Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,187 stories synthesized.
Key findings • 11 malicious npm packages disclosed on September 24, 2026 • All advisories published within an 11-minute window • Multiple packages impersonated the @baanx/ and @insiderint…
CISA has published a whitepaper detailing four 'dimensions of quality' to enhance the CVE program, aiming to improve vulnerability cataloging and characterization amidst growing volume.
Key findings • Two critical (CVSSv3 9.9) and two medium (CVSSv3 4.3) vulnerabilities disclosed for GitLab CE/EE. • Critical flaws CVE-2026-93577 and CVE-2026-89078 allow arbitrary code execut…
Key findings • GitLab CE/EE: Five vulnerabilities disclosed on September 24, 2026, including two critical RCE flaws. • Critical flaws CVE-2026-93577 and CVE-2026-89078 allow arbitrary code ex…
Key findings • Adobe CVE-2026-71362 confirmed under active exploitation. • Vulnerability added to CISA's KEV catalog on September 24, 2026. • Federal agencies must remediate by March 24, …
Key findings • Five High/Critical vulnerabilities in IBM DataStage on Cloud Pak for Data 5.4.0.0 disclosed Sept 22-23, 2026. • Critical CVE-2026-16346 (CVSS 9.9) allows arbitrary command exec…
Key findings • Twelve high and critical vulnerabilities disclosed for IBM DataStage on Cloud Pak for Data 5.4.0.0 between Sep 22-23, 2026. • Multiple flaws allow arbitrary command or code exe…
Independent researcher discovers multiple critical flaws in the open-source DCM4CHE medical imaging archive, potentially allowing data deletion, forgery, and denial-of-service attacks.
Key findings • 15 vulnerabilities disclosed for IBM Concert versions 1.0.0 through 3.0.0 between 2026-09-22 and 2026-09-23. • Critical flaws include memory corruption (CVE-2026-6928, CVE-2026…
Key findings • Critical CVE-2026-67404 allows MITM attacks due to insecure SSL fallback without CA bundle. • High severity flaws include message size validation bypass (CVE-2026-67235) and at…
A novel process parameter-poisoning technique allows attackers to inject malicious code into critical system structures during process initialization, bypassing traditional EDR defenses.
A Department of Homeland Security Inspector General report reveals that 86% of federal agencies missed a key deadline for implementing CISA's Secure Cloud Business Applications (SCuBA) directives, leaving systems vulnerable.
Key findings • 25 CVEs disclosed simultaneously for Drupal on September 23, 2026. • All advisories are listed on the official Drupal security page. • The batch covers a wide range of pote…
Key findings • Seven vulnerabilities disclosed simultaneously in Joomla's Easy Store extension (v1.0.0-3.0.0). • Includes two high-severity SQL injection flaws in coupon and media deletion fu…
A new phishing technique, dubbed device code phishing, exploits the legitimate OAuth 2.0 Device Authorization Grant to steal user accounts without requiring credentials or passwords.
The Pentagon's top civilian cyber official, Katie Sutton, stated that the demand for cyber capabilities significantly exceeds the available supply, highlighting cyber operations as a critical tool of modern warfare.
CISA and the FBI have issued guidance highlighting significant cybersecurity risks for critical infrastructure operators when engaging third-party industrial control system (ICS) integrators.
A campaign dubbed 'Macfinger ClickFix' is actively compromising legitimate websites to redirect macOS users to fake bot protection pages, employing social engineering to trick them into verification and exfiltrate data.
A chain of two vulnerabilities in MikroTik RouterOS, dubbed MikroTrick, allows unauthenticated attackers to gain full administrative control of internet-exposed routers.
Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender, a new foundation designed to unify SIEM and threat protection for human analysts and AI agents.
A vulnerability in GitLab's email work item feature allows attackers to push code into private repositories by exploiting exposed project email addresses.
Attackers are increasingly using multi-stage redirects and dynamic content to obscure phishing attacks, creating a visibility gap that traditional URL analysis struggles to bridge.
OpenAI is collaborating with Ukraine on the 'Daybreak' program, providing AI tools and subsidized computing power to defend the nation's vital power and water systems against cyber threats.
Outerlimit has raised $16 million to build a decentralized zero trust security layer for autonomous AI agents, aiming to mitigate risks associated with their tool manipulation and workflow execution.