Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
104 matching stories — incident, in Threat Exposure Management (CTEM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Horizon3 researchers analyze CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability affecting an unauthenticated gRPC service. The deep-dive explains how path traversal and null-byte handling enable arbitrary file writes and remote code execution, along with indicators of compromise for defenders.
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Direc
OverviewOn October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3, the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied.BeyondTrust has confirmed that explo
The Arbitrary File Upload in BeyondTrust Remote Support let an attacker upload files to the appliance before BeyondTrust's October 15, 2026 fix. This FAQ is updated as new details emerge.
OverviewOn October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user.The advisory states that CVE-2026-97229 affects GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab says all deployment types are affected unles
CVE-2026-102764 is an Arbitrary File Upload vulnerability in BeyondTrust Remote Support that allows an external, unauthenticated attacker to perform arbitrary file operations by issuing specially crafted requests. Apply BeyondTrust's security patches, and check appliances for signs of compromise.
CVE-2026-104935 is an actively exploited Ivanti Connect Secure authentication bypass that can enable remote code execution. Review the exploit chain, affected versions, fixed releases, indicators of compromise, and how NodeZero Rapid Response helps validate exposure and verify remediation.
Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab’s CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby executing arbitrary code with the […] The post GitLab Remote Code Execution Vulnerability
Attackers are chaining CVE-2026-105133 and CVE-2026-105134 to bypass authentication and achieve remote code execution in AhsayCBS. Explore the technical findings, indicators of compromise, affected versions, hotfixes, and how NodeZero Rapid Response helps validate exposure.
A template injection flaw in Adobe Commerce scores a maximum 10.0, letting an unauthenticated attacker execute arbitrary code on a public storefront with no user interaction required.
Ivanti patched the Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure across several version branches, with fixed releases now available. This FAQ is updated as new details emerge.
SAP NetWeaver Visual Composer skips authorization checks in portal functionality, letting a low-privileged user invoke internal operations on a connected back-end system and potentially compromise it fully.
Overview On October 9, 2026, Push Security disclosed a malvertising campaign targeting Claude users. Attackers set the landing domain of a Google search ad to bing.com, leveraging Bing’s own click redirects and multi-layer cloaking to guide users to a counterfeit Claude download page and execute ClickFix-style attacks. Ad platform reviewers only saw bing.com. A compromised […] The post AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix appeared fi
IBM DataPower Gateway fails to reject empty passwords during LDAP authentication, letting a remote attacker obtain administrative access to the gateway enforcing policy for everything behind it.
Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes appeared first on
October 2026 CVE of the Month: The Next.js RCE Behind "Not Affected" (CVE-2026-75604)
Security teams are under pressure to detect threats, investigate incidents, and contain attacks before they disrupt business operations. But when security tools are disconnected, analysts may need to move between consoles, correlate alerts manually, and coordinate response actions across different teams. That can slow down security incident response and make it harder to maintain a The post Automated Security Incident Remediation Platforms Compared appeared first on Seceon Inc.
Overview On September 11, 2026, the Huntress SOC released a set of cases tracked over a nine-month period. The conclusion ran counter to their own expectations: what is currently being exploited more frequently in the AI domain is not the models or the AI companies themselves, but rather the everyday AI features that users rely […] The post AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution appeared first on NSFOCUS.
September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)
Threat Summary A critical zero-day vulnerability (CVE-2026-50656/“RoguePlanet”) in Microsoft Defender’s Malware Protection Engine (mpengine.dll) enables local users, including standard, low-privilege accounts, to escalate privileges to NT AUTHORITY\SYSTEM using a race condition and improper link resolution. Microsoft initially issued a patch (Engine v1.1.26060.3008) in July 2026. However, on August 12, 2026, a new exploit chain, “ShieldBreak,” ... Microsoft Defender Patch Bypas
Summary On July 30th, 2026, SolarWinds released fixes for a critical Authentication-Bypass vulnerability in Web Help Desk (WHD) tracked as CVE-2026-28323, and a related high-severity Denial-of-Service vulnerability, tracked as CVE-2026-28299. Although no active exploitation has been observed yet, WHD is commonly internet-facing and the authentication bypass requires no credentials, making it a likely target once ... SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299
In January 2023, this column's first life at Kenna featured CVE-2022-44698 , a Windows SmartScreen Mark-of-the-Web bypass that attackers were happily using while the scoring systems shrugged. Three and a half years later, here we are again. This month's pick scores 3.3 under CVSS v3.1, the kind of number that never makes a patch queue, and our sensors have recorded it being exploited in the wild multiple times in the past month.
On July 17, 2026, WordPress pushed an emergency security update. WordPress 7.0.2, 6.9.5, and 6.8.6 fixed two core vulnerabilities: CVE-2026-63030 and CVE-2026-60137. Our team at Element Security analyzed the patched code to understand the vulnerabilities, protect our customers, and develop an exploit module for our External Security platform. We identified both root causes and investigated […] The post WordPress wp2shell RCE: CVE-2026-63030 and CVE-2026-60137 appeared first on Element Secu