Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,299 stories synthesized.
CISA has added CVE-2026-48907, an improper access control vulnerability in the Widget Factory Joomla Content Editor, to its Known Exploited Vulnerabilities catalog due to active exploitation.
Backslash Security found that Anthropic silently patched over 30 security flaws in Claude Code within two months, exposing a security gap caused by the rapid release cycle of AI coding tools.
Key findings • Three improper-access-control CVEs disclosed together for Devolutions Server • CVE-2026-12117 lets authenticated users enumerate social login metadata via a crafted API request…
Key findings • Two critical RCE bugs (CVE-2026-0164, CVE-2026-0139) in the Modem baseband, both remotely exploitable without user interaction • Two remote DoS CVEs (CVE-2026-0156, CVE-2026-01…
A Python developer narrowly avoided a supply-chain attack after an AI coding agent flagged a backdoor hidden in a fake Node.js repository sent by a LinkedIn recruiter posing as a crypto startup.
Key findings • Adobe disclosed 5 CVEs on June 16, 2026: 4 in DNG SDK, 1 in Acrobat PDF Extension for Chrome • CVE-2026-47964 is a heap-based buffer overflow in DNG SDK rated High (CVSS 7.8), …
Key findings • 25 CVEs disclosed in a single day across OpenClaw versions before 2026.5.x • Highest severity is CVE-2026-53843 (CVSS 8.8): device session re-establishes authority after revoca…
Three critical Fortinet FortiSandbox vulnerabilities, including authentication bypass and remote code execution flaws, are being actively exploited in the wild, according to threat intelligence firm Defused.
Attackers compromised ShapedPlugin's build pipeline, injecting a critical backdoor (CVE-2026-10735) into Pro plugin updates distributed through official channels, affecting over 400,000 sites.
CISA disclosed two vulnerabilities in Rockwell Automation CompactLogix 5370 controllers that could allow unauthenticated denial-of-service attacks, urging updates to version V38.011.
CISA disclosed CVE-2025-14272, a missing authorization vulnerability in Rockwell Automation FactoryTalk Analytics PavilionX that could allow unauthenticated attackers to execute privileged operations.
CISA disclosed two vulnerabilities in Rockwell Automation FLEX I/O EtherNet/IP adapters, including a critical authentication bypass (CVE-2026-0647) and a high-severity denial-of-service flaw (CVE-2026-0646).
CISA disclosed CVE-2020-13573, a high-severity stack-based buffer overflow in Rockwell Automation RSLinx Classic versions ≤4.50.00, which could allow remote code execution or denial-of-service.
CISA has disclosed CVE-2026-11317, a high-severity denial-of-service vulnerability in Rockwell Automation Logix 5370 and 5570 controllers that can cause a major nonrecoverable fault requiring a full program download to recover.
Key findings • Six of seven CVEs share a use-after-free pattern: reading packet metadata after ownership transferred to the TX path • CVE-2026-10635 (CVSS 6.3) is a use-after-free in Xtensa M…
The Lorem Ipsum malware campaign, now linked to the Vice Society ransomware group, has shifted to ClickFix lures hosted on compromised WordPress sites after Microsoft disrupted its certificate supply.
India's MeitY has temporarily blocked Telegram nationwide until June 22, 2026, to combat organized cheating schemes targeting the NEET UG 2026 medical entrance exam.
Key findings • Three of the five CVEs affect AWS Lambda adapters — body-limit bypass, header dropping, and cookie merging • CVE-2026-54290 is a high-severity CORS misconfiguration that expo…
ReversingLabs has uncovered an active Device Code phishing campaign that tricks Microsoft 365 users into authorizing attacker devices via legitimate OAuth flows, bypassing password theft entirely.
Varonis researchers detail GhostTree, a technique that exploits recursive NTFS junctions to generate billions of valid file paths, causing Microsoft Defender folder scans to hang and allowing malware to remain undetected.
GitGuardian's new Developer Endpoint Protection tool scans workstations for plaintext secrets and AI agent artifacts, addressing a credential theft pattern behind recent supply-chain attacks.
Key findings • 25 CVEs disclosed in a single coordinated advisory on June 16, 2026 • Two Critical-rated DOM Security mitigation bypasses (CVE-2026-12316, CVE-2026-12315) at CVSS 9.1 • Eig…
Key findings • One critical mitigation bypass (CVE-2026-12315, CVSS 9.1) in the DOM Security component • Multiple high-severity memory safety bugs (CVE-2026-12326, CVE-2026-12324, CVE-2026-12…
Key findings • Two critical-rated DOM Security mitigation bypasses (CVE-2026-12316, CVE-2026-12315) rated CVSSv3 9.1 • Eight high-severity memory safety bugs, including one rated 8.1 (CVE-202…