Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 7,946 stories synthesized.
Fortinet has disclosed a high-severity OS command injection vulnerability in the web UI of FortiSandbox Cloud and FortiSandbox PaaS, allowing privileged attackers to execute arbitrary commands.
Fortinet disclosed a format string vulnerability in the fazsvcd daemon affecting FortiAnalyzer and FortiManager, allowing remote privileged attackers to execute arbitrary code.
Fortinet disclosed an argument injection vulnerability in FortiDeceptor's WEBUI that allows super-admin attackers with CLI access to delete sensitive files via crafted HTTP requests.
Microsoft has patched a use-after-free vulnerability in the Windows NDIS driver (ndis.sys) that lets low-privileged attackers gain kernel-level code execution.
Microsoft has patched a high-severity local privilege escalation vulnerability in the Windows cdd.dll driver that allows attackers with low-privileged code execution to gain SYSTEM-level access.
Microsoft has released a security update for a local privilege escalation vulnerability in the win32kfull driver, tracked as CVE-2026-24285, which allows attackers to gain SYSTEM privileges.
A local privilege escalation vulnerability in Array Networks MotionPro, tracked as CVE-2026-26364, allows low-privileged attackers to gain SYSTEM-level access via incorrect permissions in the ArrayInstallManager DCOM application.
Microsoft has released a security update addressing CVE-2026-25181, an out-of-bounds read information disclosure vulnerability in Windows GDI bitmap parsing that could leak sensitive memory.
Apple has patched a critical out-of-bounds write vulnerability (CVE-2026-20616) in macOS's libusd_ms library that could allow remote attackers to execute arbitrary code via a malicious Alembic file.
A local privilege escalation vulnerability in Fortinet FortiClient, tracked as CVE-2026-24018, allows attackers to gain root access via a symbolic link attack on shared objects.
Apple has released a security update for macOS to fix CVE-2026-20634, an out-of-bounds read vulnerability in the ImageIO framework that can be triggered by a specially crafted SGI image file.
Microsoft has patched a high-severity local privilege escalation vulnerability in the Windows cdd.dll driver that allows attackers with low-privileged code execution to gain SYSTEM privileges.
Apple has released a security update addressing CVE-2026-20675, a critical integer overflow vulnerability in the macOS ImageIO framework that could allow remote code execution via crafted SGI image files.
Microsoft has released a patch for CVE-2026-23668, a critical local privilege escalation vulnerability in the win32kfull driver that allows attackers to gain SYSTEM privileges.
Apple has released a security update for macOS to address CVE-2026-20611, a critical out-of-bounds write vulnerability in the Audio APAC frame decoder that could allow remote code execution with user interaction.
Microsoft has patched a local privilege escalation vulnerability in the Windows win32kfull driver, tracked as CVE-2026-24285, which allows an attacker with low-privileged code execution to gain SYSTEM-level access.
Trend Micro researchers have identified critical security weaknesses in OpenClaw, a viral sovereign agent framework, including insufficient input validation and potential for arbitrary code execution.
Trend Micro MDR analysis reveals KongTuke still uses compromised WordPress sites and fake CAPTCHA lures to deliver modeloRAT, leveraging legitimate Windows tools for stealth.
Huntress researchers uncovered a campaign where a threat actor exploited vulnerabilities in SolarWinds Web Help Desk and other enterprise software, then used a free trial of Elastic Cloud SIEM to store and triage stolen system data from over 200 hosts.
A breach at TriZetto Provider Solutions, a Cognizant subsidiary, has compromised the personal and health insurance information of over 3.4 million patients.
A critical path traversal vulnerability in Unraid's auth-request.php allows unauthenticated attackers to bypass authentication entirely, with a CVSS score of 7.3.
A critical path traversal vulnerability in Unraid (CVE-2026-3838) allows authenticated remote attackers to execute arbitrary code as root, with a CVSS score of 8.8.
Trend Micro researchers demonstrated document-based exploits against AI-driven KYC pipelines and introduced FENRIR, an automated system for discovering AI vulnerabilities at scale.