Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
169 matching stories — incident, in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed […]
The Arbitrary File Upload in BeyondTrust Remote Support let an attacker upload files to the appliance before BeyondTrust's October 15, 2026 fix. This FAQ is updated as new details emerge.
BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch. The attack began on August 29, 2026, when one BeyondTrust-hosted Remote Support instance and one self-hosted appliance were compromised. BeyondTrust detected the hosted incident during proactive hunting on September 28, reproduced the entry vector that day, […]
CVE-2026-102764 is an Arbitrary File Upload vulnerability in BeyondTrust Remote Support that allows an external, unauthenticated attacker to perform arbitrary file operations by issuing specially crafted requests. Apply BeyondTrust's security patches, and check appliances for signs of compromise.
BeyondTrust has disclosed CVE-2026-102764, a critical vulnerability in Remote Support (RS) that was exploited as a zero-day by a suspected China-nexus cyber espionage actor. The flaw carries a CVSS 4.0 score of 9.3 and can allow an unauthenticated remote attacker to perform arbitrary file operations on a vulnerable appliance. Google Threat Intelligence Group and Mandiant […] The post CVE-2026-102764: Critical BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers appeared fi
CVE-2026-103768 betrifft das ELEX WordPress HelpDesk & Customer Ticketing System bis Version 3.3.7. Version 3.3.8 behebt die Schwachstelle. The post CVE-2026-103768: Upload-Schwachstelle im ELEX-HelpDesk-Plugin appeared first on LocateRisk.
Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS. The flaw carries a CVSS 4.0 score of 8.6 and enables an authenticated attacker with network access to execute arbitrary code with root privileges on a vulnerable appliance/system. Palo Alto Networks disclosed the issue […] The post CVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access appeared first on S
Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect […] The post CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticate
Microsoft has patched CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is already being exploited in real-world attacks. The flaw carries a CVSS score of 8.8 and allows an unauthenticated attacker to evade Mark of the Web (MOTW) protections by convincing a victim to interact with a specially crafted file. The zero-day was […] The post CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web appeared first on SOC Prime.
CVE-2026-105445: Docker Hub PAT Reassignment Flaw Docker has disclosed CVE-2026-105445 , a critical privilege assignment flaw in Docker Hub that could allow an attacker to reuse a personal access token (PAT) after it was
A template injection flaw in Adobe Commerce scores a maximum 10.0, letting an unauthenticated attacker execute arbitrary code on a public storefront with no user interaction required.
CVE-2026-87855 betrifft JTL-Connector for WooCommerce bis Version 2.4.3. Version 2.4.4 oder höher behebt die Schwachstelle. The post CVE-2026-87855: Sicherheitsupdate für JTL-Connector for WooCommerce appeared first on LocateRisk.
CVE-2026-70279 ist eine XSS-Spoofing-Schwachstelle in Microsoft Exchange Server. The post CVE-2026-70279: XSS-Spoofing in Microsoft Exchange Server appeared first on LocateRisk.
69Critical1337Important0Moderate1LowMicrosoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.This month’s update includes patches for 301 products and comp
Ivanti disclosed certain versions of ICS are affected by an authentication bypass by spoofing vulnerability. Here's how to find affected appliances.
OverviewOn October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-da
Ivanti patched the Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure across several version branches, with fixed releases now available. This FAQ is updated as new details emerge.
A crafted link, one page load, and no clicks required. Bishop Fox found a reflected XSS in Siemens Teamcenter’s login redirect that auto-submits its own form, turning attribute injection into zero-interaction code execution and a silent surrogate delegation change on the victim’s account.
SAP NetWeaver Visual Composer skips authorization checks in portal functionality, letting a low-privileged user invoke internal operations on a connected back-end system and potentially compromise it fully.
IBM DataPower Gateway fails to reject empty passwords during LDAP authentication, letting a remote attacker obtain administrative access to the gateway enforcing policy for everything behind it.
