1,167 articles
Threat IntelEnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.
Threat IntelThe EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.
Active ExploitThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data…
CMS SecurityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL…
Threat IntelA path traversal vulnerability has been reported to affect Qsirch.
CiscoA vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write…
Threat IntelAn OS command injection vulnerability has been reported to affect HybridDesk Station.
CMS SecurityIncorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM:…
Active ExploitA flaw has been found in Ahsay AhsayCBS up to 10.3.2.
OT / SCADAWeak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions…
Threat IntelIncorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior,…
Threat IntelF5 NGINX resolves a critical use-after-free vulnerability in HTTP/3 QUIC stream processing (CVE-2026-97205) allowing worker process termination and code execution.
Data BreachThe Reserve Bank of India enforces updated CSFB directives mandating 6-hour breach disclosure to CERT-In, third-party cloud audits, and zero-trust banking security.
Threat IntelF5 NGINX patches critical heap buffer overflow CVE-2026-93479 in ngx_http_core_module where regex map variables lead to worker crash and code execution.
Threat IntelIvanti patches critical SQL injection vulnerability CVE-2026-89310 in Endpoint Manager Core Server enabling unauthenticated remote code execution.
RansomwareForensic analysis of SEC Form 8-K Item 1.05 material cybersecurity incident disclosures: 4-day reporting timelines, root causes, and board oversight standards.
CMS SecurityJTL patches a critical arbitrary file upload vulnerability in JTL-Connector for WooCommerce (CVE-2026-87855) allowing unauthenticated web shell execution.
Threat IntelProFTPD resolves a critical access control flaw in mod_copy (CVE-2015-3306) where unauthenticated attackers copy arbitrary server files and execute remote code.
FortinetFortinet releases security updates for FortiOS and FortiProxy (CVE-2026-14851) resolving an information disclosure flaw that exposed administrative bearer tokens.
CMS SecurityWordPress security advisory resolves a high-severity privilege escalation flaw in SimpleForm (CVE-2026-104748) allowing unauthenticated users to register as admin.
Threat IntelONLYOFFICE patches a critical path traversal vulnerability in Document Server DocService (CVE-2021-3199) allowing arbitrary file overwrite and remote code execution.
CMS SecurityTyche Softwares resolves a critical PHP object injection flaw in Abandoned Cart Pro for WooCommerce (CVE-2026-97657) enabling unauthenticated remote code execution.
CMS SecurityTyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
Threat IntelStrapi resolves a high-severity vulnerability (CVE-2023-22894) where password reset tokens and API secrets were stored unhashed in database audit records.