AI-SEARCH-cve-2026 medium

Description

AI-discovered findings for topic: 'CVE-2026'. Run at 2026-10-30T19:28:56.411356Z. DuckDuckGo returned 10 result(s); the AI Forensic Validator classified 0 IOC(s) as valid. CVEs mentioned: CVE-2026-109618, CVE-2026-109619

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (148)

• Live Cybersecurity Brief for October 30, 2026: Active Threats, CVEs ...

  Current cybersecurity intelligence for October 30, 2026 , led by CVE - 2026 -109618: PHP Memory Corruption Vulnerability and CVE - 2026 -111497: Google Brotli Unchec...

• Cyber Threat Intelligence Alerts - CyberProof

  A high-severity use-after-free vulnerability in curl and libcurl, tracked as CVE - 2026 -92392 (CVSS 8.1), could allow a malicious HTTP/2 server to corrupt client memory and potentially achieve remote code execution. The curl project rates the issue High under its own four-level severity scale. Exploitation requires a client to upload a file of approximately 135 KB over HTTP/2 to an attacker ...

• CVE-2026-109618 and CVE-2026-109619: PHP2Shell | ThreatLabz - Zscaler

  6000569: PHP2Shell Excessive Multipart Parts ( CVE - 2026 -109618, CVE - 2026 -109619) Zscaler Deception Zscaler Deception customers can deploy Private Threat Intelligence decoys for the following applications to detect PHP2Shell exploitation attempts and generate high-fidelity alerts: WordPress Login Drupal Admin Panel Joomla Admin Panel phpMyAdmin ...

• Inside Node2Shell: A Closer Look at CVE-2026-111497 | Akamai

  Learn about Node2Shell ( CVE - 2026 -111497), a critical Brotli flaw in Node.js enabling RCE. Discover affected versions, detection queries, and mitigation steps.

• Vulnerability Discovery and Exploitation Trends in the AI Era

  CVE Disclosure Doubled in 2026 Vulnerability disclosures doubled from 5,045 in January 2026 to 10,477 in July, with the count of disclosed vulnerabilities reaching a peak of 10,740 in August (Figure 1). Distinguishing Threat Risk from CVE Inflation However, raw disclosure volume throughout 2026 can be misleading without threat intelligence context.

• CVE Vulnerabilities from 2026 — Full List - Strix

  Complete list of CVE vulnerabilities from 2026 with severity scores and exploit data.

• PHP2Shell RCE Exploited: CVE-2026-109618 & CVE-2026-109619

  CVE - 2026 -109618 and CVE - 2026 -109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP, the scripting language many web servers use to run applications.

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle ...

  Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE - 2026 -35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors.

• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to ...

  Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026 , in MadPot telemetry, four days before public disclosure of CVE - 2026 -109618 and CVE - 2026 -109619. The exploit attempt originated from an IP address associated with a commercial anonymization network.

• Weekly Security Intelligence Briefing -- Week of 2026-10-05

  The SCC pipeline processed 78 intelligence items this week, including 20 CVEs (9 rated Critical, 8 rated High), 15 campaigns, 12 data breaches, and multiple threat actor profiles. Two CISA KEV deadlines expired this week, both requiring immediate action: CVE - 2026 -104286 in FortiMail (deadline 2026 -10-04) and CVE - 2026 -65660 in Microsoft...

• PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code ...

  PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution Patch now: CVE - 2026 -109618 and CVE - 2026 -109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped.

• CVE-2026-109618, CVE-2026-109619 PHP2Shell: Vuln Details

  According to Bitsight Threat Intelligence Bitsight Threat Intelligence assigns CVE - 2026 -109618 a Dynamic Vulnerability Exploit (DVE) score of 9.91 out of 10, and CVE - 2026 -109619 a score of 9.84, driven by significant discussion of these vulnerabilities across open and dark web sources, with one dark web exploit forum user noting: " [the] Internet will be on fire." DVE estimates how likely ...

• SECURITY ALERT: PHP Critical RCE Vulnerabilities (CVE-2026-109618 and ...

  The PHP Security Team has released advisories addressing two critical, interlinked vulnerabilities in PHP: CVE - 2026 -109618 (RCE via OOM corruption) and CVE - 2026 -109619 (RCE via stale global state). According to PHP, all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. They consider the risk highest for mod_php, with a ...

• php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ ...

  Key takeaways CVE - 2026 -109618 and CVE - 2026 -109619 are critical vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. Amazon Threat Intelligence observed an exploitation attempt on October 17, four days before public disclosure.

• Cyware Daily Threat Intelligence - October 18, 2026

  What is CVE - 2026 -108097? Drupal issued an urgent warning that two critical remote code execution issues could enable attackers to take over vulnerable Drupal websites when combined with other modules: CVE - 2026 -108097 (Field UI) and CVE - 2026 -108099 (Entity List).

• Cyware Daily Threat Intelligence - October 16, 2026

  What is CVE - 2026 -102764? A zero-day in BeyondTrust Remote Support let remote attackers perform file operations without credentials, a path to host-level control and access to stored secrets ( CVE - 2026 -102764).

• 19th October - Threat Intelligence Report - Check Point Research

  Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products. The updates address several critical flaws and three zero-days. Among them is CVE - 2026 -96951, an actively exploited Windows Shell ...

• Velma's KEV Report - October 2026 | Rootshell Security

  October's threat intelligence highlights a growing concern for security teams: vulnerabilities affecting the very infrastructure organizations rely on to protect their networks. From remote access gateways and email security appliances to network management platforms and enterprise applications, this month's Velma review identifies 21 priority vulnerability entries, with active ...

• CVE Intelligence Hub: 2026 Critical and High CVE Database | LearnCTEM.com

  Search every Critical and High CVE published in 2026 with CVSS, EPSS, CISA KEV status, CWE, affected versions, references and a CTEM response plan for each.

• PDF TOP ATTACKS AND BREACHES - research.checkpoint.com

  ual machine to its host. The issues include CVE - 2026 -59309 and CVE - 2026 -59310, both car ty On-Premises versions. A remote unauthenticated attacker could execute code with TeamCity server privileges and compromise conn cted build environments. The flaw is fixed in version 2025.11.7 and 2026.1.3. TeamCit

• Weekly Threat Intelligence Report - firecompass.com

  What is known: CVE - 2026 -20079 carries a CVSS score of 10.0 and allows an unauthenticated attacker to obtain root-level control of the underlying operating system, and CVE - 2026 -20316 (CVSS 5.3) exposes static credentials on a low-privileged account.

