Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
651 matching stories — incident — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
GitLab has released security fixes for CVE-2026-85706, a critical path traversal vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE) with a maximum CVSS score of 10.0. The flaw allows unauthorized access to server-side files, risking exposure of sensitive source code and development infrastructure. Following confirmation of its addition to CISA’s Known Exploited Vulnerabilities (KEV) catalog, organizations managing self-hosted GitLab instances are strongly urge
Threat Summary Patches have now been released addressing two critical vulnerabilities: CVE-2026-85102, which affects Security Gateway and Spark Firewall, and CVE-2026-85103, which affects Security Gateway, Management Server, and Spark Firewall. CVE-2026-85102 is an improper certificate validation during VPN negotiation and CVE-2026-85103 heap overflow in ASN.1 certificate decoding. Both bugs open the door to unauthenticated remote ... Check Point VPN Critical RCE Vulnerabilities CVE-2026-85102 &
Threat Summary A critical security weakness (CVE-2026-84869) has been identified in the ConnectWise ScreenConnect client (prior to version 26.6.5), where missing authorisation controls and improper privilege management allow file transfers and execution through active remote sessions without host confirmation. While the vulnerability is restricted to the client and session handling components (the server itself is ... CVE-2026-84869: ConnectWise ScreenConnect Client Vulnerability Critical Remote
Threat Summary A critical security weakness (CVE-2026-84869) has been identified in the ConnectWise ScreenConnect client (prior to version 26.6.5), where missing authorization controls and improper privilege management allow file transfers and execution through active remote sessions without host confirmation. While the vulnerability is restricted to the client and session handling components (the server itself is ... CVE-2026-84869: ConnectWise ScreenConnect Client Vulnerability Critical Remote
GitLab has released emergency security updates for a maximum-severity vulnerability in Community Edition (CE) and Enterprise Edition (EE) that allows unauthenticated attackers to read arbitrary files from vulnerable servers. Tracked as CVE-2026-85706 and rated 10.0 on the CVSS scale, the flaw resides in the repository commits API and results from improper path confinement combined with […] The post CVE-2026-85706: Critical GitLab Path Traversal Flaw Exploited in the Wild appeared first on
OverviewOn September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions.On September 1
An unauthenticated PHP object injection flaw in The Events Calendar plugin for WordPress lets attackers execute code on the server through comments submitted on event pages.
GitLab CVE-2026-85706 Added to CISA KEV CVE-2026-85706 represents a severe path traversal flaw in GitLab CE and EE, permitting unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployme
In this blog we’re breaking down each CVE separately, including the root cause, technical overview and patch details. Read our analysis of these 4 critical CVEs Netty CVE-2026-75595 Root Cause A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, […] The post Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676 appeared first on OX Securit
September 2026 exploitation of three JFrog Artifactory flaws gives attackers two practical routes into self-hosted artifact hubs: a one-request admin-token minting path through `CVE-2026-82329`, and a two-step chain where `CVE-2026-42018` leaks an internal anonymous token that `CVE-2026-42016` can escalate because token scope is not enforced.
An unauthenticated RCE in Adobe Commerce and Magento was exploited in the wild before a fix shipped, dropping a Rust backdoor and PHP web shell. Patching stops new attacks, it does not undo the ones that already happened.
CVE-2026-85706 is a critical GitLab CE/EE path traversal vulnerability that can allow unauthenticated attackers to read arbitrary server-side files. NodeZero® Rapid Response safely validates exposure.
A CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center is being exploited by three separate threat actor types at once, with no workaround available. Here's what that means for anyone managing firewalls on behalf of clients.
On September 10, 2026, GitLab released versions 19.3.2, 19.2.6, and 19.1.8 for GitLab Community Edition and Enterprise Edition. The release addresses a critical path traversal vulnerability tracked as CVE-2026-85706, affecting the repository commits API. GitLab assigned this issue a CVSS score of 10.0, and watchTowr assesses with a high confidence that this vulnerability will rapidly…
A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.
CVE-2026-8778 betrifft MIPL Grouped Checkout Fields for WooCommerce bis einschließlich 1.2.1. The post CVE-2026-8778: Nicht authentifizierter Datei-Upload in WooCommerce-Plugin appeared first on LocateRisk.
A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it.
Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329). Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control.
TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. Adobe assigned the vulnerability a CVSS score of 10.0 and released an emergency hotfix after exploitation was observed in the wild. Imperva Cloud WAF and On-Prem WAF […] The post Imperva Customers Protected Against StyleSmu
Palo Alto Networks has released security updates for a high-severity buffer overflow vulnerability affecting PAN-OS software. Tracked as CVE-2026-0310, the issue resides in XML processing functionality and can allow an unauthenticated remote attacker to cause a denial-of-service condition on VM-Series firewalls or execute arbitrary code with root privileges on vulnerable PA-Series hardware firewalls. The flaw […] The post CVE-2026-0310: PAN-OS Buffer Overflow Can Enable Root RCE on PA-Seri
A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.
Overview On August 27, 2026, cybersecurity research firm Mindgard publicly disclosed a prompt injection vulnerability in Amazon Kiro IDE. Kiro is an AI-driven development environment launched by Amazon, equipped with an agent capable of reading/writing repository files, invoking native tools, and triggering IDE features. Discovered and reported on December 11, 2025 (tested on Kiro 0.7.45 […] The post AI Security Incident Case: Amazon Kiro Prompt Injection Vulnerability Analysis appeared fi
A memory corruption flaw in SAP's Extended Passport processing lets an unauthenticated attacker execute operating system commands as the SAP system account, giving full control of the underlying host.
Summary SAP issued an urgent security update this week to address the critical vulnerability CVE-2026-44756, commonly known as OVERPASS. The vulnerability has the highest possible severity rating, with a CVSS score of 10.0, and affects a wide range of SAP solutions. OVERPASS could enable threat actors to disrupt SAP services, access sensitive information, change system […] The post SAP OVERPASS Vulnerability: Protecting SAP Systems from CVE-2026-44756 appeared first on Layer Seven Security
SAP has addressed CVE-2026-44756, a maximum-severity memory corruption vulnerability in Extended Passport (EPP) Processing that could let a remote, unauthenticated attacker execute arbitrary operating system commands on vulnerable SAP systems. The issue, dubbed OVERPASS by Onapsis Research Labs, carries a CVSS score of 10.0 and resides in shared SAP kernel code used by multiple products […] The post CVE-2026-44756: Critical SAP Kernel Flaw Enables Unauthenticated Remote Code Execution appe
Exploitation timelines have never felt shorter, with little more than a code diff, language from an advisory, or a high-confidence “rumor” of a bug often being enough to reverse, reproduce, weaponize, and exploit newly disclosed vulnerabilities given enough tokens. The most recent PaperCut NG/MF vulnerabilities are no exception. Days after the first patch was released,…
CVE-2026-78509 betrifft mehrere Microsoft-Office-Produkte und hat einen CVSS-Score von 9.8. The post CVE-2026-78509: Microsoft-Office-Schwachstelle mit CVSS 9.8 appeared first on LocateRisk.
Microsoft veröffentlicht Sicherheitsupdates für CVE-2026-69356 und CVE-2026-69641 in Exchange Server. The post CVE-2026-69356 und CVE-2026-69641: Sicherheitsupdates für Microsoft Exchange Server appeared first on LocateRisk.
OX Research found and disclosed a critical vulnerability in DeepSeek Harness, DeepSeek’s open-source AI coding-agent harness, that allowed a sandboxed AI agent to disable its own confinement with a single shell command – on shipped defaults, with no network exposure and no credentials. Vulnerability Details CVE: CVE-2026-82533 CWE: CWE-807 Reliance on Untrusted Inputs in a […] The post CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox appear
SAP Note 3759472 CVE-2026-58240 SAP Message Server Patch Day September 2026 SAP Security Note 3759472 | CVSS 3.0 base score 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) | Component BC-CST-MS | SAP Security Patch Day, 8 September 2026 At a glance SAP Note3759472 CVECVE-2026-58240 ComponentBC-CST-MS CVSS v3.0 base score9.8 CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Released8 September 2026 Summary The SAP message server keeps […] The post SAP Note 37594
SAP Note 3747649 CVE-2026-44756 SAP NetWeaver Kernel Patch Day September 2026 SAP Security Note 3747649 | CVSS 3.0 base score 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) | Component BC-CST-DP | SAP Security Patch Day, 8 September 2026 At a glance SAP Note3747649 CVECVE-2026-44756 ComponentBC-CST-DP CVSS v3.0 base score10.0 CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Released8 September 2026 Summary An SAP Internet Communication Manager, […] The post
