Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
74 matching stories — incident, in Digital Risk Protection (DRP) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Direc
OverviewOn October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3, the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied.BeyondTrust has confirmed that explo
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed […]
BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch. The attack began on August 29, 2026, when one BeyondTrust-hosted Remote Support instance and one self-hosted appliance were compromised. BeyondTrust detected the hosted incident during proactive hunting on September 28, reproduced the entry vector that day, […]
OverviewOn October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user.The advisory states that CVE-2026-97229 affects GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab says all deployment types are affected unles
CVE-2026-105445: Docker Hub PAT Reassignment Flaw Docker has disclosed CVE-2026-105445 , a critical privilege assignment flaw in Docker Hub that could allow an attacker to reuse a personal access token (PAT) after it was
A CVSS 9.8 FortiMail zero-day (CVE-2026-104286) lets an unauthenticated attacker write any file on the appliance through the IBE handler. Here is what is affected, how to check for compromise, and how to fix it.
Blog ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure? On September 22, 2026, the ShinyHunters extortion group claimed it had compromised FBIJobs.gov, the FBI’s recruitment portal, and defaced apply.fbijobs.gov with a fake seizure banner. The group says it walked away with roughly 2 to 3 TB of data on FBI agents, staff […] The post ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure? ap
A CVSS 9.8 SQL injection in Cisco Secure Email Gateway (CVE-2026-76461) lets an attacker gain root access with a single crafted email — no authentication, no workaround. Here's what's exploitable, what to check, and how to patch.
CVE-2026-16232, the Check Point Smart Console authentication bypass, including affected versions, signs of compromise, and mitigation steps. The post CVE-2026-16232: Check Point SmartConsole Zero-Day appeared first on Foresiet.
On July 27, JetBrains disclosed a critical vulnerability in its TeamCity On-Premises software and stated that it was not aware of any active exploitation. On August 5, the US Cybersecurity and Infrastructure Security Agency added the same vulnerability to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch. The vendor’s reassurance […] The post CVE-2026-63077: TeamCity Is Under Active Attack Right Now appeared first on CybelAngel.
On July 27, 2026, Apple released security updates for iOS 26.6 and iPadOS 26.6, fixing vulnerabilities across several components — Accessibility, Kernel, Libnotify, and WebKit. Among them is CVE-2026-64739, a stack-based buffer overflow in Libnotify/notifyd found and reported to Apple by ThreatBook XGPT. Apple's advisory credits Feng XUE and XGPT of ThreatBook. The same flaw also affects tvOS, watchOS, visionOS, and macOS — see Affected Scope below. There is no evidence of in-the-wild exploitati
WP2Shell combines two WordPress Core vulnerabilities into a critical unauthenticated Remote Code Execution chain. This technical analysis explains the exploit path, affected versions, detection techniques, indicators of compromise, and practical remediation guidance for security teams.
TP-Link addresses CVE-2026-3227, an authenticated command injection flaw in router configuration imports leading to root access. Learn if your device is at risk. The post TP-Link CVE-2026-3227: Authenticated Command Injection via Configuration Import appeared first on Foresiet.
CVE-2026-53435 enables authenticated deserialization to achieve full controller takeover in Jenkins via config.xml. The post Inside CVE-2026-53435: Authenticated Deserialization to Full Controller Takeover in Jenkins via config.xml appeared first on Foresiet.
