1,062 articles
MicrosoftA critical vulnerability in Microsoft Entra ID allows authenticated users to manipulate assumed-immutable directory attributes and achieve Global Admin rights.
Threat IntelCISA ICS Advisory ICSA-26-225-14 warns of a high-severity stored XSS defect in Johnson Controls Metasys building automation systems risking administrative takeover.
Threat IntelCritical authentication bypass and path traversal vulnerabilities in the Atlassian Model Context Protocol server allow unauthenticated attackers to read and exfiltrate host files.
AWS CloudAn out-of-bounds write defect in the AWS SDK for C++ Base64 decoder allows crafted inputs to corrupt heap memory and terminate cloud client processes.
OT / SCADACISA ICS Advisory ICSA-26-225-01 warns of an unsafe deserialization flaw in AVEVA Enterprise SCADA systems allowing remote code execution on critical control nodes.
Threat IntelA critical vulnerability in Langflow AI orchestration frameworks allows unauthenticated attackers to execute arbitrary code via insecure component endpoints.
LinuxAn integer overflow flaw in vLLM PagedAttention CUDA kernels allows concurrent inference requests to read sensitive prompt tokens across multi-tenant GPU memory.
AWS CloudA critical server-side request forgery flaw in LiteLLM AI proxies allows remote attackers to bypass egress restrictions and steal cloud instance credentials.
MicrosoftMicrosoft MSRC discloses high-severity 8.8 CVSS RCE flaw CVE-2026-70125 in Microsoft Outlook enabling arbitrary code execution via crafted compound documents.
AWS CloudAWS Security Bulletin 2026-084-AWS warns of authorization flaw CVE-2026-75910 in Athena ClickHouse connector allowing arbitrary Secrets Manager data leakage.
GoogleGoogle Cloud Bulletin GCP-2026-059 details missing authorization flaw CVE-2026-4644 in Integration Connectors enabling project-level privilege escalation.
AWS CloudAWS Security Bulletin 2026-075-AWS discloses critical path traversal flaw CVE-2026-18953 in aws-transform-mcp-server enabling unauthenticated arbitrary file overwrites.
PostgreSQLAWS Security Bulletin 2026-118-AWS warns of a critical type confusion flaw CVE-2026-96883 in open-source pgcollection enabling RCE in PostgreSQL database hosts.
Threat IntelCISA issues advisory ICSA-26-267-02 for critical command injection flaw CVE-2026-93289 in Eufy Omni robotic appliances enabling unauthenticated root code execution.
CMS SecurityWordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Agentic AISecurity researchers disclose CVE-2026-80347 in mcp-fetch, where unbracketed IPv6 parsing allows autonomous AI agents to be manipulated into internal cloud SSRF.
OT / SCADACISA issues advisory ICSA-26-258-04 warning of credential protection flaw CVE-2026-81861 in Schneider Electric SCADAPack RTUs managing critical pipeline infrastructure.
MicrosoftMicrosoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
Threat IntelCISA issues advisory ICSA-26-258-02 for critical hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard, allowing remote attackers to hijack navigation systems.
AWS CloudAWS Security Bulletin 2026-115-AWS warns of a critical authorization flaw in AmazonConnectSalesforceLambda enabling unprivileged IAM users to execute arbitrary AWS APIs.
Threat IntelThreat actors weaponize MikroTik RouterOS flaw CVE-2026-67279 in the "MikroTrick" chain, bypassing SSH authentication to hijack core routing infrastructure.
AWS CloudAWS discloses high-severity SSRF flaw CVE-2026-15643 in the HealthLake MCP server, enabling attackers to leak temporary SigV4 IAM credentials and healthcare FHIR records.
Threat IntelA critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.
FortinetFortinet releases emergency fixes for critical CVSS 9.6 flaw CVE-2026-84388 in FortiPAM and its Chrome Extension, allowing remote attackers to hijack administrative sessions.