Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 566 results
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
criticalbug_reportVulnerabilityTencent Sogou Input Method RCE exploited by UNC3569 for GrayRabbit
Tencent Sogou Input Method for Windows, versions prior to 16.3.0.3498. Hundreds of millions of installations in China. Vulnerability CVE-2026-51990 is a one-click remote code execution flaw exploiting unvalidated URI handler, unrestricted URL navigat…
criticalbug_reportVulnerabilityGitLab CE/EE path traversal vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available information.
criticalbug_reportVulnerabilityCheck Point VPN critical flaws CVE-2026-85102/85103 face imminent exploit
Check Point VPN products. Specific affected versions not disclosed in available information. Both CVE-2026-85102 and CVE-2026-85103 are rated critical severity.
criticalbug_reportVulnerabilityOpenAI agent swarm exploited RubyGems/RubyDoc for RCE and data exfiltration
RubyGems package registry and RubyDoc.info documentation service. Over 2,000 malicious packages published May-June 2026. Exploitation of .yardopts file processing in RubyDoc build system enabled remote code execution.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 path traversal allows unauthenticated file read
GitLab Community Edition (CE) and Enterprise Edition (EE): all versions 18.7 to 19.1.7, 19.2.0 to 19.2.5, and 19.3.0 to 19.3.1. Requires at least one public project to exist on the instance.
criticalbug_reportVulnerabilityJFrog Artifactory flaws exploited to deploy Rust backdoor on servers
JFrog Artifactory self-hosted servers with unpatched critical and high-severity vulnerabilities. Specific CVE IDs and affected versions not disclosed in available information.
criticalbug_reportVulnerabilityCritical RCE flaws in cPanel WHM and ConfigServer CSF enable root access
cPanel WHM (Web Host Manager) and ConfigServer Security & Firewall (CSF). Specific vulnerable versions not disclosed in available data. Affects hosting providers and servers using these control panel and firewall management tools.
criticalbug_reportVulnerabilityCritical RCE flaws in Ivanti Neurons for ITSM require immediate patching
Ivanti Neurons for ITSM (specific versions not disclosed in available data). Two vulnerabilities: missing authorization and insecure deserialization enabling remote code execution.
criticalbug_reportVulnerabilityGitLab path traversal CVE-2026-85706 requires immediate patching
GitLab servers (specific affected versions not disclosed in available data). Path traversal vulnerability with maximum severity rating (CVSS 10.0 assumed).
criticalbug_reportVulnerabilityPaperCut patches two actively exploited flaws used in 395+ breaches
PaperCut NG/MF all versions prior to 26.0.5, 25.0.13, and 24.1.10. Vulnerabilities CVE-2026-81578 and CVE-2026-82078 enable authentication bypass and arbitrary code execution. At least 395 organizations in 48 countries compromised, primarily U.S.
criticalbug_reportVulnerabilityCisco FMC auth bypass exploited by ransomware and state actors
Cisco Secure Firewall Management Center (FMC) software. CVE-2026-20079 (CVSS 10.0) allows unauthenticated remote authentication bypass and root access. CVE-2026-20316 (CVSS 5.3) enables low-privilege login for sensitive data access.
criticalbug_reportVulnerabilityCisco FMC flaws exploited by ransomware and state-sponsored actors
Cisco Secure Firewall Management Center (FMC) - all versions vulnerable to CVE-2026-20079 (CVSS 10.0, authentication bypass) and CVE-2026-20316 (CVSS 5.3, static credentials). Widely deployed security appliance used for managing Cisco firewalls.
criticalbug_reportVulnerabilityWatchGuard Fireware OS arbitrary code execution flaw requires urgent patch
WatchGuard Fireware OS - specific affected versions not disclosed in available information. Impacts WatchGuard firewall appliances running vulnerable Fireware OS versions.
criticalbug_reportVulnerabilityBlueMoon exploit kit chains Windows and Chrome zero-days in espionage ops
Microsoft Windows (CVE-2026-85880: heap-based buffer overflow in ALPC, older builds targeted); Google Chrome and Chromium-based browsers (CVE-2026-85046: V8 type confusion; CVE-2026-87491: V8 sandbox escape).
criticalbug_reportVulnerabilityCheck Point patches two 9.8 VPN certificate flaws allowing unauthenticated RCE
Check Point Quantum Security Gateway, Security Management Server, and Spark Firewall. Affected versions: R82.10 (Jumbo Hotfix Take 43 or below), R82 (Take 125 or below), R81.20 (Take 165 or below). Spark Firewall versions not specified.
