1,437 articles
Threat IntelLiteLLM releases urgent patch for CVE-2026-42208, a pre-auth SQL injection flaw allowing unauthenticated remote attackers to dump LLM proxy master credentials.
Check PointCheck Point and CERT-In issue emergency alerts for critical CVSS 9.8 flaw CVE-2026-91843 in Security Management and Log Servers allowing remote unauthenticated root compromise.
AWS CloudAWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Deep DiveCritical OAuth metadata flaw CVE-2026-63127 in rmcp Rust SDK allows rogue Model Context Protocol servers to capture enterprise agent tokens and impersonate identities.
Threat IntelCISA releases advisory ICSA-26-258-01 warning of critical vulnerabilities in Digital Watchdog VMAX DVR and NVR recorders allowing unauthenticated remote root code execution.
Deep DiveEuropean financial regulators transition DORA enforcement to mandatory Threat-Led Penetration Testing (TLPT) and direct scrutiny of Critical ICT Third-Party Providers.
Threat IntelVulnerability CVE-2026-67620 in Flowise AI workflow builder allows attackers to bypass SSRF deny-lists and extract cloud instance metadata credentials from OCI and Alibaba Cloud.
AWS CloudAWS and OpenSearch release security advisories for high-severity vulnerability CVE-2026-75897 in OpenSearch Dashboards enabling unauthenticated remote denial of service.
OT / SCADACISA, NSA, and the FBI issue joint advisory AA26-231A warning of active campaigns targeting Siemens S7 series PLCs using automated S7comm protocol exploitation.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-18830 in Amazon Bedrock AgentCore allowing attackers to bypass LLM safety guardrails and trigger arbitrary tool calls.
MicrosoftMicrosoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
OT / SCADAJohnson Controls and CISA release emergency advisory ICSA-26-204-01 for C-CURE 9000 and victor application servers resolving critical code execution flaw CVE-2026-21655.
MicrosoftMicrosoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-69836 in Entra ID allowing unauthenticated remote code execution via unsafe object deserialization.
CiscoCisco issues emergency software hardening release for Secure Firewall ASA, FTD, and FMC addressing actively exploited critical vulnerability CVE-2026-20329.
OT / SCADAMitsubishi Electric and CISA issue critical advisory ICSA-26-260-02 for GX Works3 and Motion Control Settings software enabling in-memory block password bypass and PLC logic tampering.
AWS CloudAWS Labs resolves high-severity vulnerability CVE-2026-16584 in AWS API MCP Server allowing autonomous AI agent workflows to bypass security policies upon initialization failure.
AWS CloudAWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
OT / SCADASiemens and CISA issue advisory ICSA-26-258-06 for Mendix SAML module vulnerability CVE-2026-80465 allowing unauthenticated remote attackers to hijack enterprise SSO accounts.
OT / SCADASchneider Electric and CISA warn of critical OS command injection flaw CVE-2026-13336 in NetBotz 5 environmental monitors enabling root host takeover via system backup restore.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-92943 in AWS IoT Device SDK for Python allowing adversary-in-the-middle telemetry interception and message spoofing.
OT / SCADASchneider Electric and CISA warn of improper authentication validation in PowerChute Serial Shutdown allowing unauthorized actors to disrupt critical infrastructure power.
LinuxThreat actors weaponize improper condition check flaw CVE-2025-39682 in Linux kernel kTLS receive path, triggering out-of-bounds corruption in multi-tenant workloads.
LinuxWorking public exploits released for four Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—enabling local root escalation and container escapes.
AWS CloudAWS patches high-severity flaw CVE-2026-86831 in Amazon EKS aws-network-policy-agent allowing unauthorized pod communication and network isolation bypass.