1,062 articles
Threat IntelAnthropic issues advisory CVE-2026-70114 for the Model Context Protocol (MCP) filesystem server, patching a path traversal flaw that allowed tool-calling escapes.
GoogleGoogle fixes critical flaw CVE-2026-69210 in Cloud IAM Workload Identity Federation where improper validation of OIDC audience claims allowed cross-tenant service account hijacking.
AWS CloudAWS patches CVE-2026-68115 in Amazon Bedrock Agent Runtime where unvalidated context memory serialization allowed cross-agent jailbreaks and tool invocation hijacking.
MicrosoftA high-severity memory corruption flaw in Azure Kubernetes Service's Cilium eBPF dataplane allows unprivileged pods to compromise Linux worker nodes.
OT / SCADAA critical buffer overflow in Schneider Electric Modicon M580 and M340 Ethernet communication modules enables unauthenticated remote code execution.
PostgreSQLA critical SQL injection flaw in LiteLLM Proxy's vector metadata filtering allows unauthenticated API consumers to execute arbitrary PostgreSQL queries.
OT / SCADAA critical memory corruption flaw in Phoenix Contact FL SWITCH 3000 and 4000 managed industrial Ethernet switches enables remote arbitrary code execution.
GoogleA security flaw in Google Cloud Run's internal metadata proxy allows server-side request forgery to steal workload identity IAM tokens.
OT / SCADAA high-severity denial-of-service vulnerability in Honeywell Experion PKS C300 controllers enables unauthenticated network packets to freeze industrial plant processes.
Threat IntelA high-severity vulnerability in Ollama allows unauthenticated network actors to trigger remote code execution when pulling tampered GGUF model manifests.
OT / SCADAA critical buffer overflow in the integrated HTTPS web server of Siemens SIMATIC S7-1500 and S7-1200 CPU firmware enables remote disruption of industrial automation controllers.
AWS CloudA security vulnerability in AWS IAM Identity Center's SCIM protocol implementation could allow token bypass during automated user and group provisioning.
OT / SCADAA critical unauthenticated RPC vulnerability in Emerson DeltaV distributed control system workstations allows attackers to execute code with SYSTEM privileges.
Threat IntelA high-severity deserialization vulnerability in vLLM's distributed PagedAttention KV-cache transfer protocol allows attackers to compromise GPU worker nodes.
OT / SCADAA critical memory corruption vulnerability in Yokogawa CENTUM VP Field Control Station (FCS) controllers allows unauthenticated network packets to manipulate industrial control setpoints.
Data BreachCloudflare Security releases an advisory addressing a vulnerability in Workers KV edge namespace routing allowing potential cross-tenant cache token retrieval.
OT / SCADARockwell Automation and CISA disclose a critical vulnerability in FactoryTalk View SE human-machine interface software allowing unauthenticated operators to bypass security.
Threat IntelHugging Face security bulletins document a memory corruption vulnerability in transformers parameter offloading modules enabling arbitrary host execution.
OT / SCADAMitsubishi Electric and CISA warn of a high-severity flaw in MELSEC iQ-R controllers allowing remote network adversaries to alter device memory registers without authentication.
MicrosoftMicrosoft MSRC publishes a security bulletin detailing an identity impersonation flaw in Azure Container Apps Dapr sidecars allowing cross-service token spoofing.
OT / SCADAABB Cybersecurity and CISA disclose a critical vulnerability in Symphony Plus S+ Operations SCADA software allowing unauthenticated remote code execution on power plant servers.
Agentic AIPyTorch Foundation and OpenAI issue security advisories for speech inference pipelines addressing a critical deserialization flaw enabling arbitrary command execution.
OT / SCADAGE Vernova and CISA issue industrial security advisories for Mark VIe and Mark VIeS safety systems addressing a flaw causing turbine controller communication lockup.
GoogleGoogle Cloud Security discloses a vulnerability in Cloud Armor WAF Adaptive Protection allowing attackers to bypass rate limiting via multiplexed HTTP/2 frames.