Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 584 results
criticalbug_reportVulnerabilitySAP Commerce Cloud RCE flaw (CVE-2026-58231) exploited 3 days post-patch
SAP Commerce Cloud (formerly Hybris), specifically the core Data Hub Adapter extension. All unpatched instances are vulnerable. Shadowserver tracks 4,200+ internet-exposed instances, primarily in Europe and North America.
criticalbug_reportVulnerabilityVMware vCenter RCE (CVE-2026-59310) exploited for reverse SSH access
VMware vCenter Server versions prior to 9.1.0.0300 (9.1 branch), 9.0.2.0100 (9.0 branch), and 8.0 U3k/U2f (8.0 branch). The vulnerability affects the vCenter Syslog Server component and is exploitable by unauthenticated attackers with network access.
criticalbug_reportVulnerabilitySonicWall GMS unauthenticated RCE flaws require immediate patching
SonicWall Global Management System (GMS). Specific affected versions not disclosed in available data. Both CVE-2026-66145 and CVE-2026-66147 enable unauthenticated remote code execution.
criticalbug_reportVulnerabilityCisco Secure Firewall DoS flaw under active exploitation
Cisco Secure Firewall products (specific versions not disclosed in available data). Organizations using Cisco ASA, FTD, or Firepower appliances should assume exposure until vendor advisory is reviewed.
criticalbug_reportVulnerabilityMetabase SQL injection under active exploitation, patch immediately
Metabase open-source business intelligence platform. Specific affected versions not disclosed in advisory. SQL injection vulnerability allows unauthorized database access.
criticalbug_reportVulnerabilitySharePoint CVE-2026-55040 exploited in wild after PoC release
Microsoft SharePoint servers not patched with July 2026 Patch Tuesday updates. All unpatched SharePoint instances are vulnerable to authentication bypass allowing unauthenticated remote attackers to impersonate any site user or administrator.
criticalbug_reportVulnerabilityAdobe Commerce/Magento flaw CVE-2026-71362 exploited to hijack accounts
Adobe Commerce and Magento Open Source e-commerce platforms, all currently supported release lines. The vulnerability affects customer account session handling and requires no authentication to exploit.
criticalperson_alertThreat ActorLazarus Exploits Windows Zero-Day in Operation Dream Job Campaign
Lazarus Group is a North Korean state-sponsored advanced persistent threat (APT) actor attributed to Pyongyang-backed cyber operations. The group conducts cyber espionage and financially motivated campaigns targeting organizations worldwide.
criticalperson_alertThreat ActorLazarus Exploits Windows Zero-Day in Operation Dream Job Campaign
Lazarus is a North Korean state-sponsored advanced persistent threat (APT) group linked to the Reconnaissance General Bureau. The group is financially and strategically motivated, conducting espionage operations targeting defense and critical infrast…
criticalbug_reportVulnerabilityMicrosoft SharePoint JWT auth bypass exploited in wild after PoC release
Microsoft SharePoint Enterprise Server 2016 and SharePoint Server 2019. CVE-2026-55040 is a critical authentication bypass in JWT token validation allowing unauthenticated attackers to impersonate SharePoint users or administrators.
criticalbug_reportVulnerabilityMicrosoft August 2026 Patch Tuesday: 398 vulnerabilities, 42 critical
Microsoft products and services across the ecosystem. Specific affected products, versions, and CVE identifiers not disclosed in available information. 398 total vulnerabilities addressed, including 42 rated critical severity.
criticalbug_reportVulnerabilityAdobe patches three CVSS 10.0 flaws in ColdFusion and Campaign Classic
Adobe ColdFusion 2025.0.x (prior to 2025.0.12) and 2023.0.x (prior to 2023.0.23); Adobe Campaign Classic v7 (prior to 7.4.4 build 9400) on-premise and hybrid deployments; Adobe Commerce (version not specified).
criticalbug_reportVulnerabilityVMware vCenter CVE-2026-59310 exploited in wild for RCE and persistence
Broadcom VMware vCenter Server (all unpatched versions prior to late July 2026 patch release). Affects 361+ confirmed victim IPs across 47 countries, primarily Germany, US, Turkey, Iran, and France.
criticalbug_reportVulnerabilityMalicious LiteLLM PyPI packages stole credentials from 2,100+ orgs
LiteLLM versions 1.82.7 and 1.82.8 published on PyPI on March 24, 2026 (10:39-11:19 UTC, treat installs through 16:00 UTC as suspect). Any system that installed these versions or pulled them as transitive dependencies via agent frameworks or orchestr…
criticalbug_reportVulnerabilitySAP Commerce Cloud critical flaw allows unauthenticated RCE (CVSS 10.0)
SAP Commerce Cloud (Data Hub Adapter). All unpatched versions are affected. The vulnerability impacts the default authentication client and certain functions lacking input validation.
