Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
36 matching stories — incident, in WAF / DDoS / App Protection — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Cisco has patched CVE-2026-76519, a critical zero-day vulnerability affecting Cisco Secure Email Gateway (SEG) that is already being exploited in real-world attacks. The flaw carries a CVSS score of 9.8 and enables an unauthenticated remote attacker to write arbitrary files and execute commands with root privileges on vulnerable appliances. The vulnerability resides in the Advanced […] The post CVE-2026-76519: Critical Cisco Secure Email Gateway Zero-Day Exploited for Root Access appeared
Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab’s CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby executing arbitrary code with the […] The post GitLab Remote Code Execution Vulnerability
Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect […] The post CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticate
OverviewOn October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-da
Overview On October 9, 2026, Push Security disclosed a malvertising campaign targeting Claude users. Attackers set the landing domain of a Google search ad to bing.com, leveraging Bing’s own click redirects and multi-layer cloaking to guide users to a counterfeit Claude download page and execute ClickFix-style attacks. Ad platform reviewers only saw bing.com. A compromised […] The post AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix appeared fi
Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes appeared first on
Cisco has disclosed another actively exploited zero-day vulnerability affecting its Catalyst SD-WAN infrastructure. The latest flaw, tracked as CVE-2026-76504, is a critical authentication bypass in Cisco Catalyst SD-WAN Manager that could enable an unauthenticated remote attacker to gain administrative access to an affected system. The vulnerability carries a CVSS score of 9.8, with Cisco confirming […] The post CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild
CVE-2026-87902 is a critical WordPress Core RCE flaw, exploited within hours of patch. See affected versions, exploitation flow, and how to stay protected. The post WordPress CVE-2026-87902: Unauthenticated RCE Exploited Within Hours appeared first on Indusface.
Next.js CVE-2026-94545 (CVSS 9.5) enables RCE through next/og SVG image generation. Learn affected versions, the Satori root cause, and remediation steps The post Next.js CVE-2026-94545: Critical ImageResponse Vulnerability Enables RCE via SVG appeared first on Indusface.
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to Ci
ShinyHunters now bypasses WAF rules to exploit Oracle PeopleSoft CVE-2026-35273. See the new attack chain, detection steps, and AppTrana's protection. The post CVE-2026-35273: ShinyHunters Resumes Oracle PeopleSoft Exploitation with WAF Bypass appeared first on Indusface.
Overview On September 11, 2026, the Huntress SOC released a set of cases tracked over a nine-month period. The conclusion ran counter to their own expectations: what is currently being exploited more frequently in the AI domain is not the models or the AI companies themselves, but rather the everyday AI features that users rely […] The post AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution appeared first on NSFOCUS.
TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. Adobe assigned the vulnerability a CVSS score of 10.0 and released an emergency hotfix after exploitation was observed in the wild. Imperva Cloud WAF and On-Prem WAF […] The post Imperva Customers Protected Against StyleSmu
Attacks targeting JFrog Artifactory (CVE-2026-82329) exploded in 72 hours. Fastly threat intelligence breaks down the mass scanning surge—and how our virtual patch protects you today.
Product Name: Package UpSnap Vulnerability:  Authenticated Remote Code Execution in UpSnap Vulnerable Version:<= 5.3.5 CVE: CVE-2026-49481 On 26/05/2026, a security researcher at Astra Security found a critical Remote Code Execution (RCE) vulnerability in UpSnap, a web-based wake-on-LAN(WoL).  The root cause is an OS Command Injection vulnerability(CWE-78) that exists in UpSnap’s device management functionality due to unsafe ... Read more
TL;DR: CVE-2026-64638, dubbed XSS2Shell, is a high-severity WordPress Core vulnerability that begins as a pre-authentication reflected XSS on the login screen and can be chained to PHP code execution when a logged-in administrator is successfully targeted. WordPress fixed the issue in 7.0.3 and backported the fix through maintained branches. Imperva Cloud WAF and On-Prem WAF […] The post Imperva Customers Protected Against XSS2Shell (CVE-2026-64638) in WordPress Core appeared first on Blog
A new WordPress core exploit chain, now widely tracked as wp2shell, is being actively used against internet-facing WordPress sites. It […] The post wp2shell: Inside the WordPress Unauthenticated RCE Chain (CVE-2026-63030/CVE-2026-60137) appeared first on .