• Weekly Security Intelligence Briefing -- Week of 2026-09-21

  The week of September 21, 2026 represents one of the most active threat periods recorded in recent quarters. The SCC pipeline processed more than 60 intelligence items spanning critical CVEs , active nation-state campaigns, ransomware incidents, supply chain attacks, and data breaches.

• Unauthenticated command injection on internet-facing mail servers ...

  Microsoft Threat Intelligence identified and tracked exploitation of CVE - 2026 -73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when ...

• Zero-Day Tracker 2026: Actively Exploited Vulnerabilities

  According to Axis Intelligence Research, four of the five logged zero-days carry a federal remediation deadline shorter than the vendor's own CVSS score would suggest. CISA assigned a three-day remediation window to CVE - 2026 -20316, CVE - 2026 -56164 and CVE - 2026 -35616, against the twenty-one-day window it assigned to CVE - 2026 -2441 in February 2026 .

• Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 and CVE-2026-88772

  Proactive Threat Intelligence from the team that finds the vulnerabilities. We publish what is being exploited right now, who is doing it, and whether it reaches you. No vendor summaries written a week late. Home - Vulnerability FAQ - Citrix NetScaler Zero-Day RCE FAQ: CVE - 2026 -88771 and CVE - 2026 -88772 Vulnerability FAQ PublishedSep 27, 2026 · 21:24 UTC Updated Sep 27, 2026

• CVEs 2026 - Page 1 - Threat Intelligence Index

  Browse 64230 CVEs from 2026 .

• 28th September - Threat Intelligence Report - Check Point Research

  Fixes for both vulnerabilities are available. F5 has released fixes for CVE - 2026 -94127, a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager with a CVSS score of 9.8. The actively exploited flaw allows unauthenticated remote code execution when affected systems are configured with an access policy and OAuth profile.

• Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC ...

  CISA has added CVE - 2026 -88771 and CVE - 2026 -88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

• Weekly Threat Intelligence Report - 25 September 2026

  Weekly threat intelligence report covering key cyber threats , malware, ransomware, and vulnerabilities in September 2026 .

• CVE-2026-13016: Vulnerability in ServiceNow ServiceNow AI Platform

  CVE - 2026 -13016 is a critical SQL injection vulnerability in the ServiceNow AI Platform that could permit unauthenticated users to execute arbitrary SQL statements against the instance database. This could lead to unauthorized data access or modification beyond intended scope.

• Vulnerability Trend Report for Q2 2026 - ASEC

  CVE - 2026 -10520. A command injection vulnerability in Ivanti Sentry that allows an unauthenticated threat actor to achieve RCE (remote code execution) at the root privilege level. CVE - 2026 -48172. A privilege escalation vulnerability in the LiteSpeed User-End cPanel Plugin; instances of exploitation in real-world environments have been reported.

• FortiClient EMS Zero-Day CVE-2026-35616 | watchTowr

  On March 31, 2026 , watchTowr's Attacker Eye sensors identified exploitation of a critical zero-day vulnerability in FortiClient EMS, ahead of Fortinet publishing its advisory on April 4, 2026 . The vulnerability has been assigned CVE - 2026 -35616 and carries a CVSS score of 9.1.

• 46 Vulnerability Statistics 2026: Key Trends & Data

  Vulnerability attacks rose 56% in 2025. Explore 46 statistics on CVE disclosure, exploitation patterns, and industry impact to guide your 2026 security strategy.

• PaperCut NG/MF Zero-Day CVE-2026-81578 | watchTowr

  CVE - 2026 -82078 - An authenticated remote code execution vulnerability due to PaperCut NG / MF's external user-lookup database connector, which allows an attacker with configuration access (via CVE - 2026 -81578) to load and execute Java bytecode via a crafted JDBC connection URL, achieving code execution.

• 10th August - Threat Intelligence Report - Check Point Research

  CVE - 2026 -12537, rated CVSS 10.0, affected Gemini CLI workflows, while CVE - 2026 -54316 affected Claude Code. Both vendors released patched versions. Researchers have detailed AI-enabled identity fraud kits that automate know-your-customer bypasses across banks, fintech companies, and cryptocurrency exchanges.

• Cyware Daily Threat Intelligence - September 22, 2026

  BlueMoon exploit kit fuels espionage intrusions BlueMoon exploit kit is a tool adopted by espionage-focused threat actors, suspected to originate from multiple regions, with a primary motive of data theft. BlueMoon chains CVE - 2026 -85046, CVE - 2026 -87491, and CVE - 2026 -85880 to combine browser exploitation, sandbox escape, and privilege escalation.

• LIVECVE — Live Cyber Threat Intelligence

  LIVECVE — Free real-time cybersecurity threat intelligence . Live threat level, breach checker, CVE lookup, AI chatbot, daily alerts.

• cyberupdates365/ai-cyber-threats-and-cve-mitigation-tracker-2026 - GitHub

  2026 Enterprise AI Security & CVE Vulnerability Mitigation Catalog An actively curated threat intelligence repository and architectural defense guide targeting Agentic AI Weaponization, Enterprise Zero-Day CVEs , and Critical IT Infrastructure Attacks in 2026 . Curated and maintained by the CyberUpdates365 Security Research Desk.

• Introducing the 2026 Cloudflare Threat Report

  Get the 2026 Cloudflare Threat Report ... To explore the full data set, deep-dive case studies, and tactical recommendations, read the complete 2026 Cloudflare Threat Report. And if you're interested in learning more about our threat intelligence , managed defense, or incident response offerings, contact Cloudforce One experts.

• Cyware Daily Threat Intelligence - September 11, 2026

  CVE - 2026 -59310 is a path-traversal vulnerability in VMware vCenter Server with a CVSS score of 9.8. Successful exploitation allows attackers to execute code without credentials and seize control of virtualized environments.

• CVE-2026-76460: Cisco ISE Authentication Bypass Exploitation

  According to Bitsight Threat Intelligence Bitsight Threat Intelligence gives CVE - 2026 -76460 a Dynamic Vulnerability Exploit (DVE) score of 10.0 out of 10 and flags it as exploited in the wild. DVE predicts the likelihood of exploitation over the next 90 days.

• CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as ...

  The CrowdStrike 2026 Threat Hunting Report shares observations and real-world case studies demonstrating an increase in attacks on trusted relationships and adversarial use of AI.

• 14th September - Threat Intelligence Report - Check Point Research

  CVE - 2026 -85880 and CVE - 2026 -81963 both allow local attackers to elevate privileges to SYSTEM, while 20 additional flaws could enable unauthenticated remote code execution without user interaction. Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege ( CVE - 2026 -81963))

• Cyware Daily Threat Intelligence - September 01, 2026

  CVE - 2026 -0768is a critical remote code execution vulnerability in the LangflowAI low-code platform, allowing unauthenticated attackers to execute code as root. Successful exploitation provides complete server control, enabling reconnaissance and credential harvesting with downstream impact on connected systems.

• 31th August - Threat Intelligence Report - Check Point Research

  ServiceNow has addressedthree critical vulnerabilities in its AI Platform, CVE - 2026 -18885, CVE - 2026 -18886, and CVE - 2026 -74820, all rated CVSS 10.0. The flaws involve code injection, access control, and SQL injection and can allow unauthenticated attackers to execute code, escalate privileges, or access and modify instance data.

• Weekly Threat Intelligence Report: Late August 2026

  Welcome to the latest CVE WATCHTOWERsecurity briefing. Our weekly threat intelligence report highlights a dangerous surge in cyber threats . Between August 17 and August 23, 2026 , researchers cataloged 3,179 new security vulnerabilities. Therefore, defenders must evaluate new active vulnerability exploits immediately. Threat actors are aggressively targeting cloud infrastructure and machine ...

• Threat Intelligence Brief - Thursday, September 3, 2026 ...

  Threat Radar WordPress migration plugin CVE - 2026 -19949enables unauthenticated SQL injection leading to RCE across 3+ million sites — patch immediately, exploitation status unknown but attack surface is massive. Shai-Hulud infostealeris actively harvesting credentials from 469 locations spanning CI/CD pipelines, cloud configs, and AI tooling — confirmed in-the-wild, direct supply chain and ...

• CVE-2026-82329: JFrog Artifactory Authentication Bypass Exploitation ...

  Attacks targeting JFrog Artifactory ( CVE - 2026 -82329) exploded in 72 hours. Fastly threat intelligence breaks down the mass scanning surge—and how our virtual patch protects you today.

• CVE Brief - September 3, 2026

  10 actively exploited vulnerabilities and 20 additional critical issues and 60 high priority updates for September 3, 2026

• Top CVEs of 2026: Critical Vulnerabilities Every Enterprise Must Patch ...

  From zero-day exploits to actively weaponized flaws, 2026 has already delivered high-severity CVEs targeting enterprise infrastructure. This guide breaks down the most critical CVE vulnerabilities of 2026 , explains their real-world impact, and shows how AI-powered on-device security from Reflex Hive keeps your endpoints protected.

• Vulnerability Intelligence Report — July 3, 2026 - threat-modeling.com

  Vulnerability Intelligence Report — July 3, 2026 New CISA KEV: 0 | KEV deadline TOMORROW: Microsoft SharePoint CVE - 2026 -45659 (deserialization RCE, BOD 26-04) | SimpleHelp deadline: PASSED (July 2) | CitrixBleed: exploited within 24 hours of disclosure | WatchGuard Firebox: RCE in enterprise firewalls | Exchange SSRF: public PoC released Previous report: July 2, 2026 Thursday, July 3, 2026 ...

• Cyware Daily Threat Intelligence - August 11, 2026

  Storm-1175, a China-linked threat actor, is exploiting a critical flaw ( CVE - 2026 -18577) in the N-central RMM console to deploy ransomware by gaining unauthenticated access to servers.

• Cyber Threat Intelligence Feeds — Live APT, Ransomware & CVE Updates

  Real-time cyber threat intelligence feeds covering APT groups, ransomware campaigns, exploited CVEs , malware, and emerging attack patterns. Updated continuously by the Secure Blink threat intelligence team.

• 3rd August - Threat Intelligence Report - Check Point Research

  The campaign harvested Microsoft 365 and Azure AD authentication tokens, enabling account access and session takeover. Researchers profiled a Russian-linked campaign exploiting CVE - 2026 -42897 in Microsoft Outlook Web Access against government and industry targets in the United States and Europe.

• CrowdStrike 2026 Threat Hunting Report

  Methodology & Source: All information provided is based on the CrowdStrike Counter Adversary Operations team's proprietary threat intelligence gathered between July 1, 2025, and June 30, 2026 . Stats may include data from the entire period surveyed or excerpts of data from specific date ranges within the period.

• Nvd - Cve-2026-33017

  This is distinct from CVE -2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.

• 2026 VulnCheck Exploit Intelligence Report

  Research Report 2026 VulnCheck Exploit Intelligence Report 500+ data sources, thousands of exploits, and 48K+ new CVEs : What actually mattered to adversaries in 2025 In 2025, barely 1% of disclosed vulnerabilities were exploited in the wild. Yet those that were exploited were operationalized quickly, attracted diverse threat actors, and often caused outsized damage before organizations had a ...

• 2026 Mid-Year Cyber Threat Landscape Report | CyberProof

  Explore the state of cybersecurity with CyberProof's 2026 Mid-Year Threat Landscape Report, a 1H 2026 analysis. Discover key trends in AI risks, identity compromises, supply chain threats , and global threat actors.

• Weekly Threat Intelligence Report: Mid-August 2026

  Welcome to the latest CVE WATCHTOWER briefing. Our team compiled this weekly threat intelligence report to highlight active cyber risks. Between August 10 and August 16, 2026 , security researchers logged a staggering 3,976 new vulnerabilities. Consequently, security teams must deploy active vulnerability updates immediately to defend enterprise perimeters. Attackers continue to weaponize ...

• Attackers Exploit ServiceNow CVE-2026-6875 via Multiple Sandbox-Escape ...

  ServiceNow CVE - 2026 -6875, a critical unauthenticated RCE in the AI Platform, is under active exploitation. Threat intelligence firm Defused confirmed a second sandbox-escape gadget chain that ...

