Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,755 stories synthesized.
A critical prompt injection vulnerability in FlowiseAI's CSV Agent, tracked as CVE-2026-41264, allows unauthenticated attackers to achieve remote code execution with a CVSS score of 9.8.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9776 with a CVSS score of 7.5, allows unauthenticated remote attackers to disclose sensitive information at the SYSTEM level.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9777 with a CVSS score of 7.2, allows authenticated remote attackers to execute arbitrary code at the SYSTEM level.
A new SQL injection flaw in Quest NetVault Backup's NVBUDashboard component, tracked as CVE-2026-9786 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A new command injection flaw in Unraid's Web Server, tracked as CVE-2026-9773 with a CVSS score of 8.8, allows authenticated attackers to execute arbitrary code remotely.
A high-severity cryptographic signature verification flaw in ATEN Unizon, tracked as CVE-2026-9779 with a CVSS score of 7.2, allows authenticated remote attackers to execute arbitrary code at the SYSTEM level.
A use-after-free bug in X.Org Server's FreeCounter component (CVE-2026-50260, CVSS 7.8) lets local attackers escalate privileges to root on affected Linux systems.
A high-severity command injection flaw in Unraid's Web Server FileUpload functionality, tracked as CVE-2026-9772, could let authenticated attackers execute arbitrary code on affected systems.
A critical argument injection vulnerability in Docker MCP Plugin (CVE-2026-55887, CVSS 8.6) allows remote code execution when users reference malicious Docker images.
A directory traversal vulnerability in ATEN Unizon, tracked as CVE-2026-9778 with a CVSS score of 7.2, allows authenticated remote attackers to execute arbitrary code at the SYSTEM level.
A critical stack-based buffer overflow in X.Org Server's Xkb Key Types handling, tracked as CVE-2026-50258, allows local attackers to escalate privileges to root on affected Linux systems.
A critical SQL injection vulnerability in Quest NetVault Backup's NVBUDashboard component, tracked as CVE-2026-7570 with a CVSS score of 8.8, allows authenticated attackers to bypass authentication and execute arbitrary code.
A cross-site scripting flaw in the addclient3 component of Quest NetVault Backup (CVE-2026-9780) allows remote attackers to bypass authentication with a CVSS score of 8.8.
A critical SQL injection flaw in Quest NetVault Backup's NVBUDeviceDrive component, tracked as CVE-2026-9782 with a CVSS score of 8.8, allows remote attackers to bypass authentication and execute arbitrary code.
A use-after-free vulnerability in Adobe Acrobat Reader DC's Field signatureInfo component, tracked as CVE-2026-27278 with a CVSS score of 7.8, could allow remote attackers to execute arbitrary code by tricking users into opening a malicious file or visiting a malicious page.
Japanese telecom giant KDDI disclosed a breach of its managed email service affecting up to 14.2 million users after attackers exploited a third-party software vulnerability.
A new report from Aikido Security reveals that 76% of organizations have stopped, restricted, or rolled back AI-driven behavior due to security testing gaps.
Key findings • Eight vulnerabilities disclosed on June 24, 2026, affect GeoVision GV-I/O Box 4E and GV-VMS V20. • Multiple OS command injection flaws exist in the libNetSetObj.so library of t…
GitLab released versions 19.1.1, 19.0.3, and 18.11.6 fixing multiple vulnerabilities, including two high-severity cross-site scripting flaws.
Key findings • Seven memory-safety CVEs disclosed together for GPAC/MP4Box, all fixed in version 26.02.0 • Four use-after-free bugs cluster in the filter pipeline code at filter_core/filter_p…
Mandiant reveals a threat actor exploited CVE-2026-20245, a zero-day privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager, to gain root access after breaching networks via rogue peering connections.
Palo Alto Networks' Unit 42 discovered five malicious skills on OpenClaw's ClawHub marketplace that bypassed automated scanners to deploy infostealers and execute agentic financial fraud, revealing persistent AI supply chain risks.
Cisco warns that a high-severity SSRF vulnerability in Unified Communications Manager is being actively exploited, urging immediate patching.
A Tennessee-based AI healthcare vendor is notifying nearly 1.4 million individuals of a data breach, spotlighting growing supply-chain risks from AI technology vendors.