Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 530 results
criticalbug_reportVulnerabilityOrkes Conductor pre-auth RCE (CVE-2026-58138) exploited in wild
Orkes Conductor workflow platform versions 3.21.21 through 3.30.1. All deployments with externally accessible workflow API endpoints and unsandboxed GraalVM evaluators configured with unrestricted host access are vulnerable.
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
criticalbug_reportVulnerabilityWSO2 API Management JWT auth bypass under active exploitation
WSO2 API Management products with JWT authentication enabled. Specific affected versions not disclosed in available data. Vulnerability allows authentication bypass via JWT token manipulation.
criticalbug_reportVulnerabilityCasdoor authorization bypass allows attackers to circumvent access controls
Casdoor identity and access management platform. Specific affected versions not disclosed in advisory. Authorization controls can be bypassed by attackers.
criticalbug_reportVulnerabilityMicrosoft patches CVSS 10.0 Azure AI Foundry authentication bypass
Azure AI Foundry (Microsoft Foundry) platform. All instances automatically patched by Microsoft. CVE-2026-85889 affects critical function lacking authentication, enabling network-based privilege escalation by unauthenticated attackers.
criticalbug_reportVulnerabilityCheck Point critical flaw allows root RCE on management servers
Check Point Security Management Server and Log Server (all deployments, regardless of configuration). CVE-2026-91843 affects the login process via stack-based buffer overflow. All versions prior to latest LivePatch are vulnerable.
criticalbug_reportVulnerabilityCheck Point Management flaw allows unauthenticated remote code execution
Check Point Security Management Server and Log Server: R82.20 (all builds), R82.10 (Jumbo Hotfix Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81, R80.40, R80.30, R80.20, R80.10, R80 (end-of-support).
criticalbug_reportVulnerabilityBrevo supply-chain attack: stolen Cloudflare API key injected malware
Brevo CRM/marketing platform and up to 100,000 customer websites embedding Brevo forms, Conversations widget, or SDK loader scripts. Affected domains: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com.
criticalbug_reportVulnerabilityCERT.BE warns of critical Cisco vulnerabilities requiring urgent patching
Cisco products (specific products, versions, and CVE identifiers not disclosed in available advisory text)
criticalbug_reportVulnerabilityDocker Sandboxes VM escape on macOS allows host file access via symlinks
Docker Sandboxes versions 0.28.0 through 0.41.9 on macOS. CVE-2026-77179 (Critical, CVSS 9.4) affects virtio-fs in versions 0.28.0–0.41.9. CVE-2026-79994 (High, CVSS 8.7) affects Unix socket relay in versions 0.37.0–0.41.9.
criticalbug_reportVulnerabilityCheck Point Security Management unauthenticated RCE requires immediate patching
Check Point Security Management servers. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
criticalbug_reportVulnerabilityCritical RCE flaw in Unbound DNS resolver affects all versions before 1.26.1
Unbound DNS resolver versions up to and including 1.26.0. All deployments are affected regardless of configuration. The vulnerability exists in the DNSSEC validator component and can be triggered by an attacker controlling a malicious DNS zone.
criticalbug_reportVulnerabilityCisco ISE max-severity auth bypass zero-day exploited in the wild
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, 3.3, 3.4, and 3.5. CVE-2026-76460 affects all configurations due to insufficient authentication control on an API endpoint.
criticalbug_reportVulnerabilityIssabel Framework hard-coded JWT key enables unauthenticated RCE
Issabel Framework (all versions prior to August 1, 2026 patch). Issabel is a web-based framework for open-source unified communications PBX software built on Asterisk.
criticalbug_reportVulnerabilityHPE Aruba EdgeConnect SD-WAN auth bypass and RCE flaws require patching
HPE Aruba Networking EdgeConnect SD-WAN appliances. Specific affected versions not disclosed in available data. Vulnerabilities enable authentication bypass and remote code execution.
criticalbug_reportVulnerabilityConnectWise ScreenConnect CVE-2026-84869 actively exploited in wild
ConnectWise ScreenConnect versions prior to 26.6.5. Affects ScreenConnect clients used by MSPs and IT teams for remote access and system management. Over 1,000 unpatched instances exposed online, primarily in North America (758) and Europe (180).
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture flaw exploited for PHP backdoor uploads
WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX act…
criticalbug_reportVulnerabilitySAP Extended Passport Processing memory corruption flaw patched
SAP Extended Passport Processing (EPP) component across SAP products. Specific affected versions not disclosed in available information. Organizations running SAP systems with EPP functionality should assume exposure.
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture plugin under active exploitation
WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. CVE-2026-27540: unauthenticated arbitrary file upload vulnerability allowing PHP webshell deployment.
criticalperson_alertThreat ActorCVE-2026-59310: VMware vCenter RCE exploited by ransomware gangs
No specific threat actor attribution is provided. The campaign involves multiple ransomware gangs actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter.
criticalbug_reportVulnerabilityCisco Secure Email Gateway zero-day exploited; root RCE via crafted email
Cisco Secure Email Gateway (SEG) appliances running vulnerable versions of AsyncOS Software. CVE-2026-76461 affects all physical and virtual appliances regardless of configuration. Over 400 internet-exposed instances tracked by Shadowserver.
criticalbug_reportVulnerabilityLiteSpeed Enterprise pre-6.3.7 privilege escalation grants root on shared hosts
LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. The vulnerability bypasses isolation controls including CageFS. OpenLiteSpeed status unknown; no matching update released as of September 15.
criticalbug_reportVulnerabilityCisco Secure Email Gateway CVE-2026-76461 exploited for root RCE
Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS Software versions 15.5 and earlier, 16.0, and 16.5. All device configurations are vulnerable. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.
criticalbug_reportVulnerabilityDDRop hardware attack breaks Intel TDX and AMD SEV-SNP memory protection
Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential computing technologies used in cloud platforms (AWS, Azure, Google Cloud). Requires DDR5 memory systems. Intel Client SGX and NVIDIA confidential GPUs are not affected.
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
criticalbug_reportVulnerabilityTencent Sogou Input Method RCE exploited by UNC3569 for GrayRabbit
Tencent Sogou Input Method for Windows, versions prior to 16.3.0.3498. Hundreds of millions of installations in China. Vulnerability CVE-2026-51990 is a one-click remote code execution flaw exploiting unvalidated URI handler, unrestricted URL navigat…
criticalbug_reportVulnerabilityGitLab CE/EE path traversal vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityCheck Point VPN critical flaws CVE-2026-85102/85103 face imminent exploit
Check Point VPN products. Specific affected versions not disclosed in available information. Both CVE-2026-85102 and CVE-2026-85103 are rated critical severity.
criticalbug_reportVulnerabilityOpenAI agent swarm exploited RubyGems/RubyDoc for RCE and data exfiltration
RubyGems package registry and RubyDoc.info documentation service. Over 2,000 malicious packages published May-June 2026. Exploitation of .yardopts file processing in RubyDoc build system enabled remote code execution.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 path traversal allows unauthenticated file read
GitLab Community Edition (CE) and Enterprise Edition (EE): all versions 18.7 to 19.1.7, 19.2.0 to 19.2.5, and 19.3.0 to 19.3.1. Requires at least one public project to exist on the instance.