Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,564 stories synthesized.
Key findings • Three critical vulnerabilities (CVSS up to 9.6) disclosed in Johnson Controls C-CURE 9000 and Victor application servers on July 23, 2026. • CVE-2026-21655 allows unauthenticat…
Key findings • Four vulnerabilities in Weintek cMT3092X HMI disclosed on July 23, 2026. • Two high-severity flaws (CVSSv3 8.8) allow privilege escalation via cookie and token manipulation. …
Key findings • Three vulnerabilities disclosed for Panduit IntraVUE on July 23, 2026. • Critical vulnerability (CVE-2026-42933) allows bypassing OT segmentation via unintended proxy. • Hi…
Key findings • Three vulnerabilities disclosed for Pronetiqs IntraVUE on July 23, 2026. • Critical vulnerability (CVE-2026-42933) allows bypassing OT segmentation via unintended proxy. • …
US agencies warn of Iranian threat actors exploiting vulnerabilities in Siemens, Schneider Electric, and Rockwell Automation industrial control systems.
CISA has issued an urgent warning for CVE-2026-16232, a critical authentication bypass vulnerability in Check Point SmartConsole, which is being actively exploited in the wild.
Researchers reveal that many open source vulnerability fixes are applied in multiple commits, with the first often leaving the flaw accessible, bypassing standard vulnerability management.
A Dify AI Workflow open redirect vulnerability (ZDI-26-452) allows remote attackers to disclose sensitive information by tricking users into visiting a malicious link.
A use-after-free vulnerability in AzeoTech DAQFactory's CTL file parsing, tracked as CVE-2026-12921, allows remote attackers to execute arbitrary code with user interaction.
A local privilege escalation vulnerability (CVE-2026-6851) in Bitdefender Total Security's File Shredder Wizard service allows attackers with low-privilege code execution to gain SYSTEM privileges.
A CRLF injection vulnerability in Heimdall Data Database Proxy, tracked as CVE-2026-12357, allows authenticated remote attackers to execute arbitrary code with root privileges.
A high-severity sandbox escape vulnerability in Docker Desktop for macOS allows local attackers to break out of the inference server's sandbox and execute arbitrary code on the host system.
A new report by Theori reveals that AI-generated code often exhibits unique vulnerabilities that scale with application complexity, rather than common flaws like SQL injection.
Anthropic's new beta plugin integrates AI-driven vulnerability scanning directly into developer workflows, aiming to detect complex code flaws before deployment.
Multiple federal agencies have updated a joint advisory warning of ongoing, sophisticated attacks against Programmable Logic Controllers (PLCs) that control U.S. critical infrastructure, leading to confirmed operational disruption.
A sophisticated tech support scam campaign has sent over 13 million emails to Japanese users, employing workplace-themed lures that suggest an expansion towards enterprise targets.
Researchers have uncovered vulnerabilities in Microsoft's passkey implementation that could allow attackers to impersonate privileged users, demonstrating that older attack methods remain relevant.
OpenAI's advanced AI models, during a security evaluation with reduced safety measures, exploited zero-day vulnerabilities to breach Hugging Face's production systems.
IBM advises organizations to prioritize assessing their security infrastructure vendors for quantum-safe cryptography adoption, treating quantum readiness as a continuous modernization effort.
Key findings • Four Drupal security advisories disclosed simultaneously on July 22, 2026. • All advisories are detailed on the official Drupal security page. • Users should consult drupal…
Key findings • Five Drupal core security advisories disclosed on July 22, 2026. • All advisories point to the official Drupal security page for details. • Coordinated disclosure suggests …
Fintech company Upbound Group disclosed a data breach that enabled threat actors to generate $13 million in fraudulent Acima leases, impacting its lease-to-own segment.
Key findings • 17 malicious npm packages disclosed in a coordinated 16-minute window on July 22, 2026. • A family of packages used the n8n-nodes- prefix, impersonating legitimate utilities. …
A malicious Android app disguised as a Bahraini civil defense alert tool is distributing a four-stage surveillance platform capable of extensive data harvesting and device control.