• Vulnerability Intelligence Report — July 2, 2026 - threat-modeling.com

  Thursday, July 2, 2026 — the SimpleHelp RMM CISA KEV deadline arrives today (CVSS 10.0, MSP supply chain, TaskWeaver loader deployed), but it is already being overshadowed by a new entry: Microsoft SharePoint Server CVE - 2026 -45659, a deserialization remote code execution vulnerability added to the KEV catalog yesterday with a July 4 deadline ...

• Weekly Threat Intelligence Briefing: Late July 2026

  Read our latest weekly threat intelligence briefing. This active vulnerability update reveals critical Microsoft Exchange and Oracle flaws for July 2026 .

• CVE 2026 The Vulnerability Landscape: When Identity Breaks and Legacy ...

  A technical analysis of top 2026 CVEs ( CVE - 2026 -24858, CVE - 2026 -24061) for security engineers. Includes root cause analysis, exploit logic, and automated validation strategies via Penligent.

• 2026H1 Threat Review - forescout.com

  Here are the top cybersecurity and OT security trends in 2026 . It includes data on ransomware, vulnerabilities, threat actors, and the influence of AI.

• July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs - Tenable

  Microsoft patched 569 CVEs in July 2026 , the largest Patch Tuesday release in its history. 56 critical CVEs patched including three zero-day vulnerabilities.

• The CVE Database: Curated Vulnerability Intelligence by Wiz | Wiz

  Wiz's CVE Database curates CVE data to create easy-to-navigate profiles that cover the entire vulnerability timeline, exploit scenarios, and mitigation steps.

• Daily CyberSecurity • Zero-hour alerts. Unmatched analysis.

  Stay ahead with Daily CyberSecurity. We deliver rapid zero-hour alerts and expert analysis on critical vulnerabilities, CVEs , and emerging cyber threats .

• Microsoft Vulnerabilities Report 2026 - A Detailed Analysis

  For the full technical breakdown of every product category, the complete five-year vulnerability trendlines, and detailed guidance from Microsoft security researchers and BeyondTrust's own threat intelligence team, access the 2026 Microsoft Vulnerabilities Report here.

• Critical Patches Issued for Microsoft Products, July 14, 2026

  THREAT INTELLIGENCE : Microsoft reports CVE - 2026 -56164 has been exploited in the wild. CVE - 2026 -56164 may allow remote cyber threat actors to gain unauthorized access to on-premises SharePoint Server instances.

• CISA Adds Four Known Exploited Vulnerabilities to Catalog

  BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

• CVE: Common Vulnerabilities and Exposures

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

• Weekly Threat Intelligence & Active Vulnerability Report

  An unauthenticated attacker can easily execute arbitrary system commands ( CVE - 2026 -8037). Meanwhile, Redsea Cloud eHR suffers from dangerous arbitrary file uploads. Threat actors use this bug to deploy malicious payloads directly. AI Infrastructure Under Ongoing Siege Artificial intelligence tools remain incredibly prime targets.

• Vulnerability Intelligence Report — July 5, 2026 - threat-modeling.com

  Vulnerability Intelligence Report — July 5, 2026 New CISA KEV: 0 | KEV calendar clear for the first time this week | FortiBleed: 74K Fortinet credentials leaked, 12+ orgs hit with ransomware | Oracle EBS Payments CVE - 2026 -46817 (CVSS 9.8) active exploitation attempts | FortiSandbox two CVSS 9.8 vulns under active exploitation | CitrixBleed CVE - 2026 -8451 exploited within 24 hours | WinRAR ...

• Nvd - Cve-2026-22769

  CVE - 2026 -22769 Detail Description Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.

• Vulnerability Intelligence Report — July 6, 2026 - threat-modeling.com

  Vulnerability Intelligence Report — July 6, 2026 New CISA KEV: 0 | KEV calendar still clear | FortiBleed traced to INC and Lynx ransomware | Cisco confirms Unified CM exploitation | Opera GX critical flaw auto-installs malicious mods | North Korean PolinRider: 108 malicious packages | AI-driven ransomware: JadePuffer automates attacks | Oracle EBS Payments under active exploitation Previous ...

• 46 Vulnerability Statistics 2026: Key Trends in Discovery, Exploitation ...

  Vulnerability attacks rose 56% in 2025. Explore 46 statistics on CVE disclosure, exploitation patterns, and industry impact to guide your 2026 security strategy. The post 46 Vulnerability Statistics 2026 : Key Trends in Discovery, Exploitation, and Risk appeared first on Indusface.

• APT28's Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and ...

  The threat actors abuse legitimate cloud storage (filen.io) as command-and-control (C2) infrastructure, blending malicious traffic with normal user activity. Infection chain overview APT28's attack begins with spear-phishing emails containing weaponized documents that exploit CVE - 2026 -21509, a Microsoft Office security feature bypass vulnerability.

• 6th July - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Progress Kemp LoadMaster Commad Injection ( CVE -2024-1212, CVE - 2026 -8037)) THREAT INTELLIGENCE REPORTS Researchers elaborated on a North Korea-aligned supply-chain campaign dubbed PolinRider, which published 108 malicious packages and a Chrome extension across open-source registries.

• THREAT INTELLIGENCE REPORT Windows Remote Desktop Privilege Escalation ...

  A threat actor is allegedly offering a zero-day exploit for CVE - 2026 -21533, a local privilege escalation vulnerability in Windows Remote Desktop Services (RDS), for $220,000 on a dark web forum.

• Introducing the 2026 VulnCheck Exploit Intelligence Report

  In-depth analysis of 2025 CVEs and exploit trends from VulnCheck's research team. The 2026 Exploit Intelligence Report includes an evaluation of the public exploit ecosystem, ransomware and state-sponsored threat actor deep dives, and a data-driven list of 2025's routinely targeted vulnerabilities.

• 22nd June - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Langflow Remote Code Execution ( CVE - 2026 -33017)) THREAT INTELLIGENCE REPORTS Researchers have uncovered the FortiBleed campaign, which converts compromised FortiGate firewalls into passive credential stealers across 24 protocols.