Microsoft has released an out-of-band security update addressing CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server that could allow authenticated attackers to access other users’ mailboxes and read sensitive emails and attachments. The flaw carries a CVSS score of 8.8 and affects multiple on-premises Exchange Server versions. The vulnerability comes amid growing security concerns surrounding […] The post CVE-2026-96940: Microsoft Exchange Vulnerability Allows
Fortinet releases critical patch for FortiMail path traversal flaw (CVE-2026-104286, CVSS 9.8). Here's how to find affected appliances on your network.
CVE-2026-88771 and CVE-2026-88772 are actively exploited Citrix NetScaler RCE zero-days in CISA KEV. Get the passive Nuclei template, the four-branch patch-gap logic, and how to detect unpatched appliances at scale with Sn1per. The post CVE-2026-88771 and CVE-2026-88772: Citrix NetScaler Pre-Auth RCE Detection with Sn1per first appeared on Sn1perSecurity.
An unauthenticated attacker who can reach TCP 19009 on a Check Point management server can take it over completely. Bishop Fox reproduced the full root RCE chain on R81.10 and R82.10, breaks down all three vulnerabilities the patch actually closes, and shares a safe detection tool for defenders.
Blog ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure? On September 22, 2026, the ShinyHunters extortion group claimed it had compromised FBIJobs.gov, the FBI’s recruitment portal, and defaced apply.fbijobs.gov with a fake seizure banner. The group says it walked away with roughly 2 to 3 TB of data on FBI agents, staff […] The post ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure? ap
Here's how to find impacted appliances on your network to mitigate CVE-2026-93952, an actively exploited improper input validation flaw in Arista VeloCloud.
A hardcoded authentication secret ships with every SolarWinds Access Rights Manager install, and reaching TCP 55555 is enough to hit a .NET deserialization sink. Bishop Fox confirmed SYSTEM-level code execution, breaks down the root cause, and shares a safe detection tool for defenders.
Discover how a single DNS request can chain a stored Cross-Site Scripting (XSS) vulnerability into Remote Code Execution (RCE) on pfSense firewalls. Read the full technical breakdown of CVE-2026-78902 affecting the popular pfBlockerNG package. The post CVE-2026-78902: XSS to RCE in pfSense with one DNS request appeared first on NetSPI.
Google has released security updates for a high-severity zero-day vulnerability affecting the cellular modem in Pixel devices after finding signs that the flaw is being used in limited, targeted attacks. Tracked as CVE-2026-58704 and scored 8.0 under CVSS 3.1, the issue can allow an attacker to bypass permission checks and escalate privileges without requiring any […] The post CVE-2026-58704: Google Pixel Modem Zero-Day Exploited in Targeted Attacks appeared first on SOC Prime.
Palo Alto Networks has released security updates for a high-severity buffer overflow vulnerability affecting PAN-OS software. Tracked as CVE-2026-0310, the issue resides in XML processing functionality and can allow an unauthenticated remote attacker to cause a denial-of-service condition on VM-Series firewalls or execute arbitrary code with root privileges on vulnerable PA-Series hardware firewalls. The flaw […] The post CVE-2026-0310: PAN-OS Buffer Overflow Can Enable Root RCE on PA-Seri
CVE-2026-82329 is a critical, unauthenticated JFrog Artifactory authentication bypass in CISA KEV. Get the passive Nuclei template, the six-branch version logic, and how to detect it at scale with Sn1per. The post CVE-2026-82329: JFrog Artifactory Auth Bypass Detection with Sn1per first appeared on Sn1perSecurity.
CVE-2026-9082 is an actively exploited, unauthenticated SQL injection in Drupal core on PostgreSQL. Learn how to detect every affected host with Sn1per and Nuclei. The post CVE-2026-9082: Drupal Core SQL Injection Detection with Sn1per first appeared on Sn1perSecurity.