Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

AutoJack: How a single page can RCE the host running your AI agent

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code executio…

VULNRecorded Future4 months ago

FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems

A dataset containing valid administrative and VPN credentials for tens of thousands of Fortinet FortiGate firewalls.

VULNMicrosoft Security4 months ago

New Forrester Total Economic Impact™ study projects a 124% ROI from unifying with Microsoft Security

New Forrester Total Economic Impact™ study shows Microsoft Security consolidation delivers ROI, lowers risk, and prepares organiza…

VULNMicrosoft Security4 months ago

From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

A poisoned npm package infected 140+ projects with a hidden payload. This report highlights how to detect, hunt, and defend agains…

VULNRecorded Future4 months ago

KlueセキュリティインシデントとRecorded Futureへの影響

透明性は私たちの企業運営の根幹をなすものです。最近発生したサードパーティベンダーによるセキュリティインシデントに関する声明をご覧ください。調査結果および、お客様の情報を保護するために講じた対策について記載しております。

VULNRecorded Future4 months ago

The Klue Security Incident and Its Impact on Recorded Future

Transparency is core to how we operate. Read our statement on a recent third-party vendor security incident, including our finding…

VULNMicrosoft Security4 months ago

Crypto Clipper uses Tor and worm-like propagation for persistence and control

Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-ba…

VULNMicrosoft Security4 months ago

Beyond the benchmark: Advancing security at AI speed

Read how Microsoft Security has advanced its agentic vulnerability detection system, codename MDASH, integrating into real-world w…

VULNMicrosoft Security4 months ago

Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report

Microsoft has been named a Leader in The Forrester Wave™: Extended Detection and Response Platforms, Q2 2026. The post Forrester…

VULNCheck Point Research4 months ago

From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker

Key Points Introduction In this research, we analyze a clipboard hijacker campaign that is hidden inside a collection of “solution…

VULNRecorded Future4 months ago

State Digital Surveillance Risk Landscape

Explore the state digital surveillance risk landscape. Learn how governments use spyware, AI, and network interception to monitor…

VULNPalo Alto Unit 424 months ago

Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE

Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article f…

VULNhighFull Disclosure4 months ago

SEC Consult SA-20260615-1 :: Multiple Vulnerabilities in Wertheim SafeController Hardware for VAULT ROOMS (Safe Deposit Locker System – Microcontroller)

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 15 SEC Consult Vulnerability Lab Security Advisory ============…

VULNcriticalFull Disclosure4 months ago

SEC Consult SA-20260615-0 :: Multiple Critical Vulnerabilities in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 15 SEC Consult Vulnerability Lab Security Advisory ============…

VULNCVE-2026-240668.4 HIGHFull Disclosure4 months ago

SEC Consult SA-20260610-0 :: Local Privilege Escalation in Slate Digital Connect (macOS)

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 15 SEC Consult Vulnerability Lab Security Advisory ============…

VULNhighCVE-2026-240647.8 HIGHFull Disclosure4 months ago

SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 15 SEC Consult Vulnerability Lab Security Advisory ============…

VULNhighFull Disclosure4 months ago

[KIS-2026-11] Discuz! <= X5.0 (enable_disable.php) Local File Inclusion Vulnerability

Posted by Egidio Romano on Jun 15 ----------------------------------------------------------------------- https://www.discuz.vip…

VULNhighFull Disclosure4 months ago

[KIS-2026-10] Discuz! <= X5.0 OCR-based CAPTCHA Bypass Vulnerability

Posted by Egidio Romano on Jun 15 ------------------------------------------------------ https://www.discuz.vip [-] Affected Vers…

VULNhighFull Disclosure4 months ago

[KIS-2026-09] Discuz! X5.0 (UC_KEY) Cross-Context Token Reuse Vulnerability

Posted by Egidio Romano on Jun 15 ------------------------------------------------------------- https://www.discuz.vip [-] Affect…

VULNRecorded Future4 months ago

The Intelligence No One Else Has: Inside Recorded Future’s Proprietary Collection Engine

Learn how Recorded Future’s proprietary collection engine empowers organizations to move beyond reactive security. Discover the po…

VULNPalo Alto Unit 424 months ago

Inside the Modern SOC: The 72-Minute Race

Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-dri…

VULNMandiant4 months ago

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of Chin…

VULNCheck Point Research4 months ago

15th June – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTA…

VULNPalo Alto Unit 424 months ago

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn…

VULNhighCVE-2026-202539.8 CRITICALwatchTowr Labs4 months ago

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)

Three posts in three days? Are we insane? We're home alone, there's no-one to stop us, and we're up past bed time. So, we need to…

VULNhighCVE-2026-507519.3 CRITICALwatchTowr Labs5 months ago

Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the b…

VULNhighCVE-2026-352739.8 CRITICALMandiant5 months ago

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

Introduction Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attr…

VULNhighCheck Point Research5 months ago

From SQLi to RCE – Exploiting LangGraph’s Checkpointer

By Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store…

VULNSentinelOne Labs5 months ago

LABScon25 Replay | Keynote: Steps to an Ecology of Cyber

Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the cas…

VULNPalo Alto Unit 425 months ago

Trust No Skill: Integrity Verification for AI Agent Supply Chains

Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage att…

Vulnerability Alerts

AutoJack: How a single page can RCE the host running your AI agent

FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems

New Forrester Total Economic Impact™ study projects a 124% ROI from unifying with Microsoft Security

From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

KlueセキュリティインシデントとRecorded Futureへの影響

The Klue Security Incident and Its Impact on Recorded Future

Crypto Clipper uses Tor and worm-like propagation for persistence and control

Beyond the benchmark: Advancing security at AI speed

​​Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report

From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker

State Digital Surveillance Risk Landscape

Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE

SEC Consult SA-20260615-1 :: Multiple Vulnerabilities in Wertheim SafeController Hardware for VAULT ROOMS (Safe Deposit Locker System – Microcontroller)

SEC Consult SA-20260615-0 :: Multiple Critical Vulnerabilities in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System)

SEC Consult SA-20260610-0 :: Local Privilege Escalation in Slate Digital Connect (macOS)

SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central

[KIS-2026-11] Discuz! <= X5.0 (enable_disable.php) Local File Inclusion Vulnerability

[KIS-2026-10] Discuz! <= X5.0 OCR-based CAPTCHA Bypass Vulnerability

[KIS-2026-09] Discuz! X5.0 (UC_KEY) Cross-Context Token Reuse Vulnerability

The Intelligence No One Else Has: Inside Recorded Future’s Proprietary Collection Engine

Inside the Modern SOC: The 72-Minute Race

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

15th June – Threat Intelligence Report

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)

Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

From SQLi to RCE – Exploiting LangGraph’s Checkpointer

LABScon25 Replay | Keynote: Steps to an Ecology of Cyber

Trust No Skill: Integrity Verification for AI Agent Supply Chains

Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report