Curated Cyber Threat Intelligence

Threat Feed

Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.

scheduleUpdated 2026-10-28 · 04:17 UTC
articleTotal: 1890 reports

Filtered Reports

30 / 541 results
Active filter:tag: #critical✕ clear
GitLab CE/EE critical RCE (CVE-2026-97229) allows unauthenticated code executioncriticalbug_reportVulnerability
bug_reportVulnerability

GitLab CE/EE critical RCE (CVE-2026-97229) allows unauthenticated code execution

GitLab Community Edition (CE) and Enterprise Edition (EE) self-managed instances: versions before 19.4.2, before 19.3.4, and before 19.2.8. The critical vulnerability CVE-2026-97229 (CVSS 10.0) affects the CI/CD regular expression compiler.

GitLab12 Oct · 12:57 UTC
GitLab CI/CD regex compiler RCE allows unauthenticated code executioncriticalbug_reportVulnerability
bug_reportVulnerability

GitLab CI/CD regex compiler RCE allows unauthenticated code execution

GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Self-managed instances are affected. GitLab.com and GitLab Dedicated are already patched.

GitLab12 Oct · 11:09 UTC
SonicWall SMA 1000 SSRF flaw (CVE-2026-102255) exploited 135 timescriticalbug_reportVulnerability
bug_reportVulnerability

SonicWall SMA 1000 SSRF flaw (CVE-2026-102255) exploited 135 times

SonicWall Secure Mobile Access (SMA) 1000 appliances. Patched in versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix) released October 6, 2026. All prior versions vulnerable.

CVE-2026-10225512 Oct · 08:36 UTC
Bricksforge WordPress plugin RCE exploited in wild (CVE-2026-85097)criticalbug_reportVulnerability
bug_reportVulnerability

Bricksforge WordPress plugin RCE exploited in wild (CVE-2026-85097)

Bricksforge WordPress plugin versions up to and including 3.1.8.9. Patched in version 3.1.8.10 (latest version 4.0.1 recommended). Affects WordPress sites using Bricksforge with Bricks visual builder.

CVE-2026-8509712 Oct · 07:02 UTC
Citrix NetScaler RCE vulnerability requires immediate patchingcriticalbug_reportVulnerability
bug_reportVulnerability

Citrix NetScaler RCE vulnerability requires immediate patching

Citrix NetScaler (specific versions not disclosed in available data). Scope and affected product lines (ADC, Gateway, etc.) not specified in source material.

Citrix9 Oct · 13:01 UTC
Pre-auth RCE in AnyDesk Linux grants root; exploit public, patch availablecriticalbug_reportVulnerability
bug_reportVulnerability

Pre-auth RCE in AnyDesk Linux grants root; exploit public, patch available

AnyDesk for Linux versions prior to 8.0.3 (specifically 8.0.2 confirmed vulnerable). Heap buffer overflow in session protocol on TCP port 7070. Windows and macOS not affected. Patched in version 8.0.3 (June 2024); current version is 8.1.0.

AnyDesk9 Oct · 10:59 UTC
SonicWall SMA1000 CVE-2026-102255 exploited 3 days after patch releasecriticalbug_reportVulnerability
bug_reportVulnerability

SonicWall SMA1000 CVE-2026-102255 exploited 3 days after patch release

SonicWall SMA1000 models 6210, 7210, and 8200v. The vulnerability affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are NOT affected. Over 400 SMA1000 appliances exposed online per Shadowserver tracking.

CVE-2026-1022559 Oct · 10:32 UTC
Citrix NetScaler RCE flaw (CVE-2026-107406) requires immediate patchingcriticalbug_reportVulnerability
bug_reportVulnerability

Citrix NetScaler RCE flaw (CVE-2026-107406) requires immediate patching

Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Provider (IdP) or Service Provider (SP). Vulnerable versions: NetScaler ADC/Gateway 14.1 prior to 14.1-73.46, 13.1 prior to 13.1-64.29; NetScaler ADC 14.1-FIPS prior to…

Citrix9 Oct · 06:27 UTC
Five critical RCE flaws in Cisco NX-OS allow root takeover of Nexus switchescriticalbug_reportVulnerability
bug_reportVulnerability

Five critical RCE flaws in Cisco NX-OS allow root takeover of Nexus switches

Cisco Nexus 3000 and 9000 Series switches running NX-OS in standalone mode. Exploitation requires NX-API, Next Generation OAM (NGOAM), or MPLS OAM features to be enabled. Nexus 7000 and Nexus 9000 in ACI mode are not affected.

