Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,946 stories synthesized.
Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities, including a preauthentication RCE in Netlogon and an EoP in the SSO plugin for Jira and Confluence, with no publicly disclosed or exploited bugs.
Microsoft's May 2026 Patch Tuesday updates for Windows 11 fix 120 vulnerabilities and introduce new features including Xbox mode, haptic feedback support, and expanded archive format support in File Explorer.
Microsoft's May 2026 Patch Tuesday addresses 120 vulnerabilities, including 17 critical flaws, with no zero-days disclosed this month.
Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities, including a critical privilege escalation flaw in the Microsoft SSO Plugin for Jira & Confluence and two Word RCE bugs exploitable via the Preview Pane.
Microsoft’s May 2026 Patch Tuesday addresses 118 vulnerabilities, including a critical SSO plugin flaw (CVE-2026-41103) and marks the first month since June 2024 with no zero-days exploited in the wild.
Škoda Auto has disclosed a data breach after attackers exploited a vulnerability in its German online shop, exposing customer names, addresses, and password hashes.
CISA has disclosed a high-severity vulnerability in Fuji Electric Tellus 5.0.2 that allows local attackers to escalate privileges to SYSTEM via an exposed kernel driver.
CISA has issued an advisory for CVE-2024-41975, an insecure default vulnerability in ABB Automation Builder Gateway for Windows that allows unauthenticated remote attackers to scan for AC500 PLCs.
ABB disclosed three vulnerabilities in AC500 V3 PLCs, including forced browsing, certificate theft, and denial-of-service, with firmware 3.9.0 available to fix them.
ABB disclosed three vulnerabilities in its WebPro SNMP Card PowerValue, including an authentication bypass that validates only the first character of session cookies, allowing brute-force attacks.
CISA has issued an advisory detailing four vulnerabilities in Subnet Solutions PowerSYSTEM Center, including an incorrect authorization flaw that could expose sensitive data in critical manufacturing and energy environments.
CISA has disclosed a critical stack buffer overflow vulnerability in ABB AC500 V3 programmable logic controllers that can be exploited remotely without authentication, potentially leading to remote code execution.
Adobe released patches for 52 vulnerabilities across 10 products on Tuesday, including two critical-severity bugs in Adobe Connect that could allow arbitrary code execution and privilege escalation.
A critical use-after-free vulnerability in Exim's BDAT message body parsing, affecting only GnuTLS builds, allows unauthenticated attackers to achieve remote code execution with a CVSS score of 9.8.
Attackers are using sponsored Google search results and shared Claude chats to deliver a ClickFix social-engineering attack targeting macOS users, leading to credential theft.
A critical authentication bypass vulnerability in cPanel & WHM is being actively exploited by the threat group Mr_Rot13 to deploy web shells, steal credentials, and install remote-control trojans.
Microsoft Incident Response reveals a campaign where attackers compromised a third-party IT services provider and abused legitimate HPE Operations Agent to deploy scripts and steal credentials without triggering alerts.
RubyGems has temporarily paused new account registrations after a coordinated attack uploaded more than 500 malicious packages to the Ruby package registry, prompting an emergency response from Mend.io and Ruby Central.
BWH Hotels disclosed that attackers accessed a web application containing guest reservation data for over six months, from October 2025 to April 2026, exposing names, emails, and reservation details.
Instructure, the company behind the Canvas learning platform, confirmed it paid an undisclosed ransom to the ShinyHunters extortion group to recover 3.65 TB of stolen data affecting 275 million records across 8,809 institutions.
Attackers can hijack AI model outputs by tampering with a single tokenizer.json file, enabling man-in-the-middle attacks that expose URLs, API parameters, and credentials to attacker infrastructure.
A new malware campaign dubbed CRPx0 is using a fake OnlyFans account lure to infect Windows and macOS systems with a multi-stage payload that performs cryptocurrency theft, data exfiltration, and ransomware encryption.
Education tech giant Instructure paid a ransom to the ShinyHunters group after two breaches of its Canvas platform, while the House Homeland Security Committee announced an investigation into the company's incident response.
Cloudflare disclosed a bug in its open-source QUIC implementation quiche where the CUBIC congestion controller's window became permanently stuck at its minimum, causing ~60% of integration tests to fail.