Section

Threats, page 5

Vulnerability intelligence, exploited CVEs, malware families and live campaigns — with the detection guidance and mitigations defenders need first.

231 articlesUpdated 28 Sep 2026Page 5 of 10

ThreatsCloud & SaaSHigh
Amazon DynamoDB Model Context Protocol Server Code Injection Flaw Enables Arbitrary Host Execution
AWS releases security bulletin 2026-097-AWS for CVE-2026-85654 in DynamoDB MCP server, where template injection enables arbitrary host command execution.
CST Newsroom20 Sep 202614 min read
ThreatsIndustrial & OTHigh
Siemens SICAM 8 Remote Parameterization Resource Exhaustion Flaw Disables Substation Automation Controllers
Siemens releases advisory SSA-246443 for high-severity flaw CVE-2026-27663 in SICAM 8 controllers, where resource exhaustion halts substation automation.
CST Newsroom20 Sep 202613 min read
ThreatsCloud & SaaSCritical
Microsoft Azure Active Directory B2C Authentication Bypass Flaw Enables Remote Privilege Escalation
Microsoft fixes critical CVSS 9.1 flaw CVE-2026-33843 in Azure AD B2C and Microsoft Entra ID allowing unauthenticated network attackers to elevate privileges.
Mei-Lin Chen20 Sep 202614 min read
ThreatsIndustrial & OTCritical
Critical Schneider Electric Modicon M580 Controllers Authentication Flaw Risks Industrial Process Takeover
Schneider Electric issues advisory SEVD-2026-251-04 for critical CVSS 9.2 flaw CVE-2026-3869 in Modicon M580 controllers enabling unauthenticated process takeover.
CST Newsroom20 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical vLLM Multimodal Video Parser Buffer Overflow Flaw Enables Remote Root Code Execution
vLLM maintainers and NIST disclose critical CVSS 9.8 flaw CVE-2026-22778 in multimodal video processing allowing unauthenticated remote root takeover of GPU clusters.
Daniel Okafor20 Sep 202614 min read
ThreatsIndustrial & OTHigh
Rockwell Automation FactoryTalk Activation Manager Flaw Enables Local SYSTEM Privilege Escalation
Rockwell Automation issues advisory SD1799 for CVE-2026-16675 in FactoryTalk Activation Manager, allowing authenticated operators to seize SYSTEM privileges.
CST Newsroom20 Sep 202613 min read
ThreatsCloud & SaaSCritical
Linux Kernel Fragnesia Flaw Weaponized for GKE Container Escapes via Socket Buffer Page-Cache Overwrite
Google Cloud and Linux maintainers patch CVE-2026-46300 (Fragnesia), a critical ESP-in-TCP kernel bug enabling container breakout to GKE node root.
Daniel Okafor20 Sep 202615 min read
ThreatsCloud & SaaSCritical
LiteLLM Pre-Authentication SQL Injection Flaw Exposes Enterprise Master Keys and AI Model Routing Gateways
LiteLLM releases urgent patch for CVE-2026-42208, a pre-auth SQL injection flaw allowing unauthenticated remote attackers to dump LLM proxy master credentials.
CST Newsroom20 Sep 202614 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Buffer Overflow Flaw Enables Unauthenticated Remote Root Code Execution
Check Point and CERT-In issue emergency alerts for critical CVSS 9.8 flaw CVE-2026-91843 in Security Management and Log Servers allowing remote unauthenticated root compromise.
Mei-Lin Chen20 Sep 202614 min read
ThreatsCloud & SaaSHigh
Amazon SSM Agent Path Traversal Flaw Enables Root Host Takeover via Malicious S3 Object Keys
AWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Daniel Okafor20 Sep 202612 min read
ThreatsIndustrial & OTCritical
Critical Flaws in Digital Watchdog VMAX Recorders Enable Unauthenticated Remote Root Takeover
CISA releases advisory ICSA-26-258-01 warning of critical vulnerabilities in Digital Watchdog VMAX DVR and NVR recorders allowing unauthenticated remote root code execution.
Mei-Lin Chen20 Sep 202612 min read
ThreatsCloud & SaaSHigh
Flowise SSRF Vulnerability Bypasses Network Guardrails to Steal Cloud Instance Credentials
