Security incident logs: How to create logs that satisfy GDPR and regulators
Learn how to create a security incident log that supports GDPR records, ICO decisions, insurance claims, and credential access reviews.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
79 matching stories — incident, in Endpoint Detection & Response — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
CVE-2026-76519: Critical Cisco Secure Email Gateway Zero-Day Exploited for Root Access
Cisco has patched CVE-2026-76519, a critical zero-day vulnerability affecting Cisco Secure Email Gateway (SEG) that is already being exploited in real-world attacks. The flaw carries a CVSS score of 9.8 and enables an unauthenticated remote attacker to write arbitrary files and execute commands with root privileges on vulnerable appliances. The vulnerability resides in the Advanced […] The post CVE-2026-76519: Critical Cisco Secure Email Gateway Zero-Day Exploited for Root Access appeared
CVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access
Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS. The flaw carries a CVSS 4.0 score of 8.6 and enables an authenticated attacker with network access to execute arbitrary code with root privileges on a vulnerable appliance/system. Palo Alto Networks disclosed the issue […] The post CVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access appeared first on S
GitLab Remote Code Execution Vulnerability (CVE-2026-97229) Notice
Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab’s CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby executing arbitrary code with the […] The post GitLab Remote Code Execution Vulnerability
CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticated Code Execution
Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect […] The post CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticate
CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web
Microsoft has patched CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is already being exploited in real-world attacks. The flaw carries a CVSS score of 8.8 and allows an unauthenticated attacker to evade Mark of the Web (MOTW) protections by convincing a victim to interact with a specially crafted file. The zero-day was […] The post CVE-2026-96951: Actively Exploited Windows Shell Zero-Day Bypasses Mark of the Web appeared first on SOC Prime.
Critical GitLab Vulnerability (CVE-2026-97229) Puts Software Supply Chains at Risk
GitLab has released emergency patches for CVE-2026-97229, a critical remote code execution vulnerability with a maximum CVSS score of 10.0. The implications extend well beyond a compromised server. The post Critical GitLab Vulnerability (CVE-2026-97229) Puts Software Supply Chains at Risk first appeared on Action1.
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
69Critical1337Important0Moderate1LowMicrosoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.This month’s update includes patches for 301 products and comp
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
OverviewOn October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-da
AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix
Overview On October 9, 2026, Push Security disclosed a malvertising campaign targeting Claude users. Attackers set the landing domain of a Google search ad to bing.com, leveraging Bing’s own click redirects and multi-layer cloaking to guide users to a counterfeit Claude download page and execute ClickFix-style attacks. Ad platform reviewers only saw bing.com. A compromised […] The post AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix appeared fi
CVE-2026-96940: Microsoft Exchange Vulnerability Allows Unauthorized Mailbox Access
Microsoft has released an out-of-band security update addressing CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server that could allow authenticated attackers to access other users’ mailboxes and read sensitive emails and attachments. The flaw carries a CVSS score of 8.8 and affects multiple on-premises Exchange Server versions. The vulnerability comes amid growing security concerns surrounding […] The post CVE-2026-96940: Microsoft Exchange Vulnerability Allows
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive
CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. For organizations that use GHES to host private source code, deployment credentials, and connections to internal development systems, the […] The post CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection
CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes
Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes appeared first on
CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild
Cisco has disclosed another actively exploited zero-day vulnerability affecting its Catalyst SD-WAN infrastructure. The latest flaw, tracked as CVE-2026-76504, is a critical authentication bypass in Cisco Catalyst SD-WAN Manager that could enable an unauthenticated remote attacker to gain administrative access to an affected system. The vulnerability carries a CVSS score of 9.8, with Cisco confirming […] The post CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to Ci
[2026.09 Vulnerability Report] Adobe Commerce RCE (CVE-2026-75650)
CVE-2026-75650, dubbed "StyleSmuggler," is a maximum-severity (CVSS 10.0) unauthenticated Remote Code Execution vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. An attacker injects malicious PHP code through the template engine’s `styles` property—which bypasses all built-in security validation—causing it to be written to disk and later executed when Magento’s dependency-injection scanner processes a “Payment Transaction Failed” email template. No authentication, no
[2026.09 Vulnerability Report] FuelCMS Remote Code Execution (CVE-2026-30457)
This is a Remote Code Execution (RCE) vulnerability found in FuelCMS. An attacker can execute arbitrary code by sending malicious PHP code via the `data` parameter of the `/fuel//preview?module=blocks&field=view` endpoint. Although the vulnerability was reported to the vendor, no patch has been released yet. AIWAAP plans to address this issue with the “2342 / Daylight Studio FuelCMS Remote Code Execution” pattern, which will be included in the September 2026 pattern update. Tags: CVE-2026-30
[2026.09 Vulnerability Report] Analysis of GitLab Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
CVE-2026-85706 is a critical path traversal vulnerability (CWE-22) found in the widely used DevOps platforms GitLab Community Edition (CE) and Enterprise Edition (EE). Remote attackers can read arbitrary local files accessible to the GitLab server process by sending specially crafted HTTP(S) API requests without requiring authentication. This vulnerability stems from insufficient file path validation and missing authentication checks within the GitLab Repository Commits API. A successful attack
Automated Security Incident Remediation Platforms Compared
Security teams are under pressure to detect threats, investigate incidents, and contain attacks before they disrupt business operations. But when security tools are disconnected, analysts may need to move between consoles, correlate alerts manually, and coordinate response actions across different teams. That can slow down security incident response and make it harder to maintain a The post Automated Security Incident Remediation Platforms Compared appeared first on Seceon Inc.
