Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
21 / 321 results
criticalbug_reportVulnerabilityCritical flaws in Sparx Pro Cloud Server actively exploited in the wild
Sparx Systems Pro Cloud Server and Enterprise Architect products. Specific vulnerable versions not disclosed in summary; CERT.BE advisory should be consulted for version details.
criticalbug_reportVulnerabilitySonicWall Gen6 SSL-VPN exploited for credential brute-force and MFA bypass
SonicWall Gen6 SSL-VPN appliances with incomplete patching. Specific firmware versions not disclosed. Affects organizations using SonicWall SSL-VPN for remote access.
criticalbug_reportVulnerabilityCompromised @antv npm packages deploy credential-stealing malware
Multiple @antv npm packages compromised with Mini Shai-Hulud malware. Affects Linux-based CI/CD pipelines using npm install. Targets credentials from GitHub, AWS, Kubernetes, HashiCorp Vault, npm, and 1Password.
criticalbug_reportVulnerabilityPgBouncer integer overflow under active exploitation, patch immediately
PgBouncer (PostgreSQL connection pooler) - specific affected versions not disclosed by CERT.BE. All unpatched instances should be considered at risk.
criticalperson_alertThreat ActorMicrosoft Disrupts Fox Tempest Malware-Signing-as-a-Service Operation
Fox Tempest is a threat actor attributed by Microsoft as operating a malware-signing-as-a-service (MSaaS) business model. The actor exploited Microsoft's Artifact Signing system to provide malicious code signing services to other cybercriminals, enab…
criticalbug_reportVulnerabilityDrupal critical core vulnerability with imminent exploit risk
Drupal core (specific versions not disclosed). All Drupal installations should be considered at risk until patched.
criticalbug_reportVulnerabilityCritical Portainer vulnerabilities enable full host takeover
Portainer container management platform. Specific affected versions not disclosed in summary; CERT.BE advisory should be consulted for version details. Impacts organizations using Portainer for Docker/Kubernetes management.
criticalbug_reportVulnerabilityChromaDB FastAPI RCE allows unauthenticated arbitrary code execution
ChromaDB latest Python FastAPI version. Affects exposed ChromaDB servers accessible over the network. No CVE assigned yet.
criticalbug_reportVulnerabilityCritical nginx vulnerabilities enable RCE and rate-limit bypass
nginx web server (specific versions not provided by CERT.BE advisory). Affects organizations running vulnerable nginx instances, particularly those exposed to the internet or untrusted networks.
criticalbug_reportVulnerabilityScadaBR 1.2.0 critical flaws enable unauthenticated remote code execution
ScadaBR version 1.2.0, a SCADA system used in critical infrastructure sectors including energy, water, and manufacturing worldwide. All four CVEs affect the same version.
criticalbug_reportVulnerabilityZKTeco CCTV cameras expose credentials via unauthenticated config port
ZKTeco CCTV cameras, specifically model SSC335-GC2063-Face-0b77, running firmware versions prior to V5.0.1.2.20260421. Vulnerability affects an undocumented configuration export port that allows unauthenticated access to camera credentials and config…
criticalbug_reportVulnerabilityMicrosoft Exchange Server XSS flaw actively exploited for session hijacking
Microsoft Exchange Server (specific versions not disclosed). Cross-Site Scripting vulnerability enabling spoofing and session hijacking. No CVE assigned yet.
criticalbug_reportVulnerabilityCritical PAN-OS vulnerabilities enable auth bypass and code execution
Palo Alto Networks PAN-OS (specific versions not provided in summary). Affects authentication controls, code execution surface, and availability.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN auth bypass grants admin access to attackers
Cisco Catalyst SD-WAN platform. Specific affected versions not disclosed. Vulnerability allows authentication bypass leading to administrative access on SD-WAN infrastructure components.
criticalbug_reportVulnerabilityMultiple critical vulnerabilities in Fortinet products require patching
Fortinet products: FortiSandbox, FortiOS, FortiAP, FortiAnalyzer, and FortiManager. Specific affected versions not provided in advisory. Multiple vulnerabilities ranging from critical to medium severity.
criticalbug_reportVulnerabilityCisco SD-WAN Manager auth bypass exploited in wild since 2023
Cisco Catalyst SD-WAN controllers and Cisco SD-WAN Manager. Specific affected versions not provided in advisory summary. CVE-2026-20127 allows administrative access compromise.
criticalbug_reportVulnerabilityIvanti EPMM critical RCE flaws under limited exploitation
Ivanti Endpoint Manager Mobile (EPMM) products. Specific affected versions not provided in advisory summary. Two critical vulnerabilities enabling unauthenticated remote code execution.
criticalbug_reportVulnerabilityFortinet FortiCloud SSO auth bypass under active exploitation
Fortinet FortiCloud SSO SAML authentication processing (CVE-2025-59718, CVE-2025-59719). Affects management interfaces of FortiGate and potentially other Fortinet products using FortiCloud SSO.
criticalbug_reportVulnerabilityCisco Secure Email Gateway critical flaw unpatched, check for compromise
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Specific affected versions not provided in advisory summary. No patch available as of December 17, 2025.
criticalbug_reportVulnerabilityReact Server Components RCE flaw enables unauthenticated remote execution
React Server Components and integrating frameworks (e.g., Next.js, Remix). All versions using React Server Components are potentially affected until patched.
criticalbug_reportVulnerabilityMicrosoft patches critical WSUS RCE flaw with public PoC exploit
Windows Server Update Service (WSUS) on Windows Server. Specific versions not disclosed in out-of-band update. Affects organizations running WSUS infrastructure for Windows update management.