Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1071 results
criticalbug_reportVulnerabilityGitLab path traversal CVE-2026-85706 requires immediate patching
GitLab servers (specific affected versions not disclosed in available data). Path traversal vulnerability with maximum severity rating (CVSS 10.0 assumed).
highbug_reportVulnerabilityJFrog Artifactory flaws actively exploited to create admin backdoors
JFrog Artifactory self-hosted instances: CVE-2026-42018 and CVE-2026-42016 (chained, versions below 7.146.8 on multiple branches); CVE-2026-82329 (standalone critical bypass, CVSS 9.8, versions below 7.161.20 across six branches).
criticalbug_reportVulnerabilityPaperCut patches two actively exploited flaws used in 395+ breaches
PaperCut NG/MF all versions prior to 26.0.5, 25.0.13, and 24.1.10. Vulnerabilities CVE-2026-81578 and CVE-2026-82078 enable authentication bypass and arbitrary code execution. At least 395 organizations in 48 countries compromised, primarily U.S.
criticalbug_reportVulnerabilityCisco FMC auth bypass exploited by ransomware and state actors
Cisco Secure Firewall Management Center (FMC) software. CVE-2026-20079 (CVSS 10.0) allows unauthenticated remote authentication bypass and root access. CVE-2026-20316 (CVSS 5.3) enables low-privilege login for sensitive data access.
highbug_reportVulnerabilityAI-enhanced BEC campaign targets finance teams with CEO impersonation
Over 1 million emails sent August 3-5 targeting enterprise finance/accounts payable departments, primarily in United States (87.7%). Campaign used third-party email delivery infrastructure to impersonate C-level executives (CEO, CFO, President) with…
criticalbug_reportVulnerabilityCisco FMC flaws exploited by ransomware and state-sponsored actors
Cisco Secure Firewall Management Center (FMC) - all versions vulnerable to CVE-2026-20079 (CVSS 10.0, authentication bypass) and CVE-2026-20316 (CVSS 5.3, static credentials). Widely deployed security appliance used for managing Cisco firewalls.
highbug_reportVulnerabilityGoogle Play Early Access abused to distribute deceptive Android apps
Google Play Early Access program; Android users globally, particularly those exposed to social media ads on TikTok and Facebook. Thousands of deceptive apps including fake casino games, reward apps, and utility apps.
criticalbug_reportVulnerabilityWatchGuard Fireware OS arbitrary code execution flaw requires urgent patch
WatchGuard Fireware OS - specific affected versions not disclosed in available information. Impacts WatchGuard firewall appliances running vulnerable Fireware OS versions.
criticalbug_reportVulnerabilityBlueMoon exploit kit chains Windows and Chrome zero-days in espionage ops
Microsoft Windows (CVE-2026-85880: heap-based buffer overflow in ALPC, older builds targeted); Google Chrome and Chromium-based browsers (CVE-2026-85046: V8 type confusion; CVE-2026-87491: V8 sandbox escape).
criticalbug_reportVulnerabilityCheck Point patches two 9.8 VPN certificate flaws allowing unauthenticated RCE
Check Point Quantum Security Gateway, Security Management Server, and Spark Firewall. Affected versions: R82.10 (Jumbo Hotfix Take 43 or below), R82 (Take 125 or below), R81.20 (Take 165 or below). Spark Firewall versions not specified.
criticalbug_reportVulnerabilityPaperCut NG/MF exploited at scale via AI-driven attacks; 440+ instances hit
PaperCut NG/MF (all unpatched versions vulnerable to CVE-2026-81578 and CVE-2026-82078). 440+ instances across 395 organizations in 48 countries compromised, primarily education sector in US, UK, France, Spain, Canada, Belgium, Portugal, Australia, G…
highbug_reportVulnerabilityHard-coded API credentials in drEryk Gabinet allow ticket system access
drEryk Gabinet software, all versions before 11.5.0. Affects the ticket reporting component with hard-coded API credentials that authenticate directly to the ticket system API.
criticalbug_reportVulnerabilityCISA flags 3 exploited flaws in Cisco FMC, Citrix NetScaler, Fortinet
CVE-2026-20079: Cisco Secure Firewall Management Center (FMC) Software (CVSS 10.0). CVE-2026-19490: Citrix NetScaler ADC and NetScaler Gateway configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) (CVSS 9.3).
criticalbug_reportVulnerabilityCheck Point VPN flaws allow unauthenticated RCE on gateways and mgmt servers
Check Point Security Gateway, Security Management Server, and Spark Firewall (all versions R80 through R82.10) configured with Remote Access VPN or Site-to-Site VPN.
