Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 551 results
criticalbug_reportVulnerabilityAI-assisted Chrome full-chain exploit built in 6 days, all bugs patched
Google Chrome versions prior to 152.0.7977.82 on Windows. Three vulnerabilities chained: CVE-2026-85045 (V8 JavaScript engine), CVE-2026-78952 (Crashpad crash handler), and one unidentified bug in animated-WebP decoder.
criticalbug_reportVulnerabilityAI agent finds OTP delivery bypass in major insurer's production site
Major insurance company's production website with millions of users. Specific vendor and product not disclosed. Authentication flow allows attacker-controlled OTP delivery address, bypassing account ownership validation.
criticalbug_reportVulnerabilityGhostscript heap overflow enables RCE via crafted PDF uploads
Ghostscript versions 9.21 through 10.07.1. Affects any application that processes attacker-supplied PDFs through Ghostscript, including WordPress sites using Imagick/ImageMagick for PDF rendering.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day chain enables root RCE; third flaw unpatched
Ivanti Connect Secure VPN appliances before version 25.1.3.0 are affected. Versions 22.7R2.14 and earlier are not affected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are patched for two of three flaws.
criticalbug_reportVulnerabilitySAP Cloud SDK for Python CVSS 10 flaw leaks OAuth2 credentials to attacker
SAP Cloud SDK for Python versions below 0.45.2, 0.53.0 through 0.55.0, and all 0.36.x releases. Affects multi-tenant applications on SAP Business Technology Platform (BTP) using the SDK for authentication.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day CVE-2026-104935 exploited since Oct 3
Ivanti Connect Secure (ICS) versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Over 5,500 ICS instances exposed online. Affects SSL VPN appliances used for remote access to corporate and cloud resources.
criticalbug_reportVulnerabilityCritical RCE flaw in Splunk Enterprise requires immediate patching
Splunk Enterprise (specific versions not disclosed in available data). Multiple vulnerabilities reported including at least one critical-severity remote code execution flaw.
criticalbug_reportVulnerabilityPre-auth RCE in AnyDesk for Linux requires immediate patching
AnyDesk for Linux - specific vulnerable versions not disclosed in available information. Pre-authentication remote code execution vulnerability affects unauthenticated network-accessible installations.
criticalbug_reportVulnerabilityGitLab CE/EE critical vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available advisory text. CVE identifier not yet assigned or published.
criticalbug_reportVulnerabilityLedger hardware wallets sold via CryptoBilis contain spy chip implants
Ledger Nano X hardware wallets distributed through Southeast Asian reseller CryptoBilis (Malaysia-based, operating across Southeast Asia). Compromised devices also sold via Amazon Japan and Yahoo! Auctions Japan by China-based sellers shipping from M…
criticalbug_reportVulnerabilityGitLab CE/EE critical RCE (CVE-2026-97229) allows unauthenticated code execution
GitLab Community Edition (CE) and Enterprise Edition (EE) self-managed instances: versions before 19.4.2, before 19.3.4, and before 19.2.8. The critical vulnerability CVE-2026-97229 (CVSS 10.0) affects the CI/CD regular expression compiler.
criticalbug_reportVulnerabilityGitLab CI/CD regex compiler RCE allows unauthenticated code execution
GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Self-managed instances are affected. GitLab.com and GitLab Dedicated are already patched.
criticalbug_reportVulnerabilitySonicWall SMA 1000 SSRF flaw (CVE-2026-102255) exploited 135 times
SonicWall Secure Mobile Access (SMA) 1000 appliances. Patched in versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix) released October 6, 2026. All prior versions vulnerable.
criticalbug_reportVulnerabilityBricksforge WordPress plugin RCE exploited in wild (CVE-2026-85097)
Bricksforge WordPress plugin versions up to and including 3.1.8.9. Patched in version 3.1.8.10 (latest version 4.0.1 recommended). Affects WordPress sites using Bricksforge with Bricks visual builder.
criticalbug_reportVulnerabilityCitrix NetScaler RCE vulnerability requires immediate patching
Citrix NetScaler (specific versions not disclosed in available data). Scope and affected product lines (ADC, Gateway, etc.) not specified in source material.