criticalbug_reportVulnerabilityWindows kernel driver zero-day CVE-2026-68820 exploited by Lazarus APT
Windows kernel driver afd.sys (Ancillary Function Driver for WinSock) across all supported Windows versions. CVE-2026-68820 is a use-after-free vulnerability enabling local privilege escalation to SYSTEM level. CVSS 7.0.
criticalbug_reportVulnerabilityZoom annotation tool flaws enabled zero-click client hijacking
Zoom Workplace (all platforms) before 7.1.5 and 7.0.6; Zoom Workplace VDI Client for Windows before 7.0.11 and 6.6.16; Zoom Rooms and Zoom Meeting SDK (all platforms) before 7.1.0 and 7.1.5. Affects both screen sharers and meeting viewers.
criticalbug_reportVulnerabilityMicrosoft patches 400 flaws including 3 zero-days, one exploited by Lazarus
All supported Windows versions (Windows 10, Windows 11). Three zero-day vulnerabilities: CVE-2026-68820 (Windows AFD.sys driver, actively exploited by Lazarus APT), CVE-2026-62832 (Windows User Profile Service, publicly disclosed as "LegacyHive"), an…
criticalbug_reportVulnerabilitySharePoint Server auth bypass chained to RCE, no credentials required
Microsoft SharePoint Server Subscription Edition, 2019, and 2016 (CVE-2026-55040, CVSS 9.1). Chained RCE flaw CVE-2026-63520 (CVSS 8.1) also affects Project Server 2013 SP1 and Office Web Apps 2013 SP1. SharePoint Online is not affected.
criticalbug_reportVulnerabilityCritical SQL injection in Metabase requires immediate patching
Metabase (specific affected versions not disclosed in advisory). SQL injection vulnerability impacts database query functionality.
criticalperson_alertThreat ActorRansomware Gangs Exploit SonicWall SMA1000 SSRF and Auth Bypass Flaws
The actors are ransomware gangs—a broad category of financially motivated cybercrime operators—actively exploiting recently patched SonicWall SMA1000 vulnerabilities.
criticalbug_reportVulnerabilityProgress Kemp LoadMaster command injection flaw exploited in the wild
Progress Kemp LoadMaster GA v7.2.63.1 and older, LTSF v7.2.54.17 and older; MOVEit WAF all versions before GA v7.2.63.2. Approximately 300 instances exposed online. Used by Fortune 500 companies and government agencies including Amazon and U.S.
criticalbug_reportVulnerabilityHead Mare hacktivists backdoor TrueConf installers via server compromise
TrueConf video conferencing servers (unpatched versions) and client installers distributed from compromised servers. Specific vulnerable versions not disclosed. Affects organizations using TrueConf for video conferencing.
criticalbug_reportVulnerabilityMetabase zero-day (CVSS 10.0) exploited for unauthenticated admin access
Metabase versions 1.58.0 through 1.63.2 (all self-hosted and cloud instances). Specifically: 1.58.0–1.58.23, 1.59.0–1.59.20, 1.60.0–1.60.16, 1.61.0–1.61.10, 1.62.0–1.62.8, and 1.63.0–1.63.2. Metabase Cloud instances already patched.
criticalbug_reportVulnerabilityN-able N-central exploited; attackers persist via Cloudflare tunnels
N-able N-central RMM product, all versions prior to 2026.3.1.7. CVE-2026-18577 (CVSS 8.2) is an incomplete fix for CVE-2026-18556 (CVSS 8.2), both enabling authentication bypass and account takeover. On-premise deployments are affected.
criticalbug_reportVulnerabilityProgress Kemp LoadMaster command injection (CVE-2026-8037) exploited
Progress Kemp LoadMaster appliances. All versions with vulnerable escape_quotes() function. Unauthenticated remote attack vector.
criticalbug_reportVulnerabilityMetabase SQL injection zero-day exploited to steal customer data
Metabase (specific versions not disclosed). Confirmed victims include Framework and Tally customer instances. All unpatched Metabase deployments potentially at risk.
criticalbug_reportVulnerabilityNearly 800 malicious npm packages deliver cross-platform RAT via typosquatting
npm registry: ~800 packages using typosquatting and AI-generated names. Targets all Node.js developers on Windows, macOS (x64/ARM64), and Linux (x64/ARM64). Delivers WEL1DROPPER leading to Sliver C2 framework and platform-specific infostealers.
criticalbug_reportVulnerabilityKVM VM escape vulnerabilities require immediate patching
KVM (Kernel-based Virtual Machine) hypervisor. Specific affected versions not disclosed in advisory. Impacts organizations running KVM-based virtualization infrastructure on Linux hosts.
criticalbug_reportVulnerability18-year-old Linux SCTP flaw enables local root and container escape
Linux kernel versions since 2.6.25 (2008) through 7.1.5, 6.18.41, 6.12.100, and 6.6.147. Affects systems with SCTP networking enabled. Confirmed vulnerable: Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, OpenCloudOS.