highbug_reportVulnerability10% of LiteLLM gateways accept default "sk-1234" admin key from docs
LiteLLM open-source AI gateway: 294 of 3,074 internet-facing instances scanned in February 2026 accepted the example admin key "sk-1234" from setup documentation. 191 had no key set at all; remainder used the documented default.
criticalbug_reportVulnerabilityCisco Secure FMC auth bypass CVE-2026-20079 actively exploited
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. All unpatched versions vulnerable. Cloud-hosted Security Cloud Control already patched by Cisco.
highbug_reportVulnerabilityPasskey-themed phishing campaign targets cloud identities via AiTM
Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access.
criticalbug_reportVulnerabilitySAP patches two critical RCE flaws in Kernel and NetWeaver (CVSS 10.0)
CVE-2026-44756 (CVSS 10.0) affects SAP Kernel versions 7.22–9.20 and WEBDISP 9.16–9.20 across KRNL64NUC, KRNL64UC, and KERNEL components. CVE-2026-58240 (CVSS 9.8) affects SAP NetWeaver Message Server in Kernel 9.16, 9.18, 9.19, 9.20.
criticalbug_reportVulnerabilityFortinet FortiOS & FortiSwitchManager RCE requires immediate patching
Fortinet FortiOS and FortiSwitchManager affected by remote code execution vulnerability. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or published.
criticalbug_reportVulnerabilityN-able N-central pre-auth RCE (CVE-2026-86218) requires immediate patch
N-able N-central remote monitoring and management (RMM) platform. Specific affected versions not disclosed in available information. Pre-authentication attack surface suggests all internet-facing instances are at risk.
criticalbug_reportVulnerabilityMicrosoft Sept 2026 Patch Tuesday: 964 CVEs, 2 zero-days under attack
Microsoft products across the ecosystem. 964 vulnerabilities total: 104 critical, 860 important. Two zero-day vulnerabilities are actively exploited in the wild.
highbug_reportVulnerabilityDeepSeek Harness agents can escape file sandbox via unauthenticated API
DeepSeek Harness versions 0.1.1-rc.2 and earlier. The tool runs AI coding agents on developer machines. Fixed in version 0.1.2-alpha.2 (npm) and later. Third-party desktop wrappers may ship vulnerable versions independently.
criticalbug_reportVulnerabilityAlby Hub critical flaw enables wallet takeover on internet-exposed instances
Alby Hub versions v1.7.0 through v1.18.5 (all releases before August 2025). Only instances exposed to the internet are vulnerable. Versions v1.19.0 and later are patched. Current version is v1.24.0.
highbug_reportVulnerability36,000 Plex Media Servers remain unpatched against undisclosed flaws
Plex Media Server v1.43.2 and earlier, Plex Desktop prior to v1.115.0. Over 36,000 internet-exposed instances confirmed vulnerable as of September 2026. Affects self-hosted and NAS-based deployments.
highbug_reportVulnerabilityYouTube gaming lures and SEO poisoning deliver multi-payload malware via PPI
Enterprise networks, critical infrastructure, and government entities. Campaign CL-CRI-1171 active since at least 2024, delivering payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz via custom loader.
highbug_reportVulnerabilityChrome V8 zero-day CVE-2026-87491 exploited in wild for sandbox code execution
Google Chrome versions prior to 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux). Affects V8 JavaScript engine. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) also vulnerable until patched.
criticalbug_reportVulnerabilitycPanel SQL injection flaw allows mail users to escalate to root
All supported versions of cPanel and WHM (release lines 11.110, 11.134, 11.136, 11.138, and WP Squared). Fixed in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP Squared).
criticalbug_reportVulnerabilityMicrosoft Defender zero-day "ShieldCrash" bypasses September patch
Microsoft Defender on all supported Windows 10, Windows 11, and Windows Server versions with September 2026 Patch Tuesday updates applied. The vulnerability is an incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read as SYSTEM…
highbug_reportVulnerabilityChrome zero-day CVE-2026-87491 exploited in wild, seventh in 2024
Google Chrome versions prior to 153.0.8010.36 (Windows/Linux) and 153.0.8010.37 (Mac) on all desktop platforms. Vulnerability exists in V8 JavaScript/WebAssembly engine.
highbug_reportVulnerabilityMicrosoft patches 974 vulnerabilities, including 2 actively exploited zero-days
Microsoft Windows (all supported versions), Windows Server 2012 and later, and other Microsoft software products. Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (privilege escalation).