1,167 articles
AWS CloudAWS releases security bulletin 2026-097-AWS for CVE-2026-85654 in DynamoDB MCP server, where template injection enables arbitrary host command execution.
MicrosoftMicrosoft fixes critical CVSS 9.1 flaw CVE-2026-33843 in Azure AD B2C and Microsoft Entra ID allowing unauthenticated network attackers to elevate privileges.
Threat IntelvLLM maintainers and NIST disclose critical CVSS 9.8 flaw CVE-2026-22778 in multimodal video processing allowing unauthenticated remote root takeover of GPU clusters.
GoogleGoogle Cloud and Linux maintainers patch CVE-2026-46300 (Fragnesia), a critical ESP-in-TCP kernel bug enabling container breakout to GKE node root.
Threat IntelLiteLLM releases urgent patch for CVE-2026-42208, a pre-auth SQL injection flaw allowing unauthenticated remote attackers to dump LLM proxy master credentials.
Check PointCheck Point and CERT-In issue emergency alerts for critical CVSS 9.8 flaw CVE-2026-91843 in Security Management and Log Servers allowing remote unauthenticated root compromise.
AWS CloudAWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Deep DiveCritical OAuth metadata flaw CVE-2026-63127 in rmcp Rust SDK allows rogue Model Context Protocol servers to capture enterprise agent tokens and impersonate identities.
Threat IntelVulnerability CVE-2026-67620 in Flowise AI workflow builder allows attackers to bypass SSRF deny-lists and extract cloud instance metadata credentials from OCI and Alibaba Cloud.
AWS CloudAWS and OpenSearch release security advisories for high-severity vulnerability CVE-2026-75897 in OpenSearch Dashboards enabling unauthenticated remote denial of service.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-18830 in Amazon Bedrock AgentCore allowing attackers to bypass LLM safety guardrails and trigger arbitrary tool calls.
MicrosoftMicrosoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
MicrosoftMicrosoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
CiscoCisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
AWS CloudAWS Labs resolves high-severity vulnerability CVE-2026-16584 in AWS API MCP Server allowing autonomous AI agent workflows to bypass security policies upon initialization failure.
AWS CloudAWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
OT / SCADASiemens and CISA issue advisory ICSA-26-258-06 for Mendix SAML module vulnerability CVE-2026-80465 allowing unauthenticated remote attackers to hijack enterprise SSO accounts.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-92943 in AWS IoT Device SDK for Python allowing adversary-in-the-middle telemetry interception and message spoofing.
LinuxThreat actors weaponize improper condition check flaw CVE-2025-39682 in Linux kernel kTLS receive path, triggering out-of-bounds corruption in multi-tenant workloads.
LinuxWorking public exploits released for four Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—enabling local root escalation and container escapes.
AWS CloudAWS patches high-severity flaw CVE-2026-86831 in Amazon EKS aws-network-policy-agent allowing unauthorized pod communication and network isolation bypass.
AWS CloudAWS resolves high-severity privilege escalation flaw CVE-2026-86830 in Temporary Elevated Access Management (TEAM) for IAM Identity Center.
MicrosoftMicrosoft patches maximum-severity CVSS 10.0 flaw CVE-2026-85889 in Azure AI Foundry enabling unauthenticated remote network privilege escalation.
Threat IntelCISA orders emergency patching of PTC Windchill PLM vulnerability CVE-2026-12569 enabling unauthenticated remote code execution and CAD blueprint theft.