{"updated":1794528038,"since":1792770395,"buildMs":36358,"sources":[{"name":"BleepingComputer","ok":true,"count":15},{"name":"The Hacker News","ok":true,"count":50},{"name":"Krebs on Security","ok":true,"count":2},{"name":"SecurityWeek","ok":true,"count":10},{"name":"Dark Reading","ok":true,"count":27},{"name":"Help Net Security","ok":true,"count":10},{"name":"The Register","ok":true,"count":35},{"name":"SANS ISC","ok":true,"count":10},{"name":"CyberScoop","ok":true,"count":10},{"name":"CISA Advisories","ok":true,"count":8},{"name":"CISA KEV","ok":true,"count":1779,"cached":true},{"name":"NVD","ok":true,"count":15},{"name":"SonicWall PSIRT","ok":true,"count":5,"vendor":true},{"name":"Microsoft MSRC","ok":true,"count":386,"vendor":true},{"name":"Ubiquiti","ok":true,"count":5,"vendor":true},{"name":"PHP.net","ok":true,"count":1,"vendor":true},{"name":"WordPress.org","ok":true,"count":3,"vendor":true},{"name":"Wordfence","ok":true,"count":4,"vendor":true},{"name":"FIRST EPSS","ok":true,"count":69}],"outlets":[{"id":"bleeping","name":"BleepingComputer","color":"#3b82f6"},{"id":"thn","name":"The Hacker News","color":"#ef4444"},{"id":"krebs","name":"Krebs on Security","color":"#a3a3a3"},{"id":"secweek","name":"SecurityWeek","color":"#f59e0b"},{"id":"darkread","name":"Dark Reading","color":"#8b5cf6"},{"id":"helpnet","name":"Help Net Security","color":"#10b981"},{"id":"register","name":"The Register","color":"#dc2626"},{"id":"sans","name":"SANS ISC","color":"#0ea5e9"},{"id":"cyberscoop","name":"CyberScoop","color":"#ec4899"},{"id":"cisa","name":"CISA Advisories","color":"#2563eb"}],"topics":[{"label":"Microsoft","outlets":["helpnet","secweek","bleeping","darkread","thn","register","sans","krebs","cyberscoop"],"count":23,"articles":[1,7,9,10,14,18,22,30],"cves":["CVE-2026-124194","CVE-2026-119958","CVE-2026-116928","CVE-2026-118207","CVE-2026-109459","CVE-2026-119967"],"kev":true,"latest":1794525323,"score":137,"heat":"major"},{"label":"ConnectWise","outlets":["bleeping","cyberscoop","thn","register","secweek"],"count":7,"articles":[3,6,36,37,54,66,72],"cves":["CVE-2026-84869"],"kev":true,"latest":1794523990,"score":87,"heat":"major"},{"label":"OpenAI / AI agents","outlets":["helpnet","register","bleeping","darkread","thn"],"count":8,"articles":[0,8,9,15,52,91,107,130],"cves":[],"kev":false,"latest":1794527143,"score":74,"heat":"major"},{"label":"Google Chrome","outlets":["secweek","sans","register","thn"],"count":4,"articles":[32,78,116,131],"cves":["CVE-2026-125350","CVE-2026-124194","CVE-2026-119958","CVE-2026-109459","CVE-2026-119967","CVE-2026-116710"],"kev":true,"latest":1794490929,"score":71,"heat":"hot"},{"label":"GitHub","outlets":["bleeping","secweek","thn","darkread"],"count":5,"articles":[4,33,64,107,120],"cves":[],"kev":false,"latest":1794522330,"score":58,"heat":"hot"},{"label":"N-able","outlets":["bleeping","thn","secweek","darkread"],"count":5,"articles":[12,46,57,77,132],"cves":[],"kev":false,"latest":1794513076,"score":58,"heat":"hot"},{"label":"Palo Alto","outlets":["helpnet","cisa"],"count":3,"articles":[28,41,42],"cves":["CVE-2026-109618","CVE-2026-109619","CVE-2026-111497"],"kev":true,"latest":1794495629,"score":49,"heat":"warm"},{"label":"Node.js","outlets":["cisa","thn"],"count":2,"articles":[40,63],"cves":["CVE-2026-111497"],"kev":true,"latest":1794484800,"score":47,"heat":"warm"},{"label":"Apache","outlets":["bleeping","secweek","thn"],"count":3,"articles":[13,24,65],"cves":["CVE-2026-119618"],"kev":false,"latest":1794510775,"score":44,"heat":"hot"},{"label":"Cisco","outlets":["thn","cisa"],"count":2,"articles":[90,122],"cves":["CVE-2026-20320","CVE-2026-111560","CVE-2026-111793","CVE-2026-116606","CVE-2026-124194","CVE-2026-125350"],"kev":true,"latest":1794377042,"score":39,"heat":"warm"},{"label":"Barracuda","outlets":["register","cisa"],"count":2,"articles":[106,122],"cves":["CVE-2026-116606","CVE-2026-111560","CVE-2026-20320","CVE-2026-111793","CVE-2026-124194","CVE-2026-125350"],"kev":true,"latest":1794336695,"score":39,"heat":"warm"},{"label":"Linux","outlets":["thn","bleeping"],"count":2,"articles":[17,58],"cves":[],"kev":false,"latest":1794506571,"score":32,"heat":"warm"}],"cves":{"CVE-2026-124194":{"id":"CVE-2026-124194","title":"Microsoft