Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
7 / 9 results
criticalbug_reportVulnerabilityServiceNow critical vulnerabilities require immediate patching
ServiceNow platform (specific versions not disclosed in advisory). Scope and affected components not detailed in available information.
criticalbug_reportVulnerabilityServiceNow platforms face critical vulnerabilities requiring urgent patching
ServiceNow platforms (specific versions not disclosed in advisory). Scope and affected components not detailed in available information.
criticalbug_reportVulnerabilityServiceNow AI Platform: Three CVSS 10.0 flaws enable unauthenticated RCE
ServiceNow AI Platform versions: Xanadu (before Patch 11 HF 7a), Yokohama (before Patch 12 HF 3b / Patch 13 HF 4), Zurich (before Patch 7b HF 3 through Patch 12 depending on branch), Australia (before Patch 2 HF 3 through Patch 5).
criticalbug_reportVulnerabilityServiceNow AI Platform: 3 critical unauthenticated flaws patched
ServiceNow AI Platform (formerly Now Platform): Xanadu Patch 11, Yokohama Patch 12-13, Zurich Patch 7-12, Australia Patch 2-5. Affects cloud (auto-patched) and self-hosted instances.
highperson_alertThreat ActorCity Forum campaign scrapes Salesforce and ServiceNow portals
City Forum is a campaign name assigned by Reco to a coordinated data harvesting operation targeting enterprise SaaS platforms. The activity is attributed to a single attacker infrastructure operating from IP address 158.220.87.79, hosted on a Contabo…
highperson_alertThreat ActorCity-Forum Campaign Targets Salesforce and ServiceNow Portals
City-Forum is an ongoing data theft campaign, not a formally attributed threat actor group. The campaign has been active since at least March 2025 and is characterized by consistent infrastructure use—a single IP address (158.220.87.79) hosted by Ger…
highbug_reportVulnerabilityServiceNow patches actively exploited auth bypass on hosted instances
ServiceNow hosted customer instances (specific versions not disclosed). On-premise deployments may also be affected pending vendor guidance.