Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Industry vertical

Technology, Cloud & SaaS, page 4

Software companies, cloud platforms, data centres and managed services.

236 articlesUpdated 28 Sep 2026Page 4 of 10

ThreatsCloud & SaaSHigh
Azure Connected Machine Agent Flaw CVE-2026-47632 Enables Local Privilege Escalation Across Hybrid Server Workloads
Microsoft patches high-severity flaw CVE-2026-47632 in Azure Connected Machine Agent allowing local privilege escalation on Azure Arc hybrid endpoints.
Mei-Lin Chen21 Sep 202613 min read
ThreatsCloud & SaaSHigh
CrewAI CodeInterpreter Sandbox Escape Vulnerability CVE-2026-2275 Enables Remote Command Injection in Multi-Agent Pipelines
CrewAI maintainers resolve vulnerability CVE-2026-2275 in CodeInterpreter tool allowing arbitrary host command execution via malicious Python payloads.
CST Newsroom21 Sep 202612 min read
ThreatsCloud & SaaSCritical
Google Cloud Application Integration QueryEngineTask Flaw Permits Cross-Project Authorization Bypass
Google Cloud resolves critical flaw CVE-2026-12710 in Application Integration QueryEngineTask allowing cross-tenant authorization bypass and IAM escalation.
Mei-Lin Chen20 Sep 202613 min read
ThreatsCloud & SaaSHigh
Open WebUI Code Execution Guardrail Bypass Enables Remote Command Injection in Enterprise LLM Workspaces
Open WebUI security release patches high-severity vulnerability CVE-2026-45672 allowing sandbox escapes and arbitrary host execution via crafted pipeline code.
CST Newsroom20 Sep 202612 min read
ThreatsCloud & SaaSCritical
Critical HPE EdgeConnect SD-WAN Orchestrator Authentication Bypass Exposes Enterprise Network Fabrics
HPE Aruba Networking resolves maximum-severity CVSS 9.8 flaw CVE-2026-63455 in EdgeConnect SD-WAN Orchestrator allowing unauthenticated network takeover.
Mei-Lin Chen20 Sep 202614 min read
ThreatsCloud & SaaSHigh
Amazon DynamoDB Model Context Protocol Server Code Injection Flaw Enables Arbitrary Host Execution
AWS releases security bulletin 2026-097-AWS for CVE-2026-85654 in DynamoDB MCP server, where template injection enables arbitrary host command execution.
CST Newsroom20 Sep 202614 min read
ThreatsCloud & SaaSCritical
Microsoft Azure Active Directory B2C Authentication Bypass Flaw Enables Remote Privilege Escalation
Microsoft fixes critical CVSS 9.1 flaw CVE-2026-33843 in Azure AD B2C and Microsoft Entra ID allowing unauthenticated network attackers to elevate privileges.
Mei-Lin Chen20 Sep 202614 min read
ThreatsCloud & SaaSCritical
Critical vLLM Multimodal Video Parser Buffer Overflow Flaw Enables Remote Root Code Execution
vLLM maintainers and NIST disclose critical CVSS 9.8 flaw CVE-2026-22778 in multimodal video processing allowing unauthenticated remote root takeover of GPU clusters.
Daniel Okafor20 Sep 202614 min read
ThreatsCloud & SaaSCritical
Linux Kernel Fragnesia Flaw Weaponized for GKE Container Escapes via Socket Buffer Page-Cache Overwrite
Google Cloud and Linux maintainers patch CVE-2026-46300 (Fragnesia), a critical ESP-in-TCP kernel bug enabling container breakout to GKE node root.
Daniel Okafor20 Sep 202615 min read
ThreatsCloud & SaaSCritical
LiteLLM Pre-Authentication SQL Injection Flaw Exposes Enterprise Master Keys and AI Model Routing Gateways
LiteLLM releases urgent patch for CVE-2026-42208, a pre-auth SQL injection flaw allowing unauthenticated remote attackers to dump LLM proxy master credentials.
CST Newsroom20 Sep 202614 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Buffer Overflow Flaw Enables Unauthenticated Remote Root Code Execution
Check Point and CERT-In issue emergency alerts for critical CVSS 9.8 flaw CVE-2026-91843 in Security Management and Log Servers allowing remote unauthenticated root compromise.
Mei-Lin Chen20 Sep 202614 min read
ThreatsCloud & SaaSHigh
Amazon SSM Agent Path Traversal Flaw Enables Root Host Takeover via Malicious S3 Object Keys
AWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Daniel Okafor20 Sep 202612 min read