CVE-2026-87902: Critical Vulnerability in WordPress
We explain in simple terms why the CVE-2026-87902 vulnerability is dangerous, and how to protect your company against it.
CVE-2026-87902: Critical Vulnerability in WordPress
We explain in simple terms why the CVE-2026-87902 vulnerability is dangerous, and how to protect your company against it.
AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution
Overview On September 11, 2026, the Huntress SOC released a set of cases tracked over a nine-month period. The conclusion ran counter to their own expectations: what is currently being exploited more frequently in the AI domain is not the models or the AI companies themselves, but rather the everyday AI features that users rely […] The post AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution appeared first on NSFOCUS.
Analysis of 7-Zip vulnerabilities: CVE-2025-11001 and CVE-2025-11002
A recently disclosed 7-Zip vulnerability allows malicious actors to execute code remotely through specially crafted ZIP files
CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required
Threat Summary CVE-2026-76461 is a pre-authentication SQL injection vulnerability in the email parsing logic of Cisco Secure Email Gateway (AsyncOS). This vulnerability enables unauthenticated remote threat actors to execute arbitrary code as root by sending crafted, malicious emails. This grants threat actors full control over the operating system, allowing data exfiltration, email surveillance, persistent access, ... CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Ze
CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day Vulnerability Immediate Mitigation Required
Threat Summary CVE-2026-76461 is a pre-authentication SQL injection vulnerability in the email parsing logic of Cisco Secure Email Gateway (AsyncOS). This vulnerability enables unauthenticated remote threat actors to execute arbitrary code as root by sending crafted, malicious emails. This grants threat actors full control over the operating system, allowing data exfiltration, email surveillance, persistent access, ... CVE-2026-76461: Active Exploitation of Cisco Secure Email Gateway Critical Ze
Check Point VPN Critical RCE Vulnerabilities CVE-2026-85102 & CVE-2026-85103
Threat Summary Patches have now been released addressing two critical vulnerabilities: CVE-2026-85102, which affects Security Gateway and Spark Firewall, and CVE-2026-85103, which affects Security Gateway, Management Server, and Spark Firewall. CVE-2026-85102 is an improper certificate validation during VPN negotiation and CVE-2026-85103 heap overflow in ASN.1 certificate decoding. Both bugs open the door to unauthenticated remote ... Check Point VPN Critical RCE Vulnerabilities CVE-2026-85102 &
CVE-2026-0310: PAN-OS Buffer Overflow Can Enable Root RCE on PA-Series Firewalls
Palo Alto Networks has released security updates for a high-severity buffer overflow vulnerability affecting PAN-OS software. Tracked as CVE-2026-0310, the issue resides in XML processing functionality and can allow an unauthenticated remote attacker to cause a denial-of-service condition on VM-Series firewalls or execute arbitrary code with root privileges on vulnerable PA-Series hardware firewalls. The flaw […] The post CVE-2026-0310: PAN-OS Buffer Overflow Can Enable Root RCE on PA-Seri
CVE-2026-58400 – core-geonetwork
CVE-2026-63219 – core-geonetwork
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
OverviewOn September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances.CVE-2026-83548 is a critical pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw has a CVSS v3.1 base score
August 27 outage: Incident report
Here's a timeline of what happened, what choices we made during the incident and why, and how it was resolved.
CVE-2026-65400: macOS Screen Sharing Authentication Bypass Under Active Exploitation
New Huntress View for Security Incident Investigations
See how the Huntress SOC runs security incident investigations from first signal to final resolution, including the ones closed as benign.
Detecting Langflow CVE-2026-33017 exploitation with Wazuh
Langflow is an open source, low-code platform for building and deploying AI-powered agents and workflows. These workflows, called flows, define how AI models, prompts, and other components interact to process a request. Organizations can publish flows as HTTP endpoints, allowing applications and users to interact with them remotely. Exposing these endpoints to the internet increases […] The post Detecting Langflow CVE-2026-33017 exploitation with Wazuh appeared first on Wazuh.
Ray CVE-2025-62593: Critical Browser-Driven RCE via DNS Rebinding
CVE-2026-50522: Critical Microsoft SharePoint RCE Exploited in the Wild — Detection and Mitigation Guide
Executive Summary Microsoft patched CVE-2026-50522 in its July 2026 security updates and scored this vulnerability as Critical (CVSS 9.8). Microsoft said that this vulnerability was discovered and reported by security researcher “splitline” from DEVCORE. On July 20, watchTowr identified publicly available proof-of-concept (PoC) exploit code for this vulnerability. Within hours, its global honeypot network, Attacker […]
From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS
Apple’s latest macOS update addresses two vulnerabilities in its Screen Sharing server, including one that enables pre-authenticated remote code execution.
CVE-2026-16812: Critical Command Injection in Arista VeloCloud Orchestrator
CVE-2026-45659: Authenticated SharePoint Remote Code Execution Vulnerability Moves from Patch Tuesday to Active Exploitation
Executive Summary Microsoft addressed CVE-2026-45659, an authenticated remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server, as part of its May 2026 security updates. The vulnerability stems from improper validation of untrusted data during deserialization, enabling an authenticated user with Site Member permissions to execute arbitrary code without requiring administrative privileges. Microsoft assigned the vulnerability […]
CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
Huntress has observed a series of strikingly similar intrusions beginning with CitrixBleed 2 exploitation, employing novel local privilege escalation techniques, and ending in Dragonforce ransomware.