Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,133 stories synthesized.
A local privilege escalation vulnerability in PDF-XChange Editor's TrackerUpdate component, tracked as CVE-2026-2040, allows attackers to load malicious libraries and execute code at elevated privileges.
A critical uninitialized memory vulnerability in GIMP's PGM file parsing (CVE-2026-2044) allows remote code execution, requiring only that a user opens a malicious file.
A high-severity out-of-bounds write vulnerability in GIMP's XWD file parsing, tracked as CVE-2026-2048, allows attackers to execute arbitrary code by tricking users into opening a crafted XWD image file.
A critical out-of-bounds write vulnerability in GIMP's XWD file parsing (CVE-2026-2045) allows remote code execution when a user opens a crafted image, with a CVSS score of 7.8.
Jenkins released Security Advisory 2026-02-18 addressing two vulnerabilities in Jenkins Core, including a stored XSS flaw rated High severity.
Trail of Bits disclosed that two widely used AES libraries, aes-js and pyaes, supply a default IV in CTR mode, causing widespread key/IV reuse vulnerabilities across thousands of downstream projects.
Threat actors exploited Atlassian Jira Cloud's trusted infrastructure to run automated spam campaigns targeting government and corporate entities, bypassing traditional email security by abusing the platform's strong domain reputation.
Fortinet disclosed a vulnerability in FortiOS SSL-VPN that allows attackers to bypass a patch for a symbolic link persistence mechanism via crafted HTTP requests.
GitLab released versions 18.8.4, 18.7.4, and 18.6.6 on February 10, 2026, patching multiple vulnerabilities including a high-severity Web IDE token theft bug (CVE-2025-7659) and two denial-of-service issues.
Trend Micro researchers analyze OpenClaw, a new agentic AI system, highlighting its high autonomy and lack of human oversight as key security risks that could enable automated attacks and data exfiltration.
GitLab released emergency patches for a critical vulnerability in its AI Gateway that could allow authenticated attackers to achieve remote code execution via crafted Duo Workflow definitions.
PortSwigger Research published the 19th annual Top 10 Web Hacking Techniques of 2025, highlighting the most innovative web security research from the past year.
Two pre-authentication remote code execution vulnerabilities in Ivanti EPMM are being actively exploited, prompting CISA to add both CVEs to its Known Exploited Vulnerabilities catalog.
ESET researchers have identified DynoWiper, a new data-wiping malware used against an energy company in Poland, and attribute the attack to the Russia-aligned Sandworm group with medium confidence.
A critical stack buffer overflow vulnerability in OpenSSL's CMS AuthEnvelopedData parsing, tracked as CVE-2025-15467, carries a CVSS score of 9.8 and could allow remote code execution.
Trail of Bits has redesigned Sigstore's cryptographic architecture to support algorithm suites, enabling post-quantum readiness and compliance without repeating past agility flaws.
A SQL injection vulnerability (CVE-2025-67987) in the Quiz and Survey Master WordPress plugin, with over 40,000 active installations, allows any authenticated user with Subscriber-level access or higher to execute arbitrary SQL commands.
ESET researchers have uncovered an Android spyware campaign using a fake dating app called GhostChat to target individuals in Pakistan, exfiltrating sensitive data through hardcoded access codes and fake female profiles.
Apple has released iOS 12.5.8 (build 16H88) for older iPhone, iPad, and iPod touch models, addressing undisclosed security vulnerabilities.
Apple has released iPadOS 12.5.8 (build 16H88) for older iPad models, addressing security vulnerabilities that could be exploited by attackers.
Security researchers collected over $1 million for responsibly disclosing 76 zero-day vulnerabilities targeting connected vehicles, EV chargers, and automotive systems at Pwn2Own Automotive 2026 in Tokyo.
Trend Micro reveals PeckBirdy, a JScript-based C2 framework used by China-aligned APT groups since 2023 to abuse legitimate system tools for stealthy attacks on gambling and government targets.
ESET Research has attributed a late-2025 cyberattack on Poland's power grid to the Russia-aligned Sandworm APT group, which deployed a new data-wiping malware named DynoWiper on the 10th anniversary of Sandworm's 2015 BlackEnergy attack on Ukraine.
A critical arbitrary file upload vulnerability (CVE-2025-67968) in the RealHomes CRM WordPress plugin allows any authenticated Subscriber+ user to upload arbitrary files, leading to full site takeover.