Office","titleSrc":"kev","products":["Microsoft Office"],"name":"Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability","desc":"Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.","cvss":6.5,"severity":"MEDIUM","published":"2026-11-10T19:20:48","kev":{"added":"2026-11-10","due":"2026-11-24","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.016199999999999999122923810546126333065330982208251953125,"epssPct":0.76419000000000003591793529267306439578533172607421875,"outlets":["sans","register","krebs","cyberscoop","cisa"],"articles":[78,94,96,98,122],"firstSeen":1794340816,"score":116,"buzz":"major","advisories":[2]},"CVE-2026-125350":{"id":"CVE-2026-125350","title":"Google Chromium","titleSrc":"kev","products":["Google Chromium","google chrome"],"name":"Google Chromium Use-After-Free Vulnerability","desc":"Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-11-10T18:17:35","kev":{"added":"2026-11-10","due":"2026-11-24","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.0096200000000000000788258347483861143700778484344482421875,"epssPct":0.62112000000000000543565192856476642191410064697265625,"outlets":["krebs","register","cisa","thn"],"articles":[96,116,122,131],"firstSeen":1794297619,"score":111,"buzz":"major","advisories":[]},"CVE-2026-116606":{"id":"CVE-2026-116606","title":"Barracuda Networks Barracuda Email Security Gateway (ESG)","titleSrc":"kev","products":["Barracuda Networks Barracuda Email Security Gateway (ESG)","barracuda email security gateway 300 firmware","barracuda email security gateway 300","barracuda email security gateway 400 firmware","barracuda email security gateway 400","barracuda email security gateway 600 firmware","barracuda email security gateway 600"],"name":"Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability","desc":"Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-02T13:17:37","kev":{"added":"2026-11-10","due":"2026-11-13","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.0893400000000000027444713168733869679272174835205078125,"epssPct":0.9531300000000000327560201185406185686588287353515625,"outlets":["register","cisa"],"articles":[106,122],"firstSeen":1793728810,"score":101,"buzz":"major","advisories":[]},"CVE-2026-102895":{"id":"CVE-2026-102895","title":"GPUStack GPUStack","titleSrc":"kev","products":["GPUStack GPUStack","gpustack gpustack"],"name":"GPUStack Improper Authentication Vulnerability","desc":"GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-04T22:17:44","kev":{"added":"2026-11-09","due":"2026-11-12","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.005170000000000000116295861829485147609375417232513427734375,"epssPct":0.444859999999999977671194528738851658999919891357421875,"outlets":["sans","cisa"],"articles":[45,156],"firstSeen":1794243619,"score":94,"buzz":"major","advisories":[]},"CVE-2026-123218":{"id":"CVE-2026-123218","title":"IBM Aspera Faspex","titleSrc":"kev","products":["IBM Aspera Faspex"],"name":"IBM Aspera Faspex Incorrect Authorization Vulnerability","desc":"IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-07T04:17:28","kev":{"added":"2026-11-09","due":"2026-11-12","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.005349999999999999721056465062929419218562543392181396484375,"epssPct":0.456249999999999988897769753748434595763683319091796875,"outlets":["thn","cisa"],"articles":[133,156],"firstSeen":1794027612,"score":94,"buzz":"major","advisories":[]},"CVE-2026-123158":{"id":"CVE-2026-123158","title":"OpenBSD OpenSSH","titleSrc":"kev","products":["OpenBSD OpenSSH","openbsd openssh","alpinelinux alpine