Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,965 stories synthesized.
A malicious npm package named 'mouse5212-super-formatter' was discovered acting as an infostealer, targeting developers by exfiltrating files to a remote GitHub repository, with the attacker's hardcoded private token exposed.
Five vulnerabilities spanning four OpenTelemetry language SDKs were disclosed in a 48-hour window, including a high-severity crash bug in the JS Prometheus exporter and a medium-severity TLS validation gap in the Instana exporter.
Nine vulnerabilities, including a critical SAML authentication bypass (CVE-2026-9090, CVSS 9.1), were disclosed in Casdoor 2.362.0 and earlier, with no patch yet available.
Four medium-severity vulnerabilities in the Hono web framework were disclosed together on May 28, 2026, spanning path normalization bypass, cookie injection, IP-restriction evasion, and JWT scheme validation gaps.
Schneider Electric has released version 1.10.0 of EcoStruxure Machine Expert HVAC to fix a cleartext storage vulnerability that could expose protected source code to authorized attackers.
CISA has issued an advisory detailing five vulnerabilities in the Danelec MacGregor Voyage Data Recorder G4e, including default and hard-coded credentials, that could allow attackers to gain full administrator access to maritime transportation systems.
A critical vulnerability (CVE-2026-5386) in KMW CCTV security cameras allows remote attackers to reset the administrator password without authentication, gaining full access to feeds and settings.
CISA warns of three vulnerabilities in XCharge C6 EV charging controllers, including a critical firmware integrity bypass (CVE-2026-9037, CVSS 9.8) that allows unauthenticated remote code execution.
CISA has issued an advisory for CVE-2026-6824, a stored cross-site scripting vulnerability in CP Plus CP-UNR-108F1 NVRs that could allow attackers to hijack sessions and steal data.
CISA has issued an advisory for CVE-2026-5768, a critical missing-authentication vulnerability in Fourth Frontier Frontier X and Frontier X2 heart monitors that could allow attackers to manipulate clinical readings and cause patient harm.
CISA warns of an authentication bypass in ABB Busch-Welcome 2 Wire Door Opener Actuators that allows attackers with physical access to open doors and gates.
CISA disclosed a critical vulnerability (CVE-2026-7786, CVSS 9.8) in Jinan USR IOT's USR-W610 RS232/485 to Wi-Fi/Ethernet converter, where hard-coded plaintext admin credentials in the firmware allow unauthenticated remote attackers to gain full device control.
CISA has issued an advisory for CVE-2021-22291, a high-severity cross-site scripting vulnerability in ABB EIBPORT V3 KNX building management devices that could allow authenticated attackers to hijack sessions and alter device configurations.
A critical privilege escalation vulnerability (CVE-2026-9560, CVSS 9.4) in OpenVPN Connect for macOS allows local attackers to execute arbitrary commands as root via the privileged helper component's IPC channel.
Sonatype analysis of 4,309 malicious packages reveals that 91% use naming-variant tactics like suffix addition and dependency confusion, moving beyond classic typosquatting to evade detection.
Attackers are distributing VIP Keylogger through phishing emails disguised as bank payment notifications and procurement orders, using steganography and multi-stage loaders to evade detection.
A newly disclosed Linux local privilege escalation vulnerability named CIFSwitch lets unprivileged users gain root access by exploiting a logic flaw between the kernel CIFS client and the cifs-utils userspace helper.
Researchers have demonstrated FROST, a JavaScript-only side-channel attack that exploits the Origin Private File System to measure SSD access timing and identify websites and applications a user is running.
Microsoft analyzes The Gentlemen ransomware, a Go-based RaaS using Curve25519 and XChaCha20 encryption with aggressive lateral movement, targeting multiple sectors globally.
Apache disclosed 12 CVEs across seven projects between May 25–28, 2026, with Shiro accounting for four bugs and Airflow's unauthenticated LDAP injection topping the batch's most dangerous flaws.
Token Security researchers disclosed a five-stage exploit chain against Zapier that turned a free account into write access on SDK packages and internal code loaded in every authenticated session.
Qevlar announced AI agents that correlate CVEs with live incident data and active exploitation signals to help SOC and vulnerability management teams prioritize risks in real time.
Edamame Technologies launches a runtime verification platform that uses host telemetry and AI analysis to detect malicious behavior in AI coding agents.
Rapid7 disclosed a critical argument injection vulnerability in Gogs that lets any authenticated user achieve remote code execution on the server, with no patch available.