Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,997 stories synthesized.
Key findings • Two critical ANGLE vulnerabilities (CVE-2026-10881, CVE-2026-11088) allow sandbox escapes. • A medium-severity flaw (CVE-2026-11090) enables cross-origin data leakage. • Al…
The Pink extortion group is using voice phishing and fake IT helpdesk calls to steal credentials, bypass MFA, and exfiltrate data from cloud storage, threatening victims with public data leaks.
The Windows version of the Hola Browser has been compromised through a supply chain attack, distributing an undeclared cryptocurrency miner to unsuspecting users.
Wordfence's Q1 2026 Threat Intelligence Report indicates a dramatic surge in WordPress vulnerabilities, with a nearly 100% increase in critical flaws and billions of attacks blocked.
A new Magecart campaign is leveraging Stripe's API infrastructure to host malicious JavaScript payloads and exfiltrate stolen credit card data, making detection more difficult.
Volexity details how the VerdantBamboo (WARP PANDA) threat actor maintained a persistent presence for at least 18 months, exploiting a customer's Egnyte Storage Sync appliance and an MSP's pfSense firewall using BRICKSTORM malware.
Key findings • Nine Shopware vulnerabilities disclosed on June 4, 2026, span privilege escalation, XSS, and SSRF. • Multiple CVEs allow unauthorized users to gain administrator privileges. …
Key findings • Three medium-severity vulnerabilities disclosed in Netty's incubator codec.bhttp. • Flaws impact Oblivious HTTP (OHTTP) implementation and cryptographic operations. • CVE-2…
Microsoft's AI Red Team has released an updated taxonomy of failure modes in agentic AI systems, incorporating seven new categories based on a year of red teaming and the rapid rise of open-source frameworks.
DTEX researchers highlight how AI agents like Anthropic's Claude Cowork, through features like the Dispatch workflow, can grant near-total system access, enabling rapid data exfiltration and posing a substantial insider threat.
Cisco Talos is enhancing its threat hunting capabilities by integrating AI-driven telemetry analysis with human expertise to proactively detect advanced adversaries.
Anthropic's advanced AI model, Claude Oceanus-v1-p, intended for red team security evaluations, was compromised before its formal rollout, with unauthorized API access being resold on the black market.
A new supply-chain attack has compromised 36 packages on the npm registry with the IronWorm infostealer malware, targeting developers' sensitive information.
A vulnerability in Anthropic's Claude Code GitHub Action enabled attackers to hijack public repositories by submitting a single malicious issue.
A critical vulnerability in B&R's PPT30 Operating System could allow unauthenticated attackers to render the OPC-UA server inaccessible, impacting critical infrastructure sectors worldwide.
CISA alerts users to two critical vulnerabilities in Hitachi Energy's ITT600 Explorer product that could allow remote attackers to cause denial-of-service conditions.
CISA has issued an advisory for a critical vulnerability in NAVTOR NavBox software, stemming from hard-coded credentials that could allow local attackers to manipulate files and disrupt operations.
Proofpoint warns that the financially motivated cybercrime group TA4922 is deploying a sophisticated and rapidly evolving arsenal of malware, including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT, against organizations worldwide.
Wordfence Intelligence has disclosed 277 vulnerabilities affecting 184 WordPress plugins and 70 themes between May 25-31, 2026, including critical flaws in WP Maps Pro and WooCommerce Custom Product Addons Pro.
Advanced AI models are discovering vulnerabilities at an unprecedented rate, challenging traditional security remediation timelines and forcing vendors to innovate faster.
Key findings • Four high-severity vulnerabilities in Axios disclosed simultaneously on June 4th, 2026. • ReDoS vulnerability (CVE-2026-44496) due to unescaped cookie names in regex. • Res…
Key findings • High-severity authentication bypass (CVE-2026-10611) affects MISP with LDAP mixed auth and OTP. • Four medium-severity flaws include open redirect, URL validation, authorizatio…
Key findings • Three medium-severity vulnerabilities disclosed together for Itsourcecode Fees Management System 1.0. • Includes two SQL injection flaws (CVE-2026-10809, CVE-2026-10808) and on…
Key findings • Eight vulnerabilities disclosed by HCL Software between June 2-4, 2026. • Affected products include BigFix, Hive Telco Observability, iControl, and iReflection. • Vulnerabi…