1,437 articles
Active ExploitThreat actors actively weaponize high-severity flaw CVE-2026-33626 in LMDeploy within hours of release, using multimodal image loaders as SSRF proxies into cloud metadata.
GoogleGoogle Cloud resolves high-severity SSRF vulnerability CVE-2026-19486 in Gemini Enterprise Agent Platform App Builder allowing attackers to harvest GCP IAM service account tokens.
OT / SCADASiemens ProductCERT issues advisory SSA-503852 for critical CVSS 9.1 flaw CVE-2026-18963 in Industrial Edge Management allowing unauthenticated attackers to seize administrative accounts.
Threat IntelCritical CVSS 9.8 flaw CVE-2026-30623 in LiteLLM allows remote attackers to execute arbitrary operating system commands via unvalidated Model Context Protocol server parameters.
MicrosoftMicrosoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-48567 in Azure HorizonDB allowing network attackers to bypass authentication and seize cluster control.
OT / SCADACISA and Schneider Electric issue advisory for CVE-2025-6625 in Modicon M340 PLCs and BMX communication modules, where malformed FTP commands halt controller operations.
MicrosoftAWS patches high-severity flaw CVE-2026-7461 in Amazon ECS Agent for Windows allowing container escape and SYSTEM command injection via FSx volume mounts.
Threat IntelSecurity researchers uncover critical flaw CVE-2026-7482 (Bleeding Llama) in Ollama GGUF model loader allowing remote memory exfiltration and credential leaks.
OT / SCADARockwell Automation and CISA issue advisory ICSA-26-244-02 detailing privilege escalation flaws CVE-2026-9634 in Redundancy Module Configuration Tool.
Agentic AIHacktron AI researchers demonstrate how Claude Opus 5 synthesized an ASLR-bypassing libheif exploit to breach OpenAI forum and pivot to internal repos.
OT / SCADAHitachi Energy notification 8DBD000229 details critical CVSS 9.9 flaws in FACTS Control Platform GWS enabling remote code injection in power grid SCADA.
MicrosoftMicrosoft patches high-severity flaw CVE-2026-47632 in Azure Connected Machine Agent allowing local privilege escalation on Azure Arc hybrid endpoints.
Threat IntelCrewAI maintainers resolve vulnerability CVE-2026-2275 in CodeInterpreter tool allowing arbitrary host command execution via malicious Python payloads.
GoogleGoogle Cloud resolves critical flaw CVE-2026-12710 in Application Integration QueryEngineTask allowing cross-tenant authorization bypass and IAM escalation.
Agentic AIOpen WebUI security release patches high-severity vulnerability CVE-2026-45672 allowing sandbox escapes and arbitrary host execution via crafted pipeline code.
OT / SCADASchneider Electric advisory SEVD-2026-160-01 details high-severity XXE flaw CVE-2026-8045 in EcoStruxure IT Data Center Expert enabling data exfiltration.
Threat IntelHPE Aruba Networking resolves maximum-severity CVSS 9.8 flaw CVE-2026-63455 in EdgeConnect SD-WAN Orchestrator allowing unauthenticated network takeover.
AWS CloudAWS releases security bulletin 2026-097-AWS for CVE-2026-85654 in DynamoDB MCP server, where template injection enables arbitrary host command execution.
OT / SCADASiemens releases advisory SSA-246443 for high-severity flaw CVE-2026-27663 in SICAM 8 controllers, where resource exhaustion halts substation automation.
MicrosoftMicrosoft fixes critical CVSS 9.1 flaw CVE-2026-33843 in Azure AD B2C and Microsoft Entra ID allowing unauthenticated network attackers to elevate privileges.
OT / SCADASchneider Electric issues advisory SEVD-2026-251-04 for critical CVSS 9.2 flaw CVE-2026-3869 in Modicon M580 controllers enabling unauthenticated process takeover.
Threat IntelvLLM maintainers and NIST disclose critical CVSS 9.8 flaw CVE-2026-22778 in multimodal video processing allowing unauthenticated remote root takeover of GPU clusters.
MicrosoftRockwell Automation issues advisory SD1799 for CVE-2026-16675 in FactoryTalk Activation Manager, allowing authenticated operators to seize SYSTEM privileges.
GoogleGoogle Cloud and Linux maintainers patch CVE-2026-46300 (Fragnesia), a critical ESP-in-TCP kernel bug enabling container breakout to GKE node root.