Atlassian’s Known-File Heist
Atlassian’s Known-File Heist CVE-2026-21589 lets unauthenticated attackers read known files from eight self-hosted Atlassian product families; in some Crowd-...
Atlassian’s Eight Open Drawers
Atlassian’s Eight Open Drawers CVE-2026-21589 lets unauthenticated attackers who know an exact path read files from eight self-hosted Atlassian products;...
Atlassian’s Path Expectations
Atlassian’s Path Expectations CVE-2026-21589 lets unauthenticated attackers read known files from eight self-hosted Atlassian Data Center products when exact...
FortiMail’s Mail Slot Zero-Day
FortiMail’s Mail Slot Zero-Day FortiMail CVE-2026-104286 is being actively exploited to write arbitrary files without authentication. Disable IBE or restrict...
AI-Powered Zammad Breach Chained Two Zero-Days
AI-Powered Zammad Breach Chained Two Zero-Days DIVD says an automated AI-driven intrusion chained Zammad CVE-2026-102489 and CVE-2026-102490 to hijack...
Apple CoreGraphics Frame Break
Apple CoreGraphics Frame Break Apple patched CoreGraphics CVE-2026-86950, an out-of-bounds write that could let a crafted file execute code and may have been...
Citrix NetScaler Double Gatecrash
Citrix NetScaler Double Gatecrash Citrix says actively exploited NetScaler flaws CVE-2026-88771 and CVE-2026-88772 can enable remote code execution; preserve...
Zombie Actions: Compromised GitHub Workflows Reawaken
Zombie Actions: Compromised GitHub Workflows Reawaken Two compromised GitHub Actions resumed executing Mini Shai-Hulud after their repositories were re-...
WordPress Template Break-In
WordPress Template Break-In Attackers began exploiting WordPress Core flaw CVE-2026-87902 within hours of disclosure; under certain theme and server...
F5 BIG-IP OAuth Gatecrash
F5 BIG-IP OAuth Gatecrash F5 patched actively exploited CVE-2026-94127 in BIG-IP APM OAuth authorization-server deployments, where unauthenticated attackers...
Zyxel Switch Flaw Spills Network Secrets
Zyxel Switch Flaw Spills Network Secrets CVE-2026-7273 is being exploited to steal configurations, hashed root credentials, and network information from...
CrowdSec Source Code Theft Tied to TanStack Attack
CrowdSec Source Code Theft Tied to TanStack Attack CrowdSec says a malicious TanStack dependency likely exposed an API key used to read about 300...
Plugin4Shell Breaks AI Agent Plugin Pins
Plugin4Shell Breaks AI Agent Plugin Pins Plugin4Shell can let repository control on vulnerable Git hosts swap code behind a supposedly pinned plugin in major...
Cisco ISE Zero-Day Opens the Identity Gate
Cisco ISE Zero-Day Opens the Identity Gate Cisco ISE CVE-2026-76460 is under active exploitation, letting unauthenticated requests bypass management login...
Cisco Secure Email Gateway Zero-Day Hits Root
Cisco Secure Email Gateway Zero-Day Hits Root CVE-2026-76461 in Cisco Secure Email Gateway is actively exploited and can turn a crafted email into root-level...
Root Mail: Cisco Email Gateway Zero-Day
Root Mail: Cisco Email Gateway Zero-Day Cisco says attackers are exploiting CVE-2026-76461 in Secure Email Gateway, where a crafted email can reach root...
GitLab Repo Escape Is Now in CISA KEV
GitLab Repo Escape Is Now in CISA KEV CISA says GitLab CVE-2026-85706 is being exploited; the unauthenticated path traversal can expose arbitrary server...
PaperCut Replaces Emergency Patches for Exploited Flaw Chain
PaperCut Replaces Emergency Patches for Exploited Flaw Chain PaperCut’s actively exploited CVE-2026-81578 and CVE-2026-82078 can chain authentication bypass...
Chrome V8 zero-day patched after in-the-wild exploitation
Chrome V8 zero-day patched after in-the-wild exploitation Google patched Chrome CVE-2026-85046, an actively exploited V8 type-confusion flaw that could be...
SonicWall SMA1000 Zero-Days Hit the Edge
SonicWall SMA1000 Zero-Days Hit the Edge SonicWall says two exploited SMA1000 zero-days, CVE-2026-83548 and CVE-2026-83549, can be chained against exposed...