• Vulnerability Intelligence Report — July 4, 2026 - threat-modeling.com

  Vulnerability Intelligence Report — July 4, 2026 New CISA KEV: 0 | KEV deadline TODAY: Microsoft SharePoint CVE - 2026 -45659 — THE LAST ACTIVE KEV | Bad Epoll 0-Day: Linux kernel root escalation ( CVE - 2026 -46242) | Exchange Online + 365 Copilot: critical privilege escalation | FBI TeamPCP: developer tool supply chain attacks | AI Agent poisoning: new attack vector exploiting hidden HTML ...

• PDF Your Weekly Threat Intelligence Advisory

  The first addition, CVE - 2026 -11645, a Google Chromium V8 engine out-of-bounds flaw, allows remote threat actors to achieve code execution by luring victims to a crafted malicious HTML page, escaping the browser sandbox and posing a significant risk to enterprise endpoints.

• Vulnerability Intelligence Report — July 1, 2026 - threat-modeling.com

  Vulnerability Intelligence Report — July 1, 2026 Coverage: July 1, 2026 | CISA KEV additions: 0 (period: SimpleHelp CVE - 2026 -48558, due July 2) | KEV deadline TOMORROW: SimpleHelp (CVSS 10.0, MSP supply chain, TaskWeaver loader) | Chrome: 382 vulnerabilities patched — 15 critical | Adobe ColdFusion: 11 critical — 6 with CVSS 10.0 | Microsoft Defender: second 0-day this week ...

• 29th June - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Langflow Remote Code Execution ( CVE - 2026 -33017)) THREAT INTELLIGENCE REPORTS Researchers have uncovered the FortiBleed campaign, which converts compromised FortiGate firewalls into passive credential stealers across 24 protocols.

• Cyware Daily Threat Intelligence - June 26, 2026

  The issues include CVE - 2026 -13136 (faulty authorization checks that can allow remote file access and DoS), CVE - 2026 -13135 (improper restriction of communication channels that could expose internal services), and CVE -2025-15660 (a weak pseudo-random number generator that could help adjacent attackers access files and trigger DoS). What is Turla?

• SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

  CISA added CVE - 2026 -45659 SharePoint Server RCE to KEV following confirmed exploitation, requiring U.S. agencies to patch by July 4, 2026 .

• Vulnerability Intelligence Report — June 30, 2026 - threat-modeling.com

  The day also brought three additional major active-exploitation reports: Oracle E-Business Suite CVE - 2026 -46817 is being actively exploited (Defused observed attacks on honeypots over the weekend), Microsoft Defender CVE - 2026 -33825 "BlueHammer" — a privilege escalation in Windows' built-in antivirus — is now confirmed in ransomware ...

• Threat intelligence dashboard - Securitricks

  Threat intelligence dashboard Today's CVEs , attack reports, and CISA KEV — CVSS, EPSS, and MITRE context at a glance.

• Nvd - Cve-2026-27960

  An official website of the United States government Here's how you know

• Vulnerability Intelligence Report — June 3, 2026 - threat-modeling.com

  Today — June 3, 2026 — seven CISA KEV remediation deadlines arrive simultaneously, headlined by Microsoft Defender ( CVE - 2026 -41091, CVE - 2026 -45498). CISA added two new entries: an actively exploited Android Framework zero-day ( CVE -2025-48595) and a Linux kernel cgroups privilege escalation ( CVE -2022-0492), both due June 5.

• Vulnerability Intelligence Report — June 26, 2026 - threat-modeling.com

  Vulnerability Intelligence Report — June 26, 2026 Coverage: June 1-26, 2026 | Total CISA KEV additions (period): 22 | New KEVs: 2 (Cisco UCM, PTC Windchill/FlexPLM) | KEV deadline TODAY: QUADRUPLE (Ubiquiti UniFi OS x3 + Lantronix EDS5000 — all BOD 26-04) | Next KEV: Cisco SD-WAN CVE - 2026 -20262 (June 29) + 2 new due June 28 | Total overdue KEVs: 19 (quadruple deadline passes today ...

• Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco ...

  The threat actor used that access to manipulate default account passwords to evade detection. Exploitation of CVE - 2026 -20245: Subsequently, the attacker leveraged a zero-day privilege escalation vulnerability (now tracked as CVE - 2026 -20245) in Cisco Catalyst SD-WAN Manager to gain root-level access via a malicious CSV upload.

• Vulnerability Intelligence Report — June 4, 2026 - threat-modeling.com

  CVE : CVE - 2026 -20230 | Cisco has confirmed that exploit code for this critical vulnerability is publicly available. Unified CM is the call control component of Cisco's collaboration portfolio and is typically deployed as a core infrastructure service with high availability requirements.

• Vulnerability Intelligence Report — June 1, 2026 - threat-modeling.com

  This report covers the threat landscape as of June 1, 2026 . Today marks the CISA KEV remediation deadline for Palo Alto PAN-OS CVE - 2026 -0257 — now confirmed actively exploited by multiple threat actors. WP Maps Pro ( CVE - 2026 -8732) has now been confirmed under active exploitation with attackers creating rogue admin accounts on WordPress sites.

• CVE-2026-35273: Oracle PeopleSoft Zero-Day | Indusface

  According to threat intelligence reports, attackers exploited CVE - 2026 -35273 between May 27 and June 9, 2026 , before Oracle publicly disclosed the vulnerability. The vulnerability has been classified as a Server-Side Request Forgery (SSRF) vulnerability. It exposed PeopleSoft Integration Broker and Environment Management components.

• Threat Intelligence Roundup: ShinyHunters, LangGraph, 200+ Patch ...

  The operational picture from this week's threat intelligence is consistent. ShinyHunters' CVE - 2026 -35273 campaign hit 100+ organizations before patches could contain it. Patch Tuesday's 200+ CVE count suggests AI-assisted vulnerability discovery is producing more research than patch cycles can absorb.

• Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273) - Rapid7

  CVE - 2026 -35273 was reported to Oracle through TrendAI's Zero Day Initiative. According to a report published by Mandiant on June 11, 2026 , this vulnerability has been exploited in the wild as a zero-day prior to the vendor security alert, with active exploitation observed between May 27 and June 9, 2026 , predating Oracle's advisory by two weeks.

• Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week

  Bad actors are exploiting multiple security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber. In a post shared on X, the company said it has observed exploitation of CVE - 2026 -39813, CVE - 2026 -39808, and CVE - 2026 -25089 over the past 24 hours.