InsightsCloud & SaaS
Malicious MCP Servers Exploit OAuth Metadata Flaw in Rust SDK to Hijack Enterprise Agent Tokens
Critical OAuth metadata flaw CVE-2026-63127 in rmcp Rust SDK allows rogue Model Context Protocol servers to capture enterprise agent tokens and impersonate identities.
Priya Raman20 Sep 202613 min read
ThreatsCloud & SaaSHigh
Flowise SSRF Vulnerability Bypasses Network Guardrails to Steal Cloud Instance Credentials
Vulnerability CVE-2026-67620 in Flowise AI workflow builder allows attackers to bypass SSRF deny-lists and extract cloud instance metadata credentials from OCI and Alibaba Cloud.
Daniel Okafor20 Sep 202611 min read
ThreatsCloud & SaaSHigh
OpenSearch Dashboards Route Handler Flaw Triggers Denial of Service Across Cloud Clusters
AWS and OpenSearch release security advisories for high-severity vulnerability CVE-2026-75897 in OpenSearch Dashboards enabling unauthenticated remote denial of service.
Priya Raman19 Sep 202610 min read
ThreatsCloud & SaaSHigh
Amazon Bedrock AgentCore Flaw Allows Attackers to Bypass LLM Guardrails via Injected Tool-Use Payloads
AWS resolves high-severity vulnerability CVE-2026-18830 in Amazon Bedrock AgentCore allowing attackers to bypass LLM safety guardrails and trigger arbitrary tool calls.
Daniel Okafor19 Sep 202611 min read
ThreatsCloud & SaaSHigh
Azure Kubernetes Service Container Path Traversal Flaw Enables Node Escape and Code Execution
Microsoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
Priya Raman19 Sep 202611 min read
ThreatsCloud & SaaSCritical
Microsoft Entra ID Critical Deserialization Vulnerability Enables Unauthenticated Remote Code Execution
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
Daniel Okafor19 Sep 202612 min read
ThreatsCloud & SaaSCritical
Critical Cisco Secure Firewall Flaw Weaponized to Compromise Enterprise Perimeter Gateways
Cisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
Priya Raman19 Sep 202613 min read
ThreatsCloud & SaaSHigh
AWS Discloses Security Policy Bypass in API Model Context Protocol Server Enabling Unauthorized Agent Tool Execution
AWS Labs resolves high-severity vulnerability CVE-2026-16584 in AWS API MCP Server allowing autonomous AI agent workflows to bypass security policies upon initialization failure.
Daniel Okafor19 Sep 202611 min read
ThreatsCloud & SaaSHigh
AWS Discloses Command Injection Flaw in projen Tooling Enabling CI/CD Runner Takeover
AWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
Daniel Okafor19 Sep 202610 min read
ThreatsCloud & SaaSCritical
Siemens Mendix SAML Single Sign-On Flaw Exposes Enterprise Cloud Portals to Account Takeover
Siemens and CISA issue advisory ICSA-26-258-06 for Mendix SAML module vulnerability CVE-2026-80465 allowing unauthenticated remote attackers to hijack enterprise SSO accounts.
Priya Raman19 Sep 20269 min read
ThreatsCloud & SaaSHigh
AWS Patches Hostname Validation Bypass in IoT Device SDK Exposing Core Endpoints to AiTM Attacks
AWS resolves high-severity vulnerability CVE-2026-92943 in AWS IoT Device SDK for Python allowing adversary-in-the-middle telemetry interception and message spoofing.
Daniel Okafor19 Sep 202610 min read
ThreatsCloud & SaaSHigh
Linux Kernel In-Kernel TLS Receive Path Flaw Weaponized in Active Multi-Tenant Cloud Attacks
Threat actors weaponize improper condition check flaw CVE-2025-39682 in Linux kernel kTLS receive path, triggering out-of-bounds corruption in multi-tenant workloads.
CST Newsroom19 Sep 202611 min read

Threat scope

DevOps pipelines, cloud IAM, package registries, Kubernetes clusters and zero-day vulnerabilities.

Free newsletter

The Daily Brief

The exploited vulnerabilities, patch priorities and regulatory changes worth acting on, in one short email.

Exploited CVEs, with affected products and patch status
Patch priorities ranked by real-world exploitation
Regulatory changes: CERT-In, RBI, DPDP, DORA, NIS2

FreeOne email per weekdayUnsubscribe anytime

See a sample issue Privacy policy