Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1048 results
criticalbug_reportVulnerabilityGitLab AI Gateway RCE flaw (CVE-2026-90970) affects self-hosted instances
GitLab AI Gateway versions 18.1.6 through 19.4.0 on self-hosted deployments. Authenticated users with Duo Agent Platform access can exploit. GitLab.com, GitLab Dedicated, and self-managed instances using GitLab-hosted gateways are NOT affected.
criticalbug_reportVulnerabilityDell CSM critical flaws allow unauthenticated admin access on Kubernetes
Dell Container Storage Modules (CSM) all versions prior to 1.17.0. Fixed in version 1.18.0. Affects csm-authorization-storage gRPC server, authorization proxy, tenant service, ContainerStorageModule Custom Resource reconciler, CSM Authorization modul…
criticalbug_reportVulnerabilityGitLab AI Gateway critical RCE allows arbitrary command execution
GitLab AI Gateway service. Specific affected versions not disclosed in available information. Impacts organizations running GitLab instances with AI Gateway enabled.
criticalbug_reportVulnerabilityDell CSM Authorization flaws allow unauthenticated admin takeover
Dell Container Storage Modules (CSM) Authorization module, versions prior to 1.18.0. Affects environments integrating Dell PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT storage arrays with Kubernetes.
criticalbug_reportVulnerabilityFortiMail vulnerability under active exploitation, immediate patching required
Fortinet FortiMail email security appliances. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or not publicly disclosed.
criticalbug_reportVulnerabilityFortinet FortiMail zero-day CVE-2026-104286 exploited for file writes
Fortinet FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Unauthenticated remote attackers can write arbitrary files via path traversal and null byte injection flaws in HTTP/HTTPS handlers.
criticalbug_reportVulnerabilityFortinet FortiMail critical RCE (CVE-2026-104286) exploited in the wild
Fortinet FortiMail appliances. Specific affected versions not disclosed in available information. Vulnerability enables remote code execution or command execution on vulnerable devices.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day exploited in Finland before patches released
Citrix NetScaler ADC and Gateway versions 13.1 and 14.1 (including FIPS and NDcPP variants) released before September 27, 2026 patches. Internet-facing instances at highest risk.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack in Finland
Citrix NetScaler ADC and NetScaler Gateway (all unpatched versions). Eight CVEs (CVE-2026-88771 through CVE-2026-88778) with CVSS 4.0 scores 7.0–9.5 (High to Critical).
criticalbug_reportVulnerabilityKiteworks patches critical code injection flaw in Email Protection Gateway
Kiteworks Email Protection Gateway (EPG) all versions before 9.4.1. EPG is part of the Kiteworks Private Content Network used by thousands of global corporations and government agencies with over 100 million end-users.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass under active exploitation
Cisco Catalyst SD-WAN Manager (specific versions not disclosed in source). Vulnerability allows unauthenticated remote attackers to gain administrative API access.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager auth bypass exploited in the wild
Cisco Catalyst SD-WAN Manager, all vulnerable versions prior to patched releases. The vulnerability (CVE-2026-76504) affects the API authentication mechanism due to improper URI encoding handling in HTTP requests.
criticalbug_reportVulnerabilityWatchGuard Fireware OS critical RCE flaw requires immediate patching
WatchGuard Fireware OS - specific versions not disclosed in available data. Affects WatchGuard firewall appliances running vulnerable Fireware OS versions.
highbug_reportVulnerabilityApple CoreGraphics CVE-2026-86950 PoC published; in-the-wild use reported
Apple CoreGraphics on iOS versions before iOS 27 and macOS Golden Gate 27. Vulnerability triggered via malicious PDF with crafted embedded TrueType font.
criticalbug_reportVulnerabilityBitget confirms zero-day in third-party security product led to $387M theft
Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia.
highbug_reportVulnerabilityZammad zero-days CVE-2026-102489/102490 exploited in AI-driven breach
Zammad open-source ticketing system, all versions prior to version 7. Both self-hosted and hosted deployments affected. Over 2,000 customers and 55,000 users globally, including enterprise and nonprofit organizations.
highbug_reportVulnerabilityZimbra CVE-2026-73570 exploited to deploy web shells, steal credentials
Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. Exploitation requires SNMP notifications enabled and the optional zimbra-snmp package installed. Unauthenticated remote code execution via crafted SMTP requests.
highbug_reportVulnerabilityPhishing campaign abuses legitimate MSP360 RMM to deploy ScreenConnect
Organizations using Windows endpoints. Attackers distribute legitimate MSP360 RMM v2.5.0.67 installer via phishing emails with deceptive filenames (meeting invites, PDF readers, Zoom installers). ScreenConnect deployed as secondary RMM.
criticalbug_reportVulnerabilityCritical pre-auth RCE in MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24. Vulnerability exists in web management service HTTP request handling. Widely deployed in critical infrastructure and enterprise networks.
criticalbug_reportVulnerabilityCisco SD-WAN Manager zero-day exploited: auth bypass grants admin API access
Cisco Catalyst SD-WAN Manager, all configurations. Affected versions: all releases prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Releases earlier than 20.9 require migration.
criticalbug_reportVulnerabilityCisco Catalyst SD-WAN Manager zero-day exploited for admin escalation
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration.
highbug_reportVulnerabilityZimbra CVE-2026-73570: Unauthenticated RCE exploited in the wild
Zimbra Collaboration Suite versions prior to 10.1.20, when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Internet-facing mail servers are at risk. Exploitation requires no authentication or user interaction.
highbug_reportVulnerabilityTeamViewer patches RCE and privilege escalation flaws in client software
TeamViewer Full Client and Host software for Windows, Linux, and macOS. Vulnerabilities resolved in version 15.82 and supported maintenance/legacy releases.
criticalbug_reportVulnerabilityBitget crypto exchange breached via zero-day in security appliances
Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities.
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
highbug_reportVulnerabilityOpenSSL DTLS flaw leaks heap memory, crashes programs (CVE-2026-84782)
OpenSSL versions 4.0 (before 4.0.3), 3.6 (before 3.6.5), 3.5 (before 3.5.9), 3.4 (before 3.4.8), 3.0, 1.1.1, and 1.0.2. Only affects software using OpenSSL for DTLS connections (e.g., WebRTC, VoIP).
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772: Pre-auth RCE via DTLS overflow exploited
Citrix NetScaler ADC and NetScaler Gateway (vulnerable versions not specified in advisory). Affects the NetScaler Packet Processing Engine (NSPPE) DTLS protocol handler. Pre-authentication attack surface.
highbug_reportVulnerabilityPhishing campaign abuses MSP360 RMM and ScreenConnect for persistent access
Organizations across multiple industries targeted via phishing. Legitimate MSP360 RMM v2.5.0.67 installer abused to deploy ConnectWise ScreenConnect, creating redundant remote-access channels.
highbug_reportVulnerabilityMalicious custom ChatGPTs in Google ads deliver RAT via ClickFix attacks
Users searching for ChatGPT via Google Search who click sponsored results. Campaign leverages OpenAI's custom GPT feature (retiring December 11, 2026) and Google Sites infrastructure.
criticalbug_reportVulnerabilityCritical XSS vulnerability in Rancher Kubernetes platform requires patching
Rancher Kubernetes management platform. Specific affected versions not disclosed in available information.