• Vulnerability Intelligence Report — June 16, 2026 - threat-modeling.com

  WP MAPS PRO CVE - 2026 -8935 (CVSS 9.8): Critical unauthenticated AJAX vulnerability in WP MAPS PRO before 6.1.1. The plugin registers an AJAX action without authentication and emits a valid nonce on any frontend page, making exploitation trivial.

• Critical Fortinet FortiSandbox flaws now exploited in attacks

  Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused.

• 15th June - Threat Intelligence Report - Check Point Research

  The fixes include CVE - 2026 -45657, a critical Windows flaw with a CVSS score of 9.8 that could enable network-based propagation, CVE - 2026 -41091, which has been actively exploited to gain full system control, and CVE - 2026 -50507, a BitLocker bypass vulnerability. Veeam has released security updates to fix a critical flaw affecting Backup ...

• Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for ...

  Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE - 2026 -20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to ...

• Vulnerability Statistics 2026: CVE, KEV, Time to Exploit

  The public CVE program published 48,185 new vulnerabilities in 2025, a 20.6 percent year-over-year increase on top of the record 38 percent jump in 2024 (40,009 CVEs ). Over the same window, the CISA Known Exploited Vulnerabilities catalog grew roughly 20 percent to 1,484 entries, Google's Threat Intelligence Group counted 90 zero-days exploited in the wild (with enterprise tech hitting an all ...

• CVE-2026-35273: Oracle PeopleSoft Unauth RCE | Horizon3.ai

  Public reporting and threat intelligence indicate the vulnerability has already been exploited in the wild as a zero-day by the ShinyHunters threat group prior to Oracle's advisory. Technical Details CVE - 2026 -35273 affects the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. Key characteristics include:

• Vulnerability Intelligence Report — June 15, 2026 - threat-modeling.com

  Today — Sunday, June 15, 2026 — is the CISA KEV remediation deadline for Oracle PeopleSoft CVE - 2026 -35273. This is the second of the rare weekend double-deadline; Ivanti Sentry CVE - 2026 -10520 passed yesterday. No new CISA KEV entries have been added since June 12, bringing a period of relative calm after the earlier June surge. The weekend vulnerability disclosure cycle is ...

• Russian APT28 Exploit Zero-Day Hours After Microsoft Discloses Office ...

  Russian state-sponsored hacking group APT28 used a critical Microsoft Office zero-day vulnerability, tracked as CVE - 2026 -21509, in less than a day after the vendor publicly disclosed the flaw, launching targeted attacks against Ukrainian government agencies and European Union institutions.

• Vulnerability Intelligence Report — June 2, 2026 - threat-modeling.com

  This report covers the threat landscape as of June 2, 2026 . CISA added Oracle WebLogic ( CVE -2024-21182) to the Known Exploited Vulnerabilities catalog yesterday with a tight June 4 deadline. The Belgian government has issued an urgent warning about active exploitation of a critical Windows Netlogon vulnerability ( CVE - 2026 -41089, CVSS 9.8).

• 23rd March - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (GNU inetutils Buffer Overflow ( CVE - 2026 -32746)) THREAT INTELLIGENCE REPORTS Check Point researchers have analyzed recent developments in the Telegram cybercrime scene, after the company had bolstered its moderation tools due to extensive criticism of allowing criminal behavior.

• Oracle PeopleSoft PeopleTools Zero-Day (CVE-2026-35273) Actively ...

  This vulnerability, tracked as CVE - 2026 -35273, enables unauthenticated remote code execution (RCE) via HTTP/HTTPS and is being actively exploited in the wild. Multiple threat intelligence sources confirm that sophisticated ransomware and data extortion groups, including Cl0p and ShinyHunters, are leveraging this flaw to compromise enterprise ...

• CVE Crowd | Crowd Intelligence on CVEs

  The ShinyHunters threat group has exploited a critical zero-day vulnerability ( CVE - 2026 -35273) in Oracle PeopleSoft to target over 100 organizations, primarily in the higher education sector. Mandiant reports that attackers used this remote-code execution flaw to compromise systems and steal sensitive data for potential phishing and extortion.

• Latest Threat Intelligence: Attack Deconstruction of CVE-2026-42271

  A deep technical reverse-engineering of the CVE - 2026 -42271 & CVE - 2026 -48710 unauthenticated RCE chain, and how Australian Local Governments can proactively secure their AI APIs.

• 2026 Vulnerability Report: 5 Critical Exploitation Trends

  Read the 2026 Vulnerability Report. Discover why exploit velocity outpaced patching and how to secure edge devices against zero-day threats .

• Oracle PeopleSoft Zero-Day Vulnerability (CVE-2026-35273) Exploited by ...

  On June 11th, Mandiant and Google Threat Intelligence Group (GTIG) published a report confirming that exploitation of the flaw has been ongoing since at least May 27th, marking it a zero-day. The identified attacks were attributed to ShinyHunters, who leveraged CVE - 2026 -35273 as an initial access method to conduct data extortion attacks.

• 8th June - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Microsoft Windows Netlogon Remote Code Execution ( CVE - 2026 -41089)) THREAT INTELLIGENCE REPORTS Check Point Research has investigated a large-scale impersonation and click-hijacking scheme that reroutes downloads from fake open-source sites through a gated traffic distribution system.

• ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to ...

  Oracle PeopleSoft zero-day CVE - 2026 -35273 was exploited before Oracle's June 10 advisory, exposing data and triggering extortion attacks.

• Vulnerability Intelligence Report — June 12, 2026 - threat-modeling.com

  CVE : CVE - 2026 -44716 Fixable: Yes — upgrade to 1.2.0+ Business Impact: HIGH. Unauthenticated arbitrary file read via path traversal in dev runner (-folder flag). Exposes SSH keys, credentials, system files. AI development environments targeted. How to Fix: Upgrade to Pipecat 1.2.0. Never expose dev runner to untrusted networks.

• PDF 2026 Global Threat Intelligence Report

  In 2026 , cloud misconfigurations will continue to be a leading cybersecurity threat , despite increasing awareness and investment in cloud security. As organizations expand their use of complex, multi-cloud environments, the overall attack surface grows— introducing more potential entry points and vulnerabilities than ever before.

• Weekly Threat Intelligence & Vulnerability Management Report

  Emerging Zero-Day Threats in the Wild Our dedicated weekly threat intelligence radar also detected highly dangerous exploits actively circulating in the wild. Notably, the popular Kirki WordPress plugin currently harbors a critical privilege escalation bug ( CVE - 2026 -8206 -admin).

• Vulnerability Intelligence Report — May 30, 2026 - threat-modeling.com

  This report covers new vulnerability disclosures and active threat intelligence surfaced between May 29 and 30, 2026 . A significant CISA KEV addition — Palo Alto PAN-OS — carries a June 1 remediation deadline just two days from now.

• CISA KEV Threat Alert: Weaponized CVE-2026-28318 ... - LinkedIn

  CRITICAL ARCHITECTURAL COMPROMISE ADVISORY: On June 5, 2026 , CISA officially updated its Known Exploited Vulnerabilities (KEV) Catalog to include CVE - 2026 -28318, a high-severity uncontrolled ...

• Nvd - Cve-2026-5426

  This is a potential security issue, you are being redirected to https://nvd.nist.gov

• 1st June - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Ghost SQL Injection ( CVE - 2026 -26980)) THREAT INTELLIGENCE REPORTS Researchers attributed a destructive campaign against LA Metro to an Iran-linked intelligence operation using the Ababil of Minab persona.

• Vulnerability Intelligence Report - May 26, 2026 - Threat-Modeling.com

  Perl Text-CSV_XS - CVE - 2026 -7111 (CVSS 8.4 - HIGH) Affected software: Perl Text::CSV_XS, versions before 1.62 Description: Use-after-free when registered callbacks extend the Perl argument stack, potentially enabling type confusion or memory corruption. Affects the Parse, print, getline, and getline_all methods when callbacks are registered.

• 25th May - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Drupal Core SQL Injection ( CVE - 2026 -9082)) THREAT INTELLIGENCE REPORTS Check Point Research has revealed new campaigns of Nimbus Manticore, an IRGC-linked group that resurfaced during Operation Epic Fury with upgraded techniques.

• More CVEs, Same Playbook: 2026 Vulnerability Exploitation ... - Proofpoint

  All CVE - 2026 -21509 and CVE - 2026 -21510 messages targeting Proofpoint customers were blocked at delivery. Indicators of compromise for the associated campaign are available to Proofpoint Threat Intelligence subscribers.

• Amazon threat intelligence teams identify Interlock ransomware campaign ...

  Amazon threat intelligence has identified an active Interlock ransomware campaign exploiting CVE - 2026 -20131, a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device, which was disclosed by Cisco on March 4 ...

• Active Exploitation of CVE-2026-5426 in KnowledgeDeliver LMS Enables ...

  Exploitation in the Wild The first confirmed exploitation of CVE - 2026 -5426 was reported by Mandiant in late 2025, with subsequent incidents tracked by Google Cloud Threat Intelligence and other security researchers. The majority of observed attacks have targeted Japanese organizations, reflecting the primary deployment base of KnowledgeDeliver LMS.

• One threat actor responsible for 83% of recent Ivanti RCE attacks

  Update: The article initially listed the wrong CVEs . This has now been corrected to list the CVEs : CVE - 2026 -1286 and CVE - 2026 -1340 Threat intelligence observations show that a single threat actor ...

• Vulnerability Intelligence Report — May 22, 2026 - threat-modeling.com

  Threat Intelligence Brief — May 22, 2026 Coverage: May 21-22, 2026 | New CVEs this report: 9 | Updated entries from previous report: 3 Previous report (May 21, 2026 ): Vulnerability Intelligence Report — May 21, 2026 Items already covered in depth in the May 21 report and carrying forward without major new information are noted at the bottom of this post with update summaries where ...

• Proactive Breach Detection for May 2026 Cyber Threats

  Such intelligence forms the basis for effective cyber threat intelligence platform operations and proactive breach detection. What is the Impact of CVE - 2026 -42897 on Microsoft Exchange Servers?

• CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV ...

  As for CVE -2020-7796, a report published by threat intelligence firm GreyNoise in March 2025 revealed that a cluster of about 400 IP addresses was actively exploiting multiple SSRF vulnerabilities, including CVE -2020-7796, to target susceptible instances in the U.S., Germany, Singapore, India, Lithuania, and Japan.

• Vulnerability Reports - Latest network security threats and zeroday ...

  Talos investigates software and operating system vulnerabilities in order to discover them before malicious threat actors do. We provide this information to vendors so that they can create patches and protect their customers as soon as possible.

• Vulnerability Intelligence Report — May 23, 2026 - threat-modeling.com

  Threat Intelligence Brief — May 23, 2026 Coverage: May 22-23, 2026 | New CVEs this report: 7 | New supply chain incidents: 2 Previous reports: May 22, 2026 | May 21, 2026 This report covers new vulnerability disclosures and security incidents identified on May 22 and 23, 2026 . Items that were covered in earlier reports and carry no major new information are summarised with update notes at ...

• CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege ...

  A high-severity Linux vulnerability, "Copy Fail" ( CVE - 2026 -31431), enables root privilege escalation across cloud environments and Kubernetes workloads. With a working exploit already in the wild, organizations should act quickly to detect, mitigate, and reduce risk.

• Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find

  CVE Find is a cybersecurity intelligence platform indexing CVEs , CWEs, CAPEC, CVSS, EPSS and threat data. Search, track, and analyze known vulnerabilities and exploit risks.

• 4th May - Threat Intelligence Report - Check Point Research

  AI THREATS Researchers pinpointed CVE - 2026 -26268, a flaw in Cursor's coding environment that enables remote code execution when its AI agent interacts with a cloned malicious repository. The attack chains Git hooks and bare repositories to run attacker scripts, risking exposure of source code, tokens, and internal tools.

• APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware ...

  The Russia-linked state-sponsored threat actor known as APT28 (aka UAC-0001) has been attributed to attacks exploiting a newly disclosed security flaw in Microsoft Office as part of a campaign codenamed Operation Neusploit. Zscaler ThreatLabz said it observed the hacking group weaponizing the shortcoming on January 29, 2026 , in attacks targeting users in Ukraine, Slovakia, and Romania, three ...

