Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1048 results
criticalbug_reportVulnerabilityCritical RCE in LMCache (CVE-2026-105192) allows unauthenticated code execution
LMCache versions 0.3.9 through 0.5.5 (including 0.5.6 release candidates and development branch) when multiprocess mode is configured with routable network addresses. Also affects vLLM deployments using LMCache multiprocess connector.
highbug_reportVulnerabilityPoeLLM botnet compromises 3,400+ AI servers for cryptomining
Exposed AI services including LiteLLM, Ollama, Gotenberg PDF converter, Gitea development toolkit, and Ivanti Sentry. Over 3,400 servers compromised globally, primarily in the United States and Western Europe.
criticalbug_reportVulnerabilityHPE AOS-Switch auth bypass and buffer overflow require immediate patching
HPE Networking AOS-Switch (AOS-S) products. Specific affected versions not provided in source material. Vulnerabilities enable authentication bypass and buffer overflow leading to unauthorized access and arbitrary code execution.
criticalbug_reportVulnerabilitySonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patching
SonicWall SMA1000 series appliances. Specific affected versions not provided in source material. Two vulnerabilities: pre-authentication SSRF and post-authentication RCE.
criticalbug_reportVulnerabilityAtlassian CVE-2026-21589 exploited in wild after PoC release
Self-hosted Atlassian Data Center products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Unauthenticated arbitrary file read vulnerability.
highbug_reportVulnerabilityFBI warns FortiBleed campaign actively harvesting Fortinet credentials
Internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. All versions using legacy SHA-256 password storage are vulnerable. Over 86,644 device credentials compromised across 194 countries as of June 2026.
criticalbug_reportVulnerabilityAtlassian Data Center CVE-2026-21589 exploited within 2 hours of disclosure
Atlassian Data Center products: Bitbucket (versions before 9.4.26, 10.2.8, 10.5.1), Confluence (before 9.2.26, 10.2.19), Jira Service Management and Software (before 5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (before 10.2.24, 12.1.12), Crowd (before…
criticalbug_reportVulnerabilitySonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flaw
SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
criticalbug_reportVulnerabilityCritical file access flaw in Atlassian Data Center products requires patching
CVE-2026-21589 affects all versions of Atlassian Data Center products prior to fixed releases: Bitbucket (fix: 9.4.26, 10.2.8, 10.5.1), Confluence (9.2.26, 10.2.19), Jira Service Management and Software (5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (10…
criticalbug_reportVulnerabilityCritical unauthenticated path traversal in Atlassian products
Multiple Atlassian products: Bitbucket, Jira, Confluence, Bamboo, Crowd Data Centre, Crucible, and Fisheye. Specific vulnerable versions not provided in advisory. CVE identifier not yet assigned.
criticalbug_reportVulnerabilityCitrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patch
Citrix Netscaler ADC, Netscaler Gateway, and Netscaler FIPS appliances. Specific affected versions not provided in advisory; consult Citrix security bulletin for version details.
highbug_reportVulnerabilityNinja Forms and WPC Product Bundles XSS flaws under active exploit
Ninja Forms plugin versions 3.15.3 and older (500,000+ sites); WPC Product Bundles for WooCommerce versions 8.6.6 and older (30,000+ sites). Tracked as CVE-2026-93836 and CVE-2026-94504. Both are authenticated stored XSS vulnerabilities.
highbug_reportVulnerability32 zero-days exploited at Pwn2Own Ireland 2026, Samsung Galaxy S26 hacked
Samsung Galaxy S26, Philips Hue Bridge Pro, Oracle Autonomous AI Database, LiteLLM, Lexmark CX532adwe, Canon imageFORCE 1643F, OpenAI Codex, Sonos Era 300. Multiple zero-day vulnerabilities demonstrated in controlled competition environment.
highbug_reportVulnerabilityLinux backdoors mimic email security tools to target telecom in Korea, Taiwan
Telecom and network appliances in South Korea and Taiwan. Specific targets: systems running SpamSniper (Korean email security), ShareTech appliances, and Oracle-backed telecom platforms.