linux"],"name":"OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability","desc":"OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-05T16:17:47","kev":{"added":"2026-11-09","due":"2026-11-12","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.189000000000000001332267629550187848508358001708984375,"epssPct":0.97335000000000004849454171562683768570423126220703125,"outlets":["cisa","sans"],"articles":[156,163],"firstSeen":1793970013,"score":93,"buzz":"major","advisories":[]},"CVE-2026-111560":{"id":"CVE-2026-111560","title":"Barracuda Networks Multiple Products","titleSrc":"kev","products":["Barracuda Networks Multiple Products"],"name":"Barracuda Networks Multiple Products OS Command Injection Vulnerability","desc":"Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted…","cvss":8.5999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-02T13:17:35","kev":{"added":"2026-11-10","due":"2026-11-13","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.06196000000000000118571819029966718517243862152099609375,"epssPct":0.93603000000000002867039938792004249989986419677734375,"outlets":["register","cisa"],"articles":[106,122],"firstSeen":1794337219,"score":92,"buzz":"major","advisories":[]},"CVE-2026-116779":{"id":"CVE-2026-116779","title":"SignalWire FreeSwitch","titleSrc":"kev","products":["SignalWire FreeSwitch","freeswitch freeswitch"],"name":"SignalWire FreeSwitch Code Injection Vulnerability","desc":"SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-05T20:17:44","kev":{"added":"2026-11-09","due":"2026-11-12","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.0247299999999999985111909239776650792919099330902099609375,"epssPct":0.84758999999999995456079204814159311354160308837890625,"outlets":["cisa"],"articles":[156],"firstSeen":1794243619,"score":88,"buzz":"","advisories":[]},"CVE-2026-84869":{"id":"CVE-2026-84869","title":"ConnectWise ScreenConnect","titleSrc":"kev","products":["ConnectWise ScreenConnect","connectwise screenconnect"],"name":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","desc":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.","cvss":9.9000000000000003552713678800500929355621337890625,"severity":"CRITICAL","published":"2026-09-08T20:18:51","kev":{"added":"2026-09-11","due":"2026-09-14","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.00923999999999999994948485237955537741072475910186767578125,"epssPct":0.60907999999999995477395486886962316930294036865234375,"outlets":["cyberscoop","thn"],"articles":[6,36],"firstSeen":1794502809,"score":87,"buzz":"major","advisories":[]},"CVE-2026-20320":{"id":"CVE-2026-20320","title":"Cisco BroadWorks","titleSrc":"kev","products":["Cisco BroadWorks","cisco broadworks application delivery platform","cisco broadworks application server","cisco broadworks profile server","cisco broadworks xtended services platform"],"name":"Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability","desc":"Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.","cvss":7.5,"severity":"HIGH","published":"2026-08-19T17:18:40","kev":{"added":"2026-11-10","due":"2026-11-24","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.00820000000000000069111383282915994641371071338653564453125,"epssPct":0.57738999999999995882404846270219422876834869384765625,"outlets":["thn","cisa"],"articles":[90,122],"firstSeen":1794344409,"score":87,"buzz":"major","advisories":[]},"CVE-2025-31324":{"id":"CVE-2025-31324","title":"SAP NetWeaver","titleSrc":"kev","products":["SAP NetWeaver","sap netweaver"],"name":"SAP NetWeaver Unrestricted File Upload Vulnerability","desc":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.","cvss":10,"severity":"CRITICAL","published":"2025-04-24T17:15:35","kev":{"added":"2025-04-29","due":"2025-05-20","ransomware":true,"action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."