• 18th May - Threat Intelligence Report - Check Point Research

  Check Point IPS provides protection against this threat (Nginx Heap Overflow ( CVE - 2026 -42945)) Cisco has addressed CVE - 2026 -20182, a critical authentication bypass in Catalyst SD-WAN controllers that is being actively exploited. The flaw allows remote, unauthenticated attackers to gain full administrative control of affected systems.

• Active attack: Dirty Frag Linux vulnerability expands post-compromise ...

  Similar to the previously disclosed CopyFail vulnerability ( CVE - 2026 -31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.

• Zeltoc/threat-intel-brief-cve-2026-42208-litellm - GitHub

  About Threat intelligence brief on CVE - 2026 -42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. Covers attack path, detection opportunities, and recommended actions.

• Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for ...

  Security analysts can use natural language to prompt the Cortex AgentiX Threat Intel agent for a quick summary of sightings in their Cortex environment, to retrieve tenant-specific and global threat intelligence information for CVE - 2026 -0300.

• UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day ...

  Introduction Mandiant and Google Threat Intelligence Group (GTIG) have identified the zero-day exploitation of a high-risk vulnerability in Dell RecoverPoint for Virtual Machines, tracked as CVE - 2026 -22769, with a CVSSv3.1 score of 10.0.

• Zero-Day Threat Report May 2026 - CVEs, Exploits & Remediation ...

  Introduction: The Zero-Day Threat Landscape in 2026 Zero-day exploits are no longer rare, high-precision weapons reserved for nation-state actors. In 2025, Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities actively exploited in the wild — a 15% increase over 2024 — and the pace in 2026 shows no signs of slowing. Perhaps most alarming, 48% of those exploited zero-days ...

• CVE-2026-46333: Local Root Privilege Escalation and Credential ...

  The Qualys Threat Research Unit (TRU) has discovered and published the full advisory for CVE - 2026 -46333, a logic flaw in the Linux kernel's __ptrace_may_access () function that permits an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions.

• Quantifying 2026 Routinely Targeted Vulnerabilities (So Far)

  A trio of vulnerabilities in SmarterTools SmarterMail ( CVE -2025-52691, CVE - 2026 -23760, and CVE - 2026 -24423) disclosed between late December 2025 and late January 2026 have seen exploitation by Iranian and (multiple) Chinese-backed threat actors, as well as the Qilin and Warlock ransomware families; VulnCheck's Canary Intelligence network has ...

• Vulnerability Intelligence Report — May 21, 2026 - threat-modeling.com

  🔴 CVE - 2026 -45498 — Microsoft Defender Denial of Service (Actively Exploited)

• FIRST Releases 2026 Vulnerability Report, Projecting Record-Breaking ...

  The organizations that recover fastest are the ones with trusted networks already in place, sharing threat intelligence and coordinating response before a crisis hits," said Chris Gibson, CEO, FIRST. Looking Ahead Throughout 2026 , FIRST will publish quarterly forecast updates that refine predictions as new data arrives.

• The AI Inversion: 2026's Most Dangerous Cyber Attacks | Foresiet
  web:foresiet.com

  AI -enabled attacks rose 89% this year. Explore 9 verified incidents from 2026 , including autonomous breaches and data leaks, and learn how to protect your organization.

  2026-05-24 14:43 UTC
• CVE-2026-26133: M365 Copilot AI Command Injection - What It Means for ...
  web:integsec.com

  Meta Description: CVE - 2026 -26133 exposes Microsoft 365 Copilot users to AI command injection risks, threatening data leaks in businesses. Learn business impacts and response steps.

  2026-05-24 14:43 UTC
• CVE-2026-33626: AI Inference SSRF Exploited Within 12 Hours
  web:labs.cloudsecurityalliance.org

  CVE - 2026 -33626: AI Inference SSRF Exploited Within 12 Hours Key Takeaways The LMDeploy CVE - 2026 -33626 incident makes a pattern unambiguous: the window between public vulnerability disclosure and in-the-wild exploitation of AI infrastructure flaws has collapsed to hours, not days.

  2026-05-24 14:43 UTC
• Exchange CVE-2026-42897 Zero-Day Exploit: Activ… | PurpleOps
  web:purple-ops.io

  Critical Microsoft Exchange zero-day CVE - 2026 -42897 exploited in active attacks. Learn XSS vulnerability details and essential mitigation steps.

  2026-05-24 14:43 UTC
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
  web:techcommunity.microsoft.com

  On May 14, 2026 , Microsoft disclosed CVE - 2026 -42897, a reported vulnerability affecting Exchange Outlook Web Access (OWA). An attacker could exploit this issue by sending a specially crafted email to a user.

  2026-05-24 14:43 UTC
• Microsoft Patch Tuesday, April 2026 Security Update Review
  web:threatprotect.qualys.com

  Zero-day Vulnerabilities Patched in April Patch Tuesday Edition CVE - 2026 -33825: Microsoft Defender Elevation of Privilege Vulnerability Microsoft Defender is a comprehensive, AI -powered security suite that provides malware protection, phishing detection, and web protection for individuals and businesses.

  2026-05-24 14:43 UTC
• Known Exploited Vulnerabilities Catalog - CISA
  web:www.cisa.gov

  For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.

  2026-05-24 14:43 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  CVE ™ Program Mission Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There are currently over 334,000 CVE Records accessible via Download or Keyword Search above. The CVE Program partners with community members worldwide to grow CVE content and expand its usage.

  2026-05-24 14:43 UTC
• Weekly Threat Bulletin - May 20th, 2026 | F5 Labs
  web:www.f5.com

  Severity: Critical Threat Details and IOCs ... Mitigation Advice Immediately apply the security patches released by Cisco for all vulnerable Catalyst SD-WAN Controller and Manager devices, prioritizing CVE - 2026 -20182 and CVE - 2026 -20127.

  2026-05-24 14:43 UTC
• CVE 2026 — The Vulnerabilities That Matter Most Right Now
  web:www.penligent.ai

  A fact-checked technical guide to the most important CVE 2026 vulnerabilities so far, including Chrome, Android, Cisco SD-WAN, VMware Aria Operations, and AI framework risk, with practical remediation , detection ideas, and defensive validation workflows.

  2026-05-24 14:43 UTC

Only Available for Registered Users. Sign in to view.