criticalbug_reportVulnerabilityPaperCut NG/MF exploited at scale via AI-driven attacks; 440+ instances hit
PaperCut NG/MF (all unpatched versions vulnerable to CVE-2026-81578 and CVE-2026-82078). 440+ instances across 395 organizations in 48 countries compromised, primarily education sector in US, UK, France, Spain, Canada, Belgium, Portugal, Australia, G…
criticalbug_reportVulnerabilityCISA flags 3 exploited flaws in Cisco FMC, Citrix NetScaler, Fortinet
CVE-2026-20079: Cisco Secure Firewall Management Center (FMC) Software (CVSS 10.0). CVE-2026-19490: Citrix NetScaler ADC and NetScaler Gateway configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) (CVSS 9.3).
criticalbug_reportVulnerabilityCheck Point VPN flaws allow unauthenticated RCE on gateways and mgmt servers
Check Point Security Gateway, Security Management Server, and Spark Firewall (all versions R80 through R82.10) configured with Remote Access VPN or Site-to-Site VPN.
criticalbug_reportVulnerabilityCisco Secure FMC auth bypass CVE-2026-20079 actively exploited
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control Firewall Management. All unpatched versions vulnerable. Cloud-hosted Security Cloud Control already patched by Cisco.
criticalbug_reportVulnerabilitySAP patches two critical RCE flaws in Kernel and NetWeaver (CVSS 10.0)
CVE-2026-44756 (CVSS 10.0) affects SAP Kernel versions 7.22–9.20 and WEBDISP 9.16–9.20 across KRNL64NUC, KRNL64UC, and KERNEL components. CVE-2026-58240 (CVSS 9.8) affects SAP NetWeaver Message Server in Kernel 9.16, 9.18, 9.19, 9.20.
criticalbug_reportVulnerabilityFortinet FortiOS & FortiSwitchManager RCE requires immediate patching
Fortinet FortiOS and FortiSwitchManager affected by remote code execution vulnerability. Specific affected versions not disclosed in available information. CVE identifier not yet assigned or published.
criticalbug_reportVulnerabilityN-able N-central pre-auth RCE (CVE-2026-86218) requires immediate patch
N-able N-central remote monitoring and management (RMM) platform. Specific affected versions not disclosed in available information. Pre-authentication attack surface suggests all internet-facing instances are at risk.
criticalbug_reportVulnerabilityMicrosoft Sept 2026 Patch Tuesday: 964 CVEs, 2 zero-days under attack
Microsoft products across the ecosystem. 964 vulnerabilities total: 104 critical, 860 important. Two zero-day vulnerabilities are actively exploited in the wild.
criticalbug_reportVulnerabilityAlby Hub critical flaw enables wallet takeover on internet-exposed instances
Alby Hub versions v1.7.0 through v1.18.5 (all releases before August 2025). Only instances exposed to the internet are vulnerable. Versions v1.19.0 and later are patched. Current version is v1.24.0.
criticalbug_reportVulnerabilitycPanel SQL injection flaw allows mail users to escalate to root
All supported versions of cPanel and WHM (release lines 11.110, 11.134, 11.136, 11.138, and WP Squared). Fixed in builds 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9 (WP Squared).
criticalbug_reportVulnerabilityMicrosoft Defender zero-day "ShieldCrash" bypasses September patch
Microsoft Defender on all supported Windows 10, Windows 11, and Windows Server versions with September 2026 Patch Tuesday updates applied. The vulnerability is an incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read as SYSTEM…
criticalbug_reportVulnerabilityMicrosoft patches 966 flaws including 2 actively exploited zero-days
Microsoft products (specific products and versions not disclosed in provided data). Two zero-day vulnerabilities are actively exploited; 964 additional flaws patched in September 2026 Patch Tuesday.
criticalbug_reportVulnerabilityAdobe Commerce/Magento unauthenticated RCE requires immediate patching
Adobe Commerce and Magento platforms. Specific affected versions not disclosed in available information. Vulnerability allows unauthenticated remote code execution.
criticalbug_reportVulnerabilityAdobe Commerce zero-day CVE-2026-75650 exploited since Sept 4 for backdoors
Adobe Commerce 2.4.4 through 2.4.9 (all 2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (all 2026-aug and earlier), and Magento Open Source 2.4.6 through 2.4.9 (all 2026-aug and earlier).