Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Industry vertical

Technology, Cloud & SaaS, page 2

Software companies, cloud platforms, data centres and managed services.

236 articlesUpdated 28 Sep 2026Page 2 of 10

ThreatsCloud & SaaSHigh
Critical AWS HealthLake MCP Server Flaw Exposes Cloud IAM Credentials and Healthcare Telemetry to SSRF CVE-2026-15643
AWS discloses high-severity SSRF flaw CVE-2026-15643 in the HealthLake MCP server, enabling attackers to leak temporary SigV4 IAM credentials and healthcare FHIR records.
Priya Raman26 Sep 202617 min read
ThreatsCloud & SaaSCritical
Critical Dify Cross-Tenant Path Traversal Flaw Enables Unauthorized Access to Internal Plugin APIs CVE-2026-41948
A critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.
Priya Raman25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Critical Fortinet FortiPAM Authentication Bypass Flaw Enables Remote Session Hijacking and Traffic Proxying CVE-2026-84388
Fortinet releases emergency fixes for critical CVSS 9.6 flaw CVE-2026-84388 in FortiPAM and its Chrome Extension, allowing remote attackers to hijack administrative sessions.
Daniel Okafor25 Sep 202618 min read
ThreatsCloud & SaaSHigh
Critical Open WebUI TOCTOU DNS Rebinding SSRF Flaw Exposes Cloud Metadata and Internal VPC Services CVE-2026-87996
A critical TOCTOU race condition flaw CVE-2026-87996 in Open WebUI enables attackers to execute DNS rebinding SSRF attacks and harvest cloud metadata and credentials.
Priya Raman25 Sep 202617 min read
NewsCloud & SaaS
Halliburton SEC Form 8-K Item 1.05 Filing Details Critical System Disconnections and Material Blast Radius Across Global Energy Operations
Halliburton files SEC Form 8-K Item 1.05 detailing unauthorized corporate network access that forced critical energy infrastructure systems offline across global operations.
Daniel Okafor25 Sep 202619 min read
ThreatsCloud & SaaSCritical
Critical Microsoft Azure Arc Elevation of Privilege Flaw Allows Unauthenticated Confused Deputy Exploitation Across Hybrid Clusters CVE-2026-69399
Microsoft discloses critical CVSS 10.0 flaw CVE-2026-69399 in Azure Arc, enabling unauthenticated attackers to exploit confused deputy proxies across hybrid cloud nodes.
Daniel Okafor25 Sep 202618 min read
ThreatsCloud & SaaSHigh
Critical Ollama GGUF Model Parser Integer Overflow Flaw Exposes Local AI Inference Servers to Memory Corruption CVE-2026-86289
A critical integer overflow flaw CVE-2026-86289 in the Ollama GGUF model decoder allows attackers to trigger memory corruption and remote code execution on AI inference clusters.
Priya Raman25 Sep 202616 min read
ThreatsCloud & SaaSCritical
Critical Adobe Commerce and Magento Authorization Breakdown Flaw Exploited to Hijack E-Commerce Checkout Workflows CVE-2026-71362
Adobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
Daniel Okafor25 Sep 202617 min read
InsightsBanking & Fintech
Data Protection Board of India Unveils Digital Inquiry Framework and Mandatory Algorithmic Audits for Significant Data Fiduciaries
The Data Protection Board of India establishes binding procedural codes for DPDP inquiries, mandating independent algorithmic audits and strict breach notification timelines.
Tom Verhoeven25 Sep 202618 min read
ThreatsCloud & SaaSCritical
Critical WSO2 API Manager Path Traversal Flaw Weaponized to Extract Enterprise Gateway Credentials CVE-2026-5430
WSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
Daniel Okafor25 Sep 202617 min read
ThreatsCloud & SaaSHigh
Amazon ECS Container Agent Flaw Enables Task Boundary Breakout and IAM Role Credential Hijacking
AWS resolves a container boundary escape flaw in Amazon ECS Container Agent that allowed unprivileged containers to intercept task metadata and assume host IAM roles.
Aisha Noor25 Sep 202617 min read
ThreatsCloud & SaaSCritical
HPE Aruba EdgeConnect SD-WAN Orchestrator Authentication Bypass Flaw Enables Remote Network Gateway Hijack
HPE resolves critical flaw CVE-2026-38291 in Aruba EdgeConnect SD-WAN Orchestrator, allowing unauthenticated remote attackers to bypass auth and execute arbitrary code.
