0-Doubt

Vendor news

Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.

651 matching stories — incident — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.

Incident

CVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability

Veeam has released a security update addressing CVE-2025-64393, a critical remote code execution vulnerability in Veeam Backup & Replication. The flaw has received a CVSS 4.0 score of 9.4 and enables a low-privileged authenticated user with the Backup Viewer role to execute arbitrary code on the Veeam Backup Server. The vulnerability stems from insecure deserialization […] The post CVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability appeared first on SOC Prime.

SOC PrimeVendor blog
Incident

Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771

As self-confessed hoarders of internet “background noise” and connoisseurs of deploying random appliances on the internet to “see what happens”, we can think of little better than watching a vulnerability get exploited in the wild, in real time, against technology that half the internet relies upon. After the disclosure of any vulnerability affecting edge devices,…

watchTowrVendor blog
Incident

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

OverviewOn October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3. An unauthenticated remote attacker who knows a target file's exact name and path can access it within the

Rapid7Vendor blog
Incident

Zammad CVE-2026-102489: Session Leak to RCE

Horizon3 reverse engineered CVE-2026-102489 in Zammad, reproduced the unauthenticated WebSocket session leak, traced the vulnerable code path, and demonstrated how a leaked admin session can lead to remote code execution.

Horizon3.aiVendor blog
Incident

CVE-2026-96940: Microsoft Exchange Vulnerability Allows Unauthorized Mailbox Access

Microsoft has released an out-of-band security update addressing CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server that could allow authenticated attackers to access other users’ mailboxes and read sensitive emails and attachments. The flaw carries a CVSS score of 8.8 and affects multiple on-premises Exchange Server versions. The vulnerability comes amid growing security concerns surrounding […] The post CVE-2026-96940: Microsoft Exchange Vulnerability Allows

MicrosoftSOC PrimeIndustry coverage
Incident

CVE-2026-21589: Critical Atlassian Vulnerability Exposes Sensitive Files Across Eight Products

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight widely used Data Center products, including Jira, Confluence, and Bitbucket. The flaw, assigned a CVSS 4.0 score of 9.3, could allow unauthenticated attackers to access sensitive files on vulnerable servers without requiring valid credentials or user interaction. The vulnerability highlights the growing risks […] The post CVE-2026-21589: Critical Atlassian Vulnerability Exposes Sensitive

SOC PrimeVendor blog
Incident

CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive

CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. For organizations that use GHES to host private source code, deployment credentials, and connections to internal development systems, the […] The post CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection

GitHubSeqriteIndustry coverage
Incident

CVE-2026-32557: SQL Injection in WooCommerce Appointments

CVE-2026-32557 betrifft WooCommerce Appointments bis einschließlich 5.3.2. Die Schwachstelle ist ohne Authentifizierung über das Netzwerk erreichbar. The post CVE-2026-32557: SQL Injection in WooCommerce Appointments appeared first on LocateRisk.

LocateRiskVendor blog
Incident

CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments

Only days after Citrix addressed actively exploited NetScaler flaws CVE-2026-88771 and CVE-2026-88772, defenders faced another urgent security issue. A newly disclosed vulnerability tracked as CVE-2026-88779 has been exploited in targeted attacks against customer-managed NetScaler ADC and NetScaler Gateway appliances configured for SAML authentication. Citrix rates the vulnerability as high severity with a CVSS v4.0 score […] The post CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Aga

NetScalerCitrixSOC PrimeIndustry coverage
Incident

CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes

Fortinet has disclosed a critical FortiMail zero-day vulnerability that attackers are already exploiting in the wild. Tracked as CVE-2026-104286 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated remote attacker to write arbitrary files to the underlying system by sending specially crafted HTTP or HTTPS requests. The vulnerability poses a significant risk […] The post CVE-2026-104286: Critical FortiMail Zero-Day Exploited for Unauthenticated File Writes appeared first on

FortinetSOC PrimeIndustry coverage
Incident

CVE-2026-104859: `@nx/docker` turned release configuration into `/bin/sh -c`

Published on 2 October 2026, `CVE-2026-104859` in npm package `@nx/docker` lets untrusted `repositoryName`, `registryUrl`, `--dockerVersion`, and `NX_DOCKER_IMAGE_REF` values break out of interpolated `docker tag`, `docker images`, and `docker push` shell strings during Nx release jobs. The 22.7.8 and 23.1.1 fixes switch those calls to argv arrays with `execFile()` and `execFileSync()`.

CorgeaVendor blog
Incident

CVE-2026-103251: n8n queue mode lets Redis pub-sub install arbitrary npm packages cluster-wide

Published on 1 October 2026, CVE-2026-103251 in the npm package n8n broke the trust boundary between the normal community-package install flow and the Redis pub-sub path used by queue mode. In affected builds, anyone who could write to the Redis bus could send a forged install message and make every cluster node download, install, and load an attacker-chosen npm package without the usual validation, checksum, permission, or safety checks.

CorgeaVendor blog
Incident

Privacy Incident Response Readiness: A 12-Step Program

Build privacy incident response readiness with 12 practical steps for governance, data visibility, safeguards, regulatory analysis, and defensible decisions. The post Privacy Incident Response Readiness: A 12-Step Program appeared first on RadarFirst.

RadarFirstVendor blog
Incident

CVE-2026-84782: High-Severity OpenSSL DTLS Flaw Exposes Heap Memory and Enables DoS

OpenSSL has released security updates addressing 14 vulnerabilities, including a high-severity flaw that could expose sensitive heap memory or crash applications relying on Datagram Transport Layer Security (DTLS). Tracked as CVE-2026-84782, the vulnerability stems from improper handling of handshake message retransmissions and carries a CVSS score of 8.2. Disclosed on September 29, 2026, the issue […] The post CVE-2026-84782: High-Severity OpenSSL DTLS Flaw Exposes Heap Memory and Enables

SOC PrimeVendor blog
Incident

CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild

Cisco has disclosed another actively exploited zero-day vulnerability affecting its Catalyst SD-WAN infrastructure. The latest flaw, tracked as CVE-2026-76504, is a critical authentication bypass in Cisco Catalyst SD-WAN Manager that could enable an unauthenticated remote attacker to gain administrative access to an affected system. The vulnerability carries a CVSS score of 9.8, with Cisco confirming […] The post CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild

CiscoSOC PrimeIndustry coverage
Incident

One Port to Root: Weaponizing Check Point Management CVE-2026-93616

An unauthenticated attacker who can reach TCP 19009 on a Check Point management server can take it over completely. Bishop Fox reproduced the full root RCE chain on R81.10 and R82.10, breaks down all three vulnerabilities the patch actually closes, and shares a safe detection tool for defenders.

Bishop FoxVendor blog