Cisco8 Oct · 13:26 UTC
HPE ClearPass Policy Manager RCE and admin access flaws require patchingcriticalbug_reportVulnerability
bug_reportVulnerability

HPE ClearPass Policy Manager RCE and admin access flaws require patching

HPE Networking ClearPass Policy Manager - specific affected versions not disclosed in available information. Product is a network access control (NAC) solution used for policy management and authentication.

HPE8 Oct · 06:12 UTC
Tensorlake npm package 0.5.144 compromised with Shai-Hulud wormcriticalbug_reportVulnerability
bug_reportVulnerability

Tensorlake npm package 0.5.144 compromised with Shai-Hulud worm

npm package "tensorlake" version 0.5.144 (TypeScript SDK for Tensorlake applications). Malicious version no longer available on npm registry. Affects users who installed this specific version, particularly those with access to CI/CD pipelines, cloud…

Tensorlake8 Oct · 03:46 UTC
SonicWall SMA1000 CVSS 10.0 pre-auth SSRF allows internal accesscriticalbug_reportVulnerability
bug_reportVulnerability

SonicWall SMA1000 CVSS 10.0 pre-auth SSRF allows internal access

SonicWall SMA1000 appliances (models 6210, 7210, 8200v) running platform-hotfix versions 12.4.3-03526 and older, or 12.5.0-02952 and older. The critical flaw (CVE-2026-102255) affects the WorkPlace portal.

SonicWall7 Oct · 14:17 UTC
Critical RCE in LMCache (CVE-2026-105192) allows unauthenticated code executioncriticalbug_reportVulnerability
bug_reportVulnerability

Critical RCE in LMCache (CVE-2026-105192) allows unauthenticated code execution

LMCache versions 0.3.9 through 0.5.5 (including 0.5.6 release candidates and development branch) when multiprocess mode is configured with routable network addresses. Also affects vLLM deployments using LMCache multiprocess connector.

LMCache7 Oct · 13:34 UTC
HPE AOS-Switch auth bypass and buffer overflow require immediate patchingcriticalbug_reportVulnerability
bug_reportVulnerability

HPE AOS-Switch auth bypass and buffer overflow require immediate patching

HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.

HPE7 Oct · 12:46 UTC
SonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patchingcriticalbug_reportVulnerability
bug_reportVulnerability

SonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patching

SonicWall SMA1000 series appliances. Specific affected versions not provided in source material. Two vulnerabilities: pre-authentication SSRF and post-authentication RCE.

SonicWall7 Oct · 12:14 UTC
Atlassian CVE-2026-21589 exploited in wild after PoC releasecriticalbug_reportVulnerability
bug_reportVulnerability

Atlassian CVE-2026-21589 exploited in wild after PoC release

Self-hosted Atlassian Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated arbitrary file read vulnerability.

CVE-2026-215897 Oct · 10:49 UTC
Atlassian Data Center CVE-2026-21589 exploited within 2 hours of disclosurecriticalbug_reportVulnerability
bug_reportVulnerability

Atlassian Data Center CVE-2026-21589 exploited within 2 hours of disclosure

Atlassian Data Center products: Bitbucket (versions before 9.4.26, 10.2.8, 10.5.1), Confluence (before 9.2.26, 10.2.19), Jira Service Management and Software (before 5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (before 10.2.24, 12.1.12), Crowd (before…

CVE-2026-215897 Oct · 09:49 UTC
SonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flawcriticalbug_reportVulnerability
bug_reportVulnerability

SonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flaw

SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.

SonicWall7 Oct · 09:37 UTC
Critical file access flaw in Atlassian Data Center products requires patchingcriticalbug_reportVulnerability
bug_reportVulnerability

Critical file access flaw in Atlassian Data Center products requires patching

CVE-2026-21589 affects all versions of Atlassian Data Center products prior to fixed releases: Bitbucket (fix: 9.4.26, 10.2.8, 10.5.1), Confluence (9.2.26, 10.2.19), Jira Service Management and Software (5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (10…

Atlassian7 Oct · 07:52 UTC
Critical unauthenticated path traversal in Atlassian productscriticalbug_reportVulnerability
bug_reportVulnerability

Critical unauthenticated path traversal in Atlassian products

Multiple Atlassian products: Bitbucket, Jira, Confluence, Bamboo, Crowd Data Centre, Crucible, and Fisheye. Specific vulnerable versions not provided in advisory. CVE identifier not yet assigned.