Vulnerability CVE-2026-67620 in Flowise AI workflow builder allows attackers to bypass SSRF deny-lists and extract cloud instance metadata credentials from OCI and Alibaba Cloud.
Daniel Okafor20 Sep 202611 min read
ThreatsCloud & SaaSHigh
OpenSearch Dashboards Route Handler Flaw Triggers Denial of Service Across Cloud Clusters
AWS and OpenSearch release security advisories for high-severity vulnerability CVE-2026-75897 in OpenSearch Dashboards enabling unauthenticated remote denial of service.
Priya Raman19 Sep 202610 min read
ThreatsIndustrial & OTCritical
Threat Actors Weaponize AI Tooling and S7comm to Target Siemens S7 Industrial Controllers
CISA, NSA, and the FBI issue joint advisory AA26-231A warning of active campaigns targeting Siemens S7 series PLCs using automated S7comm protocol exploitation.
Mei-Lin Chen19 Sep 202613 min read
ThreatsCloud & SaaSHigh
Amazon Bedrock AgentCore Flaw Allows Attackers to Bypass LLM Guardrails via Injected Tool-Use Payloads
AWS resolves high-severity vulnerability CVE-2026-18830 in Amazon Bedrock AgentCore allowing attackers to bypass LLM safety guardrails and trigger arbitrary tool calls.
Daniel Okafor19 Sep 202611 min read
ThreatsCloud & SaaSHigh
Azure Kubernetes Service Container Path Traversal Flaw Enables Node Escape and Code Execution
Microsoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
Priya Raman19 Sep 202611 min read
ThreatsIndustrial & OTCritical
Johnson Controls C-CURE 9000 Vulnerabilities Allow Attackers to Hijack Physical Facility Access Gateways
Johnson Controls and CISA release emergency advisory ICSA-26-204-01 for C-CURE 9000 and victor application servers resolving critical code execution flaw CVE-2026-21655.
Mei-Lin Chen19 Sep 202613 min read
ThreatsCloud & SaaSCritical
Microsoft Entra ID Critical Deserialization Vulnerability Enables Unauthenticated Remote Code Execution
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
Daniel Okafor19 Sep 202612 min read
ThreatsCloud & SaaSCritical
Critical Cisco Secure Firewall Flaw Weaponized to Compromise Enterprise Perimeter Gateways
Cisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
Priya Raman19 Sep 202613 min read
ThreatsIndustrial & OTCritical
Mitsubishi Electric GX Works3 Authentication Bypass Exposes Industrial PLCs to Memory Manipulation Attacks
Mitsubishi Electric and CISA issue critical advisory ICSA-26-260-02 for GX Works3 and Motion Control Settings software enabling in-memory block password bypass and PLC logic tampering.
Mei-Lin Chen19 Sep 202612 min read
ThreatsCloud & SaaSHigh
AWS Discloses Security Policy Bypass in API Model Context Protocol Server Enabling Unauthorized Agent Tool Execution
AWS Labs resolves high-severity vulnerability CVE-2026-16584 in AWS API MCP Server allowing autonomous AI agent workflows to bypass security policies upon initialization failure.
Daniel Okafor19 Sep 202611 min read
ThreatsCloud & SaaSHigh
AWS Discloses Command Injection Flaw in projen Tooling Enabling CI/CD Runner Takeover
AWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
Daniel Okafor19 Sep 202610 min read
ThreatsCloud & SaaSCritical
Siemens Mendix SAML Single Sign-On Flaw Exposes Enterprise Cloud Portals to Account Takeover
Siemens and CISA issue advisory ICSA-26-258-06 for Mendix SAML module vulnerability CVE-2026-80465 allowing unauthenticated remote attackers to hijack enterprise SSO accounts.
Priya Raman19 Sep 20269 min read
ThreatsIndustrial & OTCritical
Schneider Electric NetBotz Command Injection Flaw Allows Root System Compromise via Malicious Backups
Schneider Electric and CISA warn of critical OS command injection flaw CVE-2026-13336 in NetBotz 5 environmental monitors enabling root host takeover via system backup restore.
CST Newsroom19 Sep 202610 min read