30 meters away, even through walls.

Sep 8, 2026

1 source

Ash Project: Ten Vulnerabilities Including High-Severity Flaws Disclosed Together

Key findings • Ten vulnerabilities disclosed for Ash Project components between 2026-09-07 and 2026-09-08. • Two high-severity flaws include resource exhaustion in the OAuth2 server and arbit…

Sep 8, 2026

1 source

CVE-2026-75650 Added to CISA KEV Under Active Exploitation

Key findings • CVE-2026-75650, an Adobe vulnerability, is now on CISA's KEV catalog. • The flaw is confirmed to be actively exploited in real-world attacks. • All organizations should pri…

Sep 8, 2026 · updated Sep 10, 2026

research1 source

Mandiant: Adversaries Accelerate AI Misuse, Shifting to Autonomous Operations

Mandiant's latest AI Threat Tracker reveals threat actors are rapidly evolving their use of AI, moving from basic prompting to autonomous agentic workflows and sophisticated supply chain attacks.

Sep 8, 2026

1 source

Microsoft: 2 Actively-Exploited Flaws Added to CISA KEV

Key findings • Two Microsoft vulnerabilities, CVE-2026-81963 and CVE-2026-85880, are now in CISA's KEV catalog. • Both flaws are confirmed to be under active exploitation in real-world attack…

Sep 8, 2026 · updated Sep 11, 2026

research1 source

Loyalty Points Fraud Funds Cybercriminal 'Holidays'

Cybercriminals are increasingly targeting loyalty points programs, turning accumulated rewards into cash for flights, hotel stays, and other illicit gains.

Sep 7, 2026

research1 source

PEEP Toolkit Turns Chrome and Edge into Backdoors for Host Command Execution

A new post-exploitation toolkit named PEEP leverages Chrome and Edge browser extensions to establish a backdoor for executing commands on compromised hosts, bypassing standard security checks.

Sep 7, 2026

advisory1 source · 22 CVEs

JetBrains YouTrack: 22 Vulnerabilities Disclosed, Ranging from Account Takeover to Privilege Escalation

Key findings • 22 vulnerabilities disclosed simultaneously for JetBrains YouTrack on September 7, 2026. • Vulnerabilities range from Medium to Critical severity, impacting multiple versions. …

Sep 7, 2026 · updated Sep 8, 2026

advisory2 sources · 23 CVEs

Dell Secure Connect Gateway: 25 Vulnerabilities Disclosed Together, Ranging from Command Injection to Info Disclosure

Key findings • Dell Secure Connect Gateway 5.0 impacted by 25 vulnerabilities disclosed on September 7, 2026. • High-severity flaws include OS command injection, missing authentication, and i…

Sep 7, 2026 · updated Sep 8, 2026

breach2 sources

Executives Targeted in Microsoft 365 Data Theft via Vishing and Token Hijacking

A sophisticated threat cluster is targeting executives with Microsoft 365 data theft and extortion, using vishing, AitM token theft, and residential proxies.

Sep 7, 2026 · updated Sep 8, 2026