Aisha Noor25 Sep 202617 min read
InsightsCloud & SaaS
Model Context Protocol OAuth Passthrough Flaw Exposes Autonomous AI Tool Pipelines to Silent Impersonation
An architectural vulnerability in Model Context Protocol (MCP) OAuth token passthrough allows malicious tool servers to impersonate users and hijack enterprise APIs.
Priya Raman25 Sep 202618 min read
ThreatsCloud & SaaSHigh
Google Kubernetes Engine Container Escape Vulnerability Enables Node Compromise Across Multi-Tenant Clusters
Google Cloud discloses and mitigates a high-severity container escape flaw in GKE node kernels, preventing unprivileged workloads from compromising host nodes.
Aisha Noor24 Sep 202617 min read
ThreatsCloud & SaaSHigh
Google Cloud OS Login Privilege Escalation Flaw Exposes Compute Engine Instances to Root Takeover CVE-2020-8907
Google Cloud resolves a privilege escalation flaw in Compute Engine guest-oslogin that allowed users with compute.osLogin IAM permissions to gain root access.
Aisha Noor24 Sep 202617 min read
ThreatsCloud & SaaSCritical
Critical Azure AI Language Authentication Breakdown Enables Unauthenticated Model Tampering CVE-2026-70352
Microsoft mitigates maximum-severity CVSS 10.0 flaw CVE-2026-70352 in Azure AI Language Authoring, preventing unauthenticated remote tampering with enterprise AI models.
CST Newsroom24 Sep 202617 min read
ThreatsCloud & SaaSHigh
Amazon Ion-C Library Recursion Flaw Triggers Cloud Service Stack Exhaustion Crashes CVE-2026-84851
AWS publishes Bulletin 2026-094-AWS for high-severity flaw CVE-2026-84851 in Amazon Ion-C library, allowing attackers to exhaust stack memory and crash services.
CST Newsroom24 Sep 202615 min read
ThreatsCloud & SaaSHigh
Amazon OpenSearch SQL Plugin Cursor Deserialization Flaw Enables Remote Code Execution CVE-2026-83497
AWS and OpenSearch release bulletin 2026-092-AWS for high-severity flaw CVE-2026-83497 in the SQL plugin allowing authenticated users to execute code via cursors.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSHigh
Azure AI Foundry Server-Side Request Forgery Flaw Exposes Internal Agent Infrastructure CVE-2026-85917
Microsoft discloses high-severity flaw CVE-2026-85917 in Azure AI Foundry allowing unauthenticated attackers to execute SSRF and elevate privileges over the network.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical Azure Cosmos DB Downstream Injection Flaw Enabled Cloud Privilege Escalation CVE-2026-87701
Microsoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical Check Point Security Management Server Path Traversal Flaw Exploited to Gain Root System Access CVE-2026-93616
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Newsroom23 Sep 202616 min read
ResearchCloud & SaaS
vLLM Multimodal Special Token Injection Triggers Remote Engine Crash and Service Denial CVE-2026-44222
High-severity flaw CVE-2026-44222 in vLLM allows remote unauthenticated users to crash distributed GPU inference clusters via crafted multimodal tokens.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical Arista VeloCloud Orchestrator Zero-Day Exploited to Hijack SD-WAN Edge Gateways CVE-2026-93952
Arista confirms active in-the-wild exploitation of CVSS 10.0 CVE-2026-93952, allowing unauthenticated attackers to hijack on-prem VeloCloud Orchestrators.
CST Newsroom23 Sep 202617 min read
ThreatsCloud & SaaSHigh
Critical OCI Artifact Library Flaw in ORAS-Go Enables Symlink Path Traversal and Supply Chain Compromise CVE-2026-85731
A high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
CST Newsroom23 Sep 202616 min read

Threat scope

DevOps pipelines, cloud IAM, package registries, Kubernetes clusters and zero-day vulnerabilities.

Free newsletter

The Daily Brief

The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.

Exploited CVEs, with affected products and patch status
Patch priorities ranked by real-world exploitation
Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2

FreeOne email per weekdayUnsubscribe anytime

See a sample issue Privacy policy