criticalbug_reportVulnerabilityPre-auth RCE in AnyDesk Linux grants root; exploit public, patch available
AnyDesk for Linux versions prior to 8.0.3 (specifically 8.0.2 confirmed vulnerable). Heap buffer overflow in session protocol on TCP port 7070. Windows and macOS not affected. Patched in version 8.0.3 (June 2024); current version is 8.1.0.
criticalbug_reportVulnerabilitySonicWall SMA1000 CVE-2026-102255 exploited 3 days after patch release
SonicWall SMA1000 models 6210, 7210, and 8200v. The vulnerability affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are NOT affected. Over 400 SMA1000 appliances exposed online per Shadowserver tracking.
criticalbug_reportVulnerabilityCitrix NetScaler RCE flaw (CVE-2026-107406) requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Provider (IdP) or Service Provider (SP). Vulnerable versions: NetScaler ADC/Gateway 14.1 prior to 14.1-73.46, 13.1 prior to 13.1-64.29; NetScaler ADC 14.1-FIPS prior to…
criticalbug_reportVulnerabilityFive critical RCE flaws in Cisco NX-OS allow root takeover of Nexus switches
Cisco Nexus 3000 and 9000 Series switches running NX-OS in standalone mode. Exploitation requires NX-API, Next Generation OAM (NGOAM), or MPLS OAM features to be enabled. Nexus 7000 and Nexus 9000 in ACI mode are not affected.
criticalbug_reportVulnerabilityHPE ClearPass Policy Manager RCE and admin access flaws require patching
HPE Networking ClearPass Policy Manager - specific affected versions not disclosed in available information. Product is a network access control (NAC) solution used for policy management and authentication.
criticalbug_reportVulnerabilityTensorlake npm package 0.5.144 compromised with Shai-Hulud worm
npm package "tensorlake" version 0.5.144 (TypeScript SDK for Tensorlake applications). Malicious version no longer available on npm registry. Affects users who installed this specific version, particularly those with access to CI/CD pipelines, cloud…
criticalbug_reportVulnerabilitySonicWall SMA1000 CVSS 10.0 pre-auth SSRF allows internal access
SonicWall SMA1000 appliances (models 6210, 7210, 8200v) running platform-hotfix versions 12.4.3-03526 and older, or 12.5.0-02952 and older. The critical flaw (CVE-2026-102255) affects the WorkPlace portal.
criticalbug_reportVulnerabilityCritical RCE in LMCache (CVE-2026-105192) allows unauthenticated code execution
LMCache versions 0.3.9 through 0.5.5 (including 0.5.6 release candidates and development branch) when multiprocess mode is configured with routable network addresses. Also affects vLLM deployments using LMCache multiprocess connector.
criticalbug_reportVulnerabilityHPE AOS-Switch auth bypass and buffer overflow require immediate patching
HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.
criticalbug_reportVulnerabilitySonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patching
SonicWall SMA1000 series appliances. Specific affected versions not provided in source material. Two vulnerabilities: pre-authentication SSRF and post-authentication RCE.
criticalbug_reportVulnerabilityAtlassian CVE-2026-21589 exploited in wild after PoC release
Self-hosted Atlassian Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated arbitrary file read vulnerability.
criticalbug_reportVulnerabilityAtlassian Data Center CVE-2026-21589 exploited within 2 hours of disclosure
Atlassian Data Center products: Bitbucket (versions before 9.4.26, 10.2.8, 10.5.1), Confluence (before 9.2.26, 10.2.19), Jira Service Management and Software (before 5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (before 10.2.24, 12.1.12), Crowd (before…
criticalbug_reportVulnerabilitySonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flaw
SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
criticalbug_reportVulnerabilityCritical file access flaw in Atlassian Data Center products requires patching
CVE-2026-21589 affects all versions of Atlassian Data Center products prior to fixed releases: Bitbucket (fix: 9.4.26, 10.2.8, 10.5.1), Confluence (9.2.26, 10.2.19), Jira Service Management and Software (5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (10…
criticalbug_reportVulnerabilityCritical unauthenticated path traversal in Atlassian products
Multiple Atlassian products: Bitbucket, Jira, Confluence, Bamboo, Crowd Data Centre, Crucible, and Fisheye. Specific vulnerable versions not provided in advisory. CVE identifier not yet assigned.