},"epss":0.99485999999999996656896428248728625476360321044921875,"epssPct":0.99943999999999999506172798646730370819568634033203125,"outlets":["sans"],"articles":[143],"firstSeen":1794250813,"score":80,"buzz":"","advisories":[]},"CVE-2026-111497":{"id":"CVE-2026-111497","title":"Google Brotli","titleSrc":"kev","products":["Google Brotli","google brotli","nodejs node.js","python-hyper brotlicffi","microsoft .net","debian debian linux","istio istio"],"name":"Google Brotli Unchecked Return Value Vulnerability","desc":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","cvss":9.199999999999999289457264239899814128875732421875,"severity":"CRITICAL","published":"2026-10-22T14:17:37","kev":{"added":"2026-10-27","due":"2026-11-10","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.82640999999999997793764805464888922870159149169921875,"epssPct":0.9967200000000000503774799653911031782627105712890625,"outlets":["cisa"],"articles":[40,42,44],"firstSeen":1792770395,"score":75,"buzz":"","advisories":[9]},"CVE-2026-109618":{"id":"CVE-2026-109618","title":"PHP Group PHP","titleSrc":"kev","products":["PHP Group PHP","php php","siemens ruggedcom ape1808 firmware","siemens ruggedcom ape1808","paloaltonetworks pan-os","paloaltonetworks panorama m-200","paloaltonetworks panorama m-300"],"name":"PHP Memory Corruption Vulnerability","desc":"PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.","cvss":9.199999999999999289457264239899814128875732421875,"severity":"CRITICAL","published":"2026-10-21T14:17:09","kev":{"added":"2026-10-26","due":"2026-10-29","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.99999000000000004551026222543441690504550933837890625,"epssPct":0.99999000000000004551026222543441690504550933837890625,"outlets":["cisa"],"articles":[41,43],"firstSeen":1792770395,"score":75,"buzz":"","advisories":[]},"CVE-2026-109619":{"id":"CVE-2026-109619","title":"PHP Group PHP","titleSrc":"kev","products":["PHP Group PHP","php php","siemens ruggedcom ape1808 firmware","siemens ruggedcom ape1808","paloaltonetworks pan-os","paloaltonetworks panorama m-200","paloaltonetworks panorama m-300"],"name":"PHP Stale Internal Request-State Vulnerability","desc":"PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.","cvss":9.199999999999999289457264239899814128875732421875,"severity":"CRITICAL","published":"2026-10-21T14:17:09","kev":{"added":"2026-10-26","due":"2026-10-29","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.99999000000000004551026222543441690504550933837890625,"epssPct":0.99999000000000004551026222543441690504550933837890625,"outlets":["cisa"],"articles":[41,43],"firstSeen":1792770395,"score":75,"buzz":"","advisories":[]},"CVE-2026-105134":{"id":"CVE-2026-105134","title":"Ahsay AhsayCBS","titleSrc":"kev","products":["Ahsay AhsayCBS","ahsay cloud backup suite"],"name":"Ahsay AhsayCBS Command Injection Vulnerability","desc":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","cvss":10,"severity":"CRITICAL","published":"2026-10-04T07:16:33","kev":{"added":"2026-10-14","due":"2026-10-17","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.81762999999999996791899548043147660791873931884765625,"epssPct":0.9965100000000000068922645368729718029499053955078125,"outlets":["thn"],"articles":[112],"firstSeen":1792770395,"score":75,"buzz":"","advisories":[]},"CVE-2026-111793":{"id":"CVE-2026-111793","title":"Openwave Messaging Limited Webtop Media Transcoder","titleSrc":"kev","products":["Openwave Messaging Limited Webtop Media Transcoder","openwave webtop media transcoder"],"name":"Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability","desc":"Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.","cvss":4.29999999999999982236431605997495353221893310546875,"severity":"MEDIUM","published":"2026-10-16T19:17:05","kev":{"added":"2026-11-10","due":"2026-11-24","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.0063800000000000002542410726391608477570116519927978515625,"epssPct":0.51066000000000000280664380625239573419094085693359375,"outlets":["cisa"],"articles":[122],"firstSeen":1794344409,"score":65,"buzz":"","advisories":[]},"CVE-2026-19868":{"id":"CVE-2026-19868","title":"SonicWall SonicOS SSLVPN","titleSrc":"kev","products":["SonicWall SonicOS SSLVPN","sonicwall sonicos","sonicwall nsv 270","sonicwall nsv 470","sonicwall nsv 870","sonicwall nsa 2700","sonicwall nsa 3700"],"name":"SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability","desc":"SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).","cvss":7.5,"severity":"HIGH","published":"2026-11-06T19:17:48","kev":{"added":"2026-11-06","due":"2026-11-20","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.00532000000000000007605027718682322301901876926422119140625,"epssPct":0.454569999999999974082953713150345720350742340087890625,"outlets":["cisa"],"articles":[170],"firstSeen":1793995214,"score":58,"buzz":"","advisories":[6]},"CVE-2026-105133":{"id":"CVE-2026-105133","title":"Ahsay AhsayCBS","titleSrc":"kev","products":["Ahsay AhsayCBS","ahsay cloud backup suite"],"name":"Ahsay AhsayCBS Improper Authentication Vulnerability","desc":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","cvss":6.9000000000000003552713678800500929355621337890625,"severity":"MEDIUM","published":"2026-10-04T07:16:33","kev":{"added":"2026-10-14","due":"2026-10-17","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.84477999999999997537969420591252855956554412841796875,"epssPct":0.99705999999999994631849631332443095743656158447265625,"outlets":["thn"],"articles":[112],"firstSeen":1792770395,"score":57,"buzz":"","advisories":[]},"CVE-2026-119958":{"id":"CVE-2026-119958","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-10T19:20:19","kev":null,"epss":0.0127899999999999992861265951660243445076048374176025390625,"epssPct":0.70411999999999996813215830115950666368007659912109375,"outlets":["sans","register"],"articles":[78,94],"firstSeen":1794340816,"score":53,"buzz":"trending","advisories":[3]},"CVE-2026-116928":{"id":"CVE-2026-116928","title":"November Patch Tuesday boasts over 1,000 bugs, one already under attack","titleSrc":"news","products":[],"name":"","desc":"Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-10T19:19:21","kev":null,"epss":0.01161000000000000052791104820926193497143685817718505859375,"epssPct":0.6759399999999999852917653697659261524677276611328125,"outlets":["register","cyberscoop"],"articles":[94,98],"firstSeen":1794340816,"score":52,"buzz":"trending","advisories":[]},"CVE-2026-119977":{"id":"CVE-2026-119977","title":"WordPress WordPress Core","titleSrc":"kev","products":["WordPress WordPress Core","wordpress wordpress"],"name":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","desc":"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-10-31T06:16:34","kev":{"added":"2026-11-03","due":"2026-11-06","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.011990000000000000657252030578092671930789947509765625,"epssPct":0.68598999999999998866684336462640203535556793212890625,"outlets":[],"articles":[],"firstSeen":1793743207,"score":49,"buzz":"","advisories":[7]},"CVE-2026-118383":{"id":"CVE-2026-118383","title":"Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover","titleSrc":"news","products":[],"name":"","desc":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and…","cvss":9.5,"severity":"CRITICAL","published":"2026-11-10T21:18:58","kev":null,"epss":0.007139999999999999645561299388418774469755589962005615234375,"epssPct":0.54154999999999997584154698415659368038177490234375,"outlets":["thn"],"articles":[60],"firstSeen":1794477614,"score":44,"buzz":"","advisories":[]},"CVE-2026-126325":{"id":"CVE-2026-126325","title":"PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution","titleSrc":"news","products":[],"name":"","desc":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.","cvss":9.199999999999999289457264239899814128875732421875,"severity":"CRITICAL","published":"2026-11-11T15:17:22","kev":null,"epss":0.005120000000000000418831636039840304874815046787261962890625,"epssPct":0.441510000000000013553602684623911045491695404052734375,"outlets":["thn"],"articles":[48],"firstSeen":1794488409,"score":43,"buzz":"","advisories":[]},"CVE-2026-108186":{"id":"CVE-2026-108186","title":"Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation","titleSrc":"news","products":[],"name":"","desc":"Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.","cvss":9.5999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-11-10T16:17:14","kev":null,"epss":0.004069999999999999833188990550070229801349341869354248046875,"epssPct":0.3551699999999999857180910112219862639904022216796875,"outlets":["thn"],"articles":[80],"firstSeen":1794420018,"score":41,"buzz":"","advisories":[]},"CVE-2024-27834":{"id":"CVE-2024-27834","title":"Apple Multiple Products","titleSrc":"kev","products":["Apple Multiple Products","apple safari","apple ipados","apple iphone os","apple macos","apple tvos","apple watchos"],"name":"Apple Multiple Products Improper Authentication Vulnerability","desc":"Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.","cvss":5.5,"severity":"MEDIUM","published":"2024-05-14T15:13:06","kev":{"added":"2026-11-04","due":"2026-11-18","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see…"},"epss":0.01502000000000000036470826358936392352916300296783447265625,"epssPct":0.7467099999999999848654397283098660409450531005859375,"outlets":[],"articles":[],"firstSeen":1793826018,"score":41,"buzz":"","advisories":[]},"CVE-2026-112967":{"id":"CVE-2026-112967","title":"November Patch Tuesday boasts over 1,000 bugs, one already under attack","titleSrc":"news","products":[],"name":"","desc":"Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-10T19:18:46","kev":null,"epss":0.01153999999999999991062704651767489849589765071868896484375,"epssPct":0.6743900000000000449773551736143417656421661376953125,"outlets":["register"],"articles":[94],"firstSeen":1794340816,"score":40,"buzz":"","advisories":[]},"CVE-2026-118207":{"id":"CVE-2026-118207","title":"Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era","titleSrc":"news","products":[],"name":"","desc":"Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-11-10T19:19:37","kev":null,"epss":0.0114900000000000002131628207280300557613372802734375,"epssPct":0.6731000000000000316191517413244582712650299072265625,"outlets":["register"],"articles":[30],"firstSeen":1794495611,"score":37,"buzz":"","advisories":[1]},"CVE-2026-119618":{"id":"CVE-2026-119618","title":"Apache Patches Critical HTTP Server RCE Found by Anthropic, Google","titleSrc":"news","products":[],"name":"","desc":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.","cvss":null,"severity":"","published":"2026-11-11T15:17:15","kev":null,"epss":0.003980000000000000030808688933348093996755778789520263671875,"epssPct":0.34545999999999998930633182681049220263957977294921875,"outlets":["secweek","thn"],"articles":[24,65],"firstSeen":1794463212,"score":35,"buzz":"trending","advisories":[0]},"CVE-2026-118321":{"id":"CVE-2026-118321","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":["google chrome","google android"],"name":"","desc":"Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.5999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-10-27T23:17:00","kev":null,"epss":0.0035400000000000001777744618181031910353340208530426025390625,"epssPct":0.295630000000000003890221478286548517644405364990234375,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":34,"buzz":"","advisories":[]},"CVE-2026-118309":{"id":"CVE-2026-118309","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":["google chrome","google android"],"name":"","desc":"Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","cvss":9.5999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-10-27T23:16:59","kev":null,"epss":0.00251000000000000007827072323607353609986603260040283203125,"epssPct":0.165729999999999988435916975504369474947452545166015625,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":32,"buzz":"","advisories":[]},"CVE-2026-126542":{"id":"CVE-2026-126542","title":"WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that…","titleSrc":"nvd","products":[],"name":"","desc":"WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-11T01:17:15","kev":null,"epss":0.00753000000000000023481216970822060829959809780120849609375,"epssPct":0.5555099999999999482724888366647064685821533203125,"outlets":[],"articles":[],"firstSeen":1794362415,"score":32,"buzz":"","advisories":[]},"CVE-2026-76954":{"id":"CVE-2026-76954","title":"An improper neutralization of special elements used in an SQL command vulnerability in…","titleSrc":"nvd","products":[],"name":"","desc":"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-12T04:17:20","kev":null,"epss":0.00634000000000000014932499681208355468697845935821533203125,"epssPct":0.5091200000000000169819713846663944423198699951171875,"outlets":[],"articles":[],"firstSeen":1794459611,"score":32,"buzz":"","advisories":[]},"CVE-2026-126797":{"id":"CVE-2026-126797","title":"NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin…","titleSrc":"nvd","products":[],"name":"","desc":"NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-11T21:16:43","kev":null,"epss":0.006150000000000000084654505627668186207301914691925048828125,"epssPct":0.49975000000000002753353101070388220250606536865234375,"outlets":[],"articles":[],"firstSeen":1794434411,"score":31,"buzz":"","advisories":[]},"CVE-2026-126812":{"id":"CVE-2026-126812","title":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration…","titleSrc":"nvd","products":[],"name":"","desc":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-11T21:16:45","kev":null,"epss":0.0060400000000000002298161660974074038676917552947998046875,"epssPct":0.49382999999999999118927007657475769519805908203125,"outlets":[],"articles":[],"firstSeen":1794434411,"score":31,"buzz":"","advisories":[]},"CVE-2026-119963":{"id":"CVE-2026-119963","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-10T19:20:20","kev":null,"epss":0.00856999999999999949318318925861603929661214351654052734375,"epssPct":0.58896000000000003904432333001750521361827850341796875,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":30,"buzz":"","advisories":[]},"CVE-2026-109459":{"id":"CVE-2026-109459","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-10T19:18:14","kev":null,"epss":0.00723000000000000031530333899354445748031139373779296875,"epssPct":0.5451099999999999834443542567896656692028045654296875,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":29,"buzz":"","advisories":[]},"CVE-2026-119967":{"id":"CVE-2026-119967","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-10T19:20:21","kev":null,"epss":0.00723000000000000031530333899354445748031139373779296875,"epssPct":0.5451099999999999834443542567896656692028045654296875,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":29,"buzz":"","advisories":[]},"CVE-2026-116710":{"id":"CVE-2026-116710","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-10T19:19:13","kev":null,"epss":0.00723000000000000031530333899354445748031139373779296875,"epssPct":0.5451099999999999834443542567896656692028045654296875,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":29,"buzz":"","advisories":[]},"CVE-2026-119964":{"id":"CVE-2026-119964","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.","cvss":8.0999999999999996447286321199499070644378662109375,"severity":"HIGH","published":"2026-11-10T19:20:21","kev":null,"epss":0.00723000000000000031530333899354445748031139373779296875,"epssPct":0.54510000000000002895461648222408257424831390380859375,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":29,"buzz":"","advisories":[]},"CVE-2026-113961":{"id":"CVE-2026-113961","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages.","cvss":7.5,"severity":"HIGH","published":"2026-11-09T22:18:25","kev":null,"epss":0.006119999999999999572286579763158442801795899868011474609375,"epssPct":0.49838999999999999968025576890795491635799407958984375,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":28,"buzz":"","advisories":[]},"CVE-2026-113859":{"id":"CVE-2026-113859","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.","cvss":7.5,"severity":"HIGH","published":"2026-11-10T19:19:06","kev":null,"epss":0.004230000000000000252853293858379402081482112407684326171875,"epssPct":0.371140000000000025437429940211586654186248779296875,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":27,"buzz":"","advisories":[]},"CVE-2026-120002":{"id":"CVE-2026-120002","title":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to…","titleSrc":"nvd","products":[],"name":"","desc":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","cvss":9.9000000000000003552713678800500929355621337890625,"severity":"CRITICAL","published":"2026-11-10T19:20:26","kev":null,"epss":0.0086199999999999991906474150482608820311725139617919921875,"epssPct":0.59031000000000000138555833473219536244869232177734375,"outlets":[],"articles":[],"firstSeen":1794340816,"score":27,"buzz":"","advisories":[4]},"CVE-2026-125370":{"id":"CVE-2026-125370","title":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows…","titleSrc":"nvd","products":[],"name":"","desc":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and…","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-10T00:17:09","kev":null,"epss":0.006830000000000000133504318711175073985941708087921142578125,"epssPct":0.53000999999999998113509036556934006512165069580078125,"outlets":[],"articles":[],"firstSeen":1794272416,"score":26,"buzz":"","advisories":[]},"CVE-2026-120779":{"id":"CVE-2026-120779","title":"Improper control of generation of code ('code injection') in Visual Studio Code allows an…","titleSrc":"nvd","products":[],"name":"","desc":"Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","cvss":9.5999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-11-10T19:20:27","kev":null,"epss":0.006400000000000000306699110552699494292028248310089111328125,"epssPct":0.51170999999999999818811602381174452602863311767578125,"outlets":[],"articles":[],"firstSeen":1794340816,"score":26,"buzz":"","advisories":[]},"CVE-2026-89324":{"id":"CVE-2026-89324","title":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all…","titleSrc":"nvd","products":[],"name":"","desc":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt…","cvss":9.800000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-10T22:21:14","kev":null,"epss":0.007040000000000000250632847809129089000634849071502685546875,"epssPct":0.537830000000000030269120543380267918109893798828125,"outlets":[],"articles":[],"firstSeen":1794351613,"score":26,"buzz":"","advisories":[]},"CVE-2026-85632":{"id":"CVE-2026-85632","title":"Missing authentication for critical function and Improper validation of integrity check…","titleSrc":"nvd","products":[],"name":"","desc":"Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.","cvss":9.0999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-11-11T15:17:25","kev":null,"epss":0.00217000000000000005384581669432009221054613590240478515625,"epssPct":0.1224800000000000055333515547317801974713802337646484375,"outlets":[],"articles":[],"firstSeen":1794412822,"score":26,"buzz":"","advisories":[]},"CVE-2026-113970":{"id":"CVE-2026-113970","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory.","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-11-09T22:18:26","kev":null,"epss":0.003259999999999999877042800022763913148082792758941650390625,"epssPct":0.2604699999999999793232063893810845911502838134765625,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":25,"buzz":"","advisories":[]},"CVE-2026-109593":{"id":"CVE-2026-109593","title":"An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier…","titleSrc":"nvd","products":[],"name":"","desc":"An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.","cvss":9.0999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-11-03T17:17:53","kev":null,"epss":0.005210000000000