Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,785 stories synthesized.
Key findings • Eight high-severity vulnerabilities disclosed for Docling Project on June 3, 2026. • Vulnerabilities include SSRF, Path Traversal, XXE, and unsafe archive extraction. • Imp…
Rice University researchers have developed a new jamming method that uses self-curving radio beams to fool direction-of-arrival (DoA) anti-jamming defenses, making jammers harder to locate and block.
The U.S. Treasury has sanctioned Nobitex, Iran's largest cryptocurrency exchange, for its role in facilitating ransomware payments and evading sanctions.
Nation-state threat actors, primarily from China, are escalating cyber espionage campaigns across Latin America, targeting maritime and oil production intelligence amid heightened geopolitical tensions.
Key findings • Google disclosed 25 Android SDK vulnerabilities on June 1, 2026, including multiple privilege escalation flaws. • A separate batch of 25 Linux kernel vulnerabilities was disclo…
Key findings • 25 Linux kernel vulnerabilities disclosed simultaneously on June 3, 2026. • Issues affect diverse subsystems including drivers, networking, and core kernel functions. • Vul…
Key findings • Fifteen vulnerabilities disclosed for Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909. • Hardcoded credentials, including WiFi PSK and RADIUS secret, found in firmwa…
Key findings • Cisco Webex Meetings, Unified Communications Manager, and Finesse affected by new vulnerabilities. • High-severity SSRF flaw (CVE-2026-20230) impacts Cisco Unified Communicatio…
A new wave of fake invoice scams impersonating brands like PayPal and Amazon was discovered by researchers while still under development, highlighting a psychological attack vector.
The HazyBeacon campaign is weaponizing Amazon Web Services (AWS) Lambda functions to establish covert command and control channels targeting government networks in Southeast Asia.
Cloudflare details how attackers are exploiting Border Gateway Protocol (BGP) by forging Autonomous System (AS) paths to misdirect internet traffic and conceal their origins.
A critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin, affecting versions up to 1.9.12, is being actively exploited by attackers.
CISA has added CVE-2026-45247, a critical remote code execution flaw in the Mirasvit Cache Warmer Magento extension, to its Known Exploited Vulnerabilities catalog.
A new malspam campaign is leveraging Google's DoubleClick domain to evade security detections and deliver the DesckVB RAT, personalizing lures on the fly.
The increasing use of AI in code generation introduces novel security risks, necessitating updated development and security practices to manage a broadened attack surface.
A new JavaScript malware, JS.MonoGlyphRAT, is actively targeting US enterprises by masquerading as legitimate purchase orders in phishing emails, employing sophisticated obfuscation techniques that bypass traditional signature-based antivirus defenses.
A security researcher has publicly released a proof-of-concept exploit for a Visual Studio Code vulnerability, citing dissatisfaction with Microsoft's handling of vulnerability disclosures.
Microsoft has enhanced its AI security offerings with the integration of its multi-agent vulnerability discovery system, MDASH, into Microsoft Defender, aiming to proactively identify flaws in AI models and agents.
Key findings • Two High-severity vulnerabilities (CVE-2022-49042, CVE-2022-49036) allow local code execution. • Three Medium-severity vulnerabilities include Path Traversal and cleartext cred…
Five zero-day vulnerabilities in OpenClaw enabled attackers to bypass trust boundaries and hijack AI agent access across platforms like Slack, Discord, and Microsoft Teams.
A standard annual penetration test leaves financial institutions' systems unvalidated for approximately 345 days, creating a critical window of exposure that attackers can exploit, according to security experts.
An autonomous AI security tool has discovered a critical use-after-free vulnerability in Redis, allowing authenticated users to execute arbitrary OS commands, which has now been patched.
Threat actors are continuously scanning the internet for 'swagger.json' files, which expose API structures and can reveal vulnerable applications.
Check Point Research has uncovered a sophisticated operation impersonating popular open-source and security tools, using a Traffic Distribution System (TDS) to filter users and deliver malware.