Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,562 stories synthesized.
A BlackFog report reveals that nearly half of security leaders have experienced sensitive data exposure via AI tools, highlighting a critical lack of visibility and control over enterprise AI usage.
Microsoft's November 2026 Patch Tuesday is set to be its largest ever, with 1,407 CVEs to be patched, including a zero-day vulnerability that has already been exploited in the wild.
A new market report ranks deception technology solutions for 2026, with Thinkst Canary taking the top spot for its simplicity and effectiveness, while identity-based deception gains prominence.
New research from Masaryk University reveals that many vulnerabilities in certified products are disclosed after their certification date, challenging the perceived security assurance of certifications like Common Criteria and FIPS-140.
A heap-based buffer overflow in libilbm's ILBM file parsing, disclosed by Zero Day Initiative, enables remote code execution with user interaction.
A vulnerability in Philips Hue Bridge Pro allows local attackers to write to restricted files, requiring prior code execution within a container.
A use-after-free vulnerability in Trimble SketchUp's SKP file parsing allows remote attackers to execute arbitrary code on affected systems.
A server-side request forgery (SSRF) vulnerability in Home Assistant Green's aiohttp_client component allows network-adjacent attackers to make arbitrary server-side requests without authentication.
A critical vulnerability in OriginLab Origin Viewer allows remote attackers to execute arbitrary code by exploiting a flaw in OPJU file parsing, requiring user interaction.
A critical integer underflow vulnerability in Quest NetVault Backup's nvpmgr component allows unauthenticated remote attackers to cause a denial-of-service condition.
A critical remote code execution vulnerability (CVE-2026-121614) in Docker Sandboxes allows local attackers to execute arbitrary code by exploiting flaws in sandbox creation.
Zero Day Initiative disclosed CVE-2026-122044, a critical authentication bypass vulnerability in Philips Hue Bridge Pro, allowing network-adjacent attackers to gain unauthorized access.
A heap-based buffer overflow in LibreOffice's dBase file parsing component, disclosed by Zero Day Initiative, allows remote attackers to execute arbitrary code.
A backdoor dubbed 'cwpdoor' has been discovered within the web server component of the popular Control Web Panel (CWP) for Linux, allowing attackers to execute commands without logging.
A new report from BlueFlag Security highlights a critical security gap: 99% of repository access tokens lack expiration dates, leaving code repositories vulnerable to prolonged unauthorized access.
Cybercriminals are deploying sophisticated phishing sites that impersonate popular holiday rental platforms, using realistic listings and live chat support to trick travelers into revealing sensitive personal and financial information.
Cloudflare CEO Matthew Prince highlights the significant threat posed by AI agents to website operators, predicting traffic volumes a thousand times greater than human users and questioning the cost-effectiveness of container-based architectures.
Prosecutors have indicted three individuals accused of using artificial intelligence to impersonate corporate executives and attorneys in a scheme that defrauded organizations of approximately $129 million.
Shopify is enforcing IP allowlisting for public apps accessing its Admin API by November 20, 2026, to combat unauthorized access via stolen tokens.
A critical vulnerability in Microsoft Paint (CVE-2026-3824) allows for remote code execution through an out-of-bounds read, with exploitation complexity noted as 'Less Likely'.
Key findings • SonicWall CVE-2026-19868 has been added to CISA's KEV catalog. • The vulnerability is confirmed to be under active exploitation in the wild. • Organizations must apply avai…
Delinea CEO Art Gilliland emphasizes the need for runtime authorization and continuous monitoring to manage the security risks posed by autonomous AI agents accessing enterprise systems.
Threat actors are weaponizing agentic AI frameworks like ARTEX to rapidly scan public repositories for exposed secrets, leading to swift cloud resource compromise and data exfiltration.
A wave of cyber incidents highlights the evolving landscape of hybrid warfare, featuring Ukraine's response to Russian cyberattacks, a significant breach at Norway's aid agency, and the emerging use of AI by threat actors.