criticalbug_reportVulnerabilityCritical file-access flaw in Atlassian Data Center products (self-hosted)
Atlassian self-hosted Data Center products: Confluence (< 9.2.26, 10.2.19), Jira Software/Service Management (< 9.12.40, 10.3.26, 11.3.12), Bitbucket (< 9.4.26, 10.2.8, 10.5.1), Bamboo (< 10.2.24, 12.1.12), Crowd (< 6.3.7, 7.0.3, 7.1.7, 7.2.4), Cruci…
highbug_reportVulnerabilityFake AI sites use browser-in-browser attacks to steal ad account MFA
Advertising account managers, media buyers, and agency staff using Google, Meta, TikTok, and Okta authentication. Campaign uses fake ChatGPT, Gemini, Claude, and Perplexity sites hosted on Vercel/Railway/Render infrastructure.
highbug_reportVulnerabilityLibreOffice and OpenOffice flaws enable code execution via spreadsheets
LibreOffice versions before 26.2.5 and 26.8.0 (CVE-2026-63277, patched). Apache OpenOffice all versions up to and including 4.1.16 (CVE-2026-59265, unpatched). Attack requires Java support enabled in application settings.
highbug_reportVulnerabilityCritical security gaps found in 15,465 public MCP servers for AI agents
Anthropic's Model Context Protocol (MCP) ecosystem: 15,465 publicly indexed MCP servers across 5 registries (deduplicated to 5,095 unique hostnames). Affects enterprises using MCP servers to connect AI agents, models, and IDEs to tools and data.
criticalbug_reportVulnerabilityAtlassian path traversal flaw (CVE-2026-21589) exposes files in 8 products
8 Atlassian Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. All versions prior to fixed releases (e.g., Confluence <9.2.26/10.2.19, Jira Software <9.12.40/10.3.26/11.3.12).
highbug_reportVulnerabilityClickFix attacks evolve with browser cache smuggling to bypass Run limits
Windows systems with Firefox and other browsers; users targeted via compromised websites and phishing lures. No specific product vulnerability—relies on social engineering to execute cached VBScript payloads that deploy credential-stealing .NET assem…
criticalbug_reportVulnerabilityRejetto HFS weak signing key flaw (CVE-2026-61500) actively scanned
Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 on Windows, Linux, and macOS. Fixed in version 3.2.1; latest stable is 3.3.4.
highbug_reportVulnerabilityMicrosoft Exchange privilege escalation allows mailbox access (CVE-2026-96940)
Microsoft Exchange Server on-premises: Subscription Edition RTM, Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15. Exchange Online already patched server-side; no customer action required.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway DoS flaw requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway (specific versions not disclosed in available data). Remote attackers can trigger denial of service conditions.
criticalbug_reportVulnerabilityDell System Update path traversal flaw allows unauthenticated root RCE
Dell System Update (DSU) CLI deployment tool, versions prior to 2.3.0.0. Used on PowerEdge enterprise servers running Linux and Windows for BIOS, firmware, and software updates.
highbug_reportVulnerabilityCling botnet exploits Realtek SDK flaw, uses STUN for covert C2
Realtek Jungle SDK (CVE-2021-35394, CVSS 9.8). Also targets routers and DVRs from Realtek, Eir, MVPower, LB-LINK, FiberHome, China Mobile, TBK, Linksys, Linear, D-Link, Sunhillo, Tenda, and Hytec via 20+ CVEs spanning 2014-2025.
highbug_reportVulnerabilityMISP TOTP flaw allows duplicate 2FA codes within validity window
MISP (Malware Information Sharing Platform) - specific vulnerable versions not disclosed in advisory. Affects instances using TOTP-based two-factor authentication.
highbug_reportVulnerabilityApache HTTP Server vulnerabilities require immediate patching
Apache HTTP Server - specific versions not provided in advisory. All organizations running Apache HTTP Server should verify their version against latest security bulletins.
criticalbug_reportVulnerabilityRejetto HFS session forgery flaw under active exploitation for RCE
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. Version 3.2.1 (released July 2026) contains the patch. All unpatched instances exposed to the internet are at risk.
highbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88779 exploited in SAML attacks
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.
criticalbug_reportVulnerabilityCitrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspected
Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS).