Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,191 stories synthesized.
A critical cross-site scripting vulnerability (CVE-2026-85061) in MapLibre GL JS versions prior to 6.4.1 could allow attackers to execute arbitrary JavaScript in users' browsers without interaction, potentially affecting 2.7 million users.
Microsoft is rolling out new age verification and parental control features within Windows Family Safety, leveraging Microsoft accounts to provide age-appropriate protections across apps, services, and AI experiences.
Akeyless introduces Agentic Runtime Authority, a new identity control layer designed to enforce real-time, intent-based access controls for AI agents operating in production environments.
Two critical vulnerabilities in ArangoDB versions prior to 3.12.11 allow attackers to bypass authentication and achieve remote code execution as root.
Google's September 2026 Android Security Bulletin addresses critical vulnerabilities, including multiple RCE flaws affecting Android versions up to Android 17.
A critical vulnerability in Microsoft Teams for Android, CVE-2026-65812, allows attackers to disclose sensitive user credentials with low complexity and user interaction.
New Android malware campaigns leverage Gigabud RAT and Vwork app cloner to hide fraudulent banking activities by cloning apps into concealed work profiles.
The FBI is sounding the alarm that artificial intelligence is significantly accelerating adversary capabilities, making attacks faster and more sophisticated, while stressing that fundamental cybersecurity practices remain the most critical defense.
Cloudflare has significantly updated its Workers runtime module registry to improve compatibility with Node.js applications, enabling larger and more complex deployments.
Tenable and OpenAI have introduced the CyberAgents Exchange AI Inspector, a new tool designed to rigorously vet open-source AI agents before they are listed on the CyberAgents Exchange registry.
Compromised non-human identities, including AI agents and service accounts, have surpassed phishing as the primary entry vector for cyberattacks targeting organizations.
Attackers are utilizing autonomous AI agents to execute credential theft campaigns with unprecedented speed, completing the entire process from planning to execution in under six hours.
US government agencies have issued a warning that China is systematically extracting advanced AI capabilities through a technique known as distillation, posing a significant threat to national security and technological leadership.
Key findings • Three GitPython vulnerabilities disclosed on September 9, 2026, including two High severity flaws. • CVE-2026-87817 allows arbitrary code execution by impersonating the git dir…
Key findings • Ten vulnerabilities disclosed for Siyuan Note, affecting versions before v3.8.2. • Critical code execution vulnerability (CVE-2026-86712) via crafted clipboard data. • Mult…
A new webinar aims to help security teams rapidly determine their exposure to newly disclosed vulnerabilities, especially in an era of AI-driven threat discovery.
A critical bug in the Lean theorem prover allowed researchers to generate a false proof of Fermat's Last Theorem by exploiting a semantic mismatch between logical evaluation and compiled code.
Schneider Electric, Siemens, Aveva, and Rockwell Automation have released patches for critical and high-severity vulnerabilities affecting their industrial control system products.
A critical vulnerability in Alby Hub versions v1.7.0 through v1.7.2 allows attackers to take over internet-exposed Bitcoin wallets and transfer funds.
Microsoft has released security updates for CVE-2026-69485, an Important-rated RCE vulnerability in the Windows Remote Desktop Client, allowing attackers to execute code on affected servers.
A large-scale cybercrime operation, tracked as CL-CRI-1171, is leveraging YouTube gaming lures and SEO poisoning to distribute multi-payload malware through a pay-per-install marketplace, targeting both gamers and enterprise networks.
A novel phishing technique leverages trusted Microsoft services to host malicious pages directly within the victim's browser using blob URLs, bypassing traditional detection methods.
A new open standard, ORKS, aims to revolutionize API key security by enabling keys to self-destruct upon compromise, drastically reducing the window for attackers.
Australia is introducing new legislation that would allow users over 16 to opt out of algorithmic social media feeds and mandates protections for minors against harmful content.