Atlassian7 Oct · 05:15 UTC
Citrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patchcriticalbug_reportVulnerability
bug_reportVulnerability

Citrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patch

Citrix Netscaler ADC, Netscaler Gateway, and Netscaler FIPS appliances. Specific affected versions not provided in advisory; consult Citrix security bulletin for version details.

Citrix7 Oct · 05:08 UTC
Critical file-access flaw in Atlassian Data Center products (self-hosted)criticalbug_reportVulnerability
bug_reportVulnerability

Critical file-access flaw in Atlassian Data Center products (self-hosted)

Atlassian self-hosted Data Center products: Confluence (< 9.2.26, 10.2.19), Jira Software/Service Management (< 9.12.40, 10.3.26, 11.3.12), Bitbucket (< 9.4.26, 10.2.8, 10.5.1), Bamboo (< 10.2.24, 12.1.12), Crowd (< 6.3.7, 7.0.3, 7.1.7, 7.2.4), Cruci…

CVE-2026-215896 Oct · 15:34 UTC
Atlassian path traversal flaw (CVE-2026-21589) exposes files in 8 productscriticalbug_reportVulnerability
bug_reportVulnerability

Atlassian path traversal flaw (CVE-2026-21589) exposes files in 8 products

8 Atlassian Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. All versions prior to fixed releases (e.g., Confluence <9.2.26/10.2.19, Jira Software <9.12.40/10.3.26/11.3.12).

CVE-2026-215896 Oct · 04:58 UTC
Denmark CPR breach exposes 8.8M records via compromised company credentialscriticalpublicGeopolitical
publicGeopolitical

Denmark CPR breach exposes 8.8M records via compromised company credentials

The breach of Denmark's Central Person Register (CPR) represents a significant compromise of national identity infrastructure in a NATO member state and key Nordic country.

The Hacker News6 Oct · 04:00 UTC
Rejetto HFS weak signing key flaw (CVE-2026-61500) actively scannedcriticalbug_reportVulnerability
bug_reportVulnerability

Rejetto HFS weak signing key flaw (CVE-2026-61500) actively scanned

Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 on Windows, Linux, and macOS. Fixed in version 3.2.1; latest stable is 3.3.4.

CVE-2026-615005 Oct · 18:20 UTC
Denmark's national population registry breached, 8.8M records exposedcriticalpublicGeopolitical
publicGeopolitical

Denmark's national population registry breached, 8.8M records exposed

The breach of Denmark's Central Population Register represents a compromise of critical national infrastructure affecting approximately 80% of all registered individuals in the country's civil registry system.

BleepingComputer5 Oct · 13:21 UTC
Dell System Update path traversal flaw allows unauthenticated root RCEcriticalbug_reportVulnerability
bug_reportVulnerability

Dell System Update path traversal flaw allows unauthenticated root RCE

Dell System Update (DSU) CLI deployment tool, versions prior to 2.3.0.0. Used on PowerEdge enterprise servers running Linux and Windows for BIOS, firmware, and software updates.

Dell5 Oct · 12:53 UTC
Rejetto HFS session forgery flaw under active exploitation for RCEcriticalbug_reportVulnerability
bug_reportVulnerability

Rejetto HFS session forgery flaw under active exploitation for RCE

Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. Version 3.2.1 (released July 2026) contains the patch. All unpatched instances exposed to the internet are at risk.

CVE-2026-615005 Oct · 06:09 UTC
Citrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspectedcriticalbug_reportVulnerability
bug_reportVulnerability

Citrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspected

Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS).

CVE-2026-887794 Oct · 19:58 UTC
Warlock exploits SharePoint flaws to deploy ransomware in Iberiacriticalperson_alertThreat Actor
person_alertThreat Actor

Warlock exploits SharePoint flaws to deploy ransomware in Iberia

Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…

Microsoft3 Oct · 12:36 UTC