Stories

Every story we’ve synthesized.

Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,942 stories synthesized.

patch1 source

Apple Releases iOS 16.7.15 with Security Fixes

Apple released iOS 16.7.15 (build 20H380) on March 11, 2026, addressing security vulnerabilities in the iOS 16 operating system.

Mar 11, 2026 · updated May 18, 2026

patch1 source

Apple Releases iPadOS 16.7.15 Security Update for Older iPad Models

Apple released iPadOS 16.7.15 (build 20H380) on March 11, 2026, delivering security fixes for iPad models that cannot upgrade to newer iPadOS versions.

Mar 11, 2026 · updated May 18, 2026

patch1 source

Apple Releases iPadOS 15.8.7 with Security Fixes

Apple has released iPadOS 15.8.7 (build 19H411) as a security update for older iPad models, addressing unspecified vulnerabilities.

Mar 11, 2026 · updated May 18, 2026

patch1 source

Apple Releases iOS 15.8.7 Security Update for Older Devices

Apple has released iOS 15.8.7 (build 19H411) as a security update for older iPhone and iPad models, addressing unspecified vulnerabilities in the operating system.

Mar 11, 2026 · updated May 18, 2026

research1 source

Unit 42's AdvJudge-Zero Fuzzer Bypasses LLM Guardrails with 99% Success Rate

Palo Alto Networks' Unit 42 has developed AdvJudge-Zero, an automated fuzzer that exploits LLM-based 'AI Judge' guardrails to authorize policy-violating outputs with a 99% success rate across multiple model architectures.

Mar 11, 2026 · updated May 18, 2026

research1 source

Trail of Bits Unveils Six Critical Vulnerability Patterns in ERC-4337 Smart Accounts

Trail of Bits has identified six common vulnerability patterns in ERC-4337 smart accounts after auditing dozens of implementations, warning that a single bug can be as catastrophic as leaking a private key.

Mar 11, 2026 · updated May 20, 2026

patch1 source · 5 CVEs

Microsoft Patches Two Publicly Disclosed Zero-Days in March 2026 Patch Tuesday

Microsoft's March 2026 Patch Tuesday addresses 79 vulnerabilities, including two publicly disclosed zero-days: an SQL Server elevation of privilege bug and a .NET denial-of-service flaw.

Mar 11, 2026 · updated May 18, 2026

patch1 source · 9 CVEs

Microsoft Patch Tuesday, March 2026 Edition: 77 Flaws Fixed, AI-Discovered Bug Highlights Shift in Vulnerability Research

Microsoft's March 2026 Patch Tuesday addresses 77 vulnerabilities, including two publicly disclosed flaws and a critical bug discovered by an autonomous AI agent, signaling a new era in vulnerability research.

Mar 11, 2026 · updated May 18, 2026

patch1 source · 15 CVEs

GitLab Patches High-Severity XSS and DoS Flaws Across Multiple Versions

GitLab released versions 18.9.2, 18.8.6, and 18.7.6 on March 11, 2026, fixing multiple high-severity vulnerabilities including a cross-site scripting bug and several denial-of-service issues.

Mar 11, 2026 · updated May 20, 2026

research1 source

Iranian MOIS-Linked Hackers Increasingly Tap Cyber Crime Ecosystem for Tools, Infrastructure

Check Point Research reveals that Iranian MOIS-affiliated groups like Void Manticore and MuddyWater are moving beyond imitation to directly engage with the cyber crime ecosystem, using commercial infostealers, ransomware branding, and affiliate models to advance state objectives.

Mar 10, 2026 · updated May 18, 2026

patch1 source

WordPress 6.9.2 Patches 11 Vulnerabilities Including Blind SSRF, XSS, and Path Traversal

WordPress 6.9.2, a security release fixing 11 vulnerabilities including a blind SSRF, stored XSS, path traversal, and an XXE in the bundled getID3 library, is available now with an urgent recommendation to update.

Mar 10, 2026 · updated May 20, 2026

trend1 source · 1 CVE

Google Cloud Report Reveals Vulnerability Exploits Overtake Credential Theft as Top Cloud Attack Vector

Google Cloud's H1 2026 Threat Horizons Report shows vulnerability exploits now account for 44.5% of initial cloud access vectors, up from 2.9%, as attackers weaponize flaws like React2Shell within 48 hours of disclosure.

Mar 10, 2026 · updated May 18, 2026

advisory1 source

Dutch Intelligence Warns of Russian State-Sponsored Campaign Targeting Signal and WhatsApp Accounts

Dutch intelligence agencies have uncovered a large-scale Russian state-sponsored campaign targeting Signal and WhatsApp accounts of military, government, and journalist personnel, with some Dutch government employees already compromised.

Mar 10, 2026 · updated May 18, 2026

breach2 sources

7-Eleven Confirms Data Breach After ShinyHunters Ransom Demand

7-Eleven has confirmed a data breach after the ShinyHunters threat actor claimed to have stolen over 600,000 Salesforce records and demanded a ransom.

Mar 10, 2026 · updated May 18, 2026

research1 source · 1 CVE

Sednit Reloaded: APT28 Deploys Modern Implants Against Ukrainian Military

ESET researchers reveal that Sednit (APT28) reactivated its advanced implant team in April 2024, deploying a modern toolkit including SlimAgent, BeardShell, and Covenant against Ukrainian military personnel.

Mar 10, 2026 · updated May 18, 2026

advisory1 source

Fortinet Warns of Authentication Lockout Bypass in FortiManager and FortiAnalyzer via Race Condition

Fortinet disclosed a low-severity vulnerability in FortiManager and FortiAnalyzer that allows attackers to bypass brute-force lockout protections by exploiting a race condition in the authentication mechanism.

Mar 10, 2026 · updated May 20, 2026

patch1 source

Fortinet Discloses Stack-Based Buffer Overflow in FortiManager fgtupdates Service (FG-IR-26-098)

Fortinet has disclosed a stack-based buffer overflow vulnerability in the FortiManager fgtupdates service that could allow remote unauthenticated attackers to execute unauthorized commands.

Mar 10, 2026 · updated May 20, 2026

advisory1 source

Fortinet Discloses Authentication Rate-Limit Bypass in FortiWeb Allowing Brute-Force Attacks

Fortinet disclosed an improper control of interaction frequency vulnerability in FortiWeb that allows remote unauthenticated attackers to bypass authentication rate-limiting and brute-force admin logins.

Mar 10, 2026 · updated May 20, 2026

advisory1 source

Fortinet Discloses Cleartext Password Exposure in FortiMail, FortiVoice, and FortiRecorder Debug Logs

Fortinet has disclosed a cleartext storage vulnerability in debug logs of FortiMail, FortiVoice, and FortiRecorder that allows an authenticated administrator to extract plaintext user secrets via CLI commands.

Mar 10, 2026 · updated May 20, 2026

advisory1 source

Buffer Overflow in FortiSwitchAXFixed LLDP OUI Field Allows Remote Code Execution

Fortinet disclosed a buffer overflow vulnerability in FortiSwitchAXFixed that lets an unauthenticated attacker on the same adjacent network execute arbitrary code via a crafted LLDP packet.

Mar 10, 2026 · updated May 20, 2026

advisory1 source

Fortinet Discloses OS Command Injection Vulnerability in FortiSandbox Cloud and PaaS

Fortinet has disclosed a high-severity OS command injection vulnerability in the web UI of FortiSandbox Cloud and FortiSandbox PaaS, allowing privileged attackers to execute arbitrary commands.

Mar 10, 2026 · updated May 20, 2026

patch1 source

Format String Vulnerability in FortiAnalyzer and FortiManager fazsvcd Daemon Allows Remote Code Execution

Fortinet disclosed a format string vulnerability in the fazsvcd daemon affecting FortiAnalyzer and FortiManager, allowing remote privileged attackers to execute arbitrary code.

Mar 10, 2026 · updated May 20, 2026

advisory1 source

FortiDeceptor WEBUI Argument Injection Allows Arbitrary File Deletion by Privileged Attackers

Fortinet disclosed an argument injection vulnerability in FortiDeceptor's WEBUI that allows super-admin attackers with CLI access to delete sensitive files via crafted HTTP requests.

Mar 10, 2026 · updated May 20, 2026

patch1 source · 1 CVE

CVE-2026-24289: Microsoft Windows NDIS Driver Use-After-Free Flaw Allows Kernel Privilege Escalation

Microsoft has patched a use-after-free vulnerability in the Windows NDIS driver (ndis.sys) that lets low-privileged attackers gain kernel-level code execution.

Mar 10, 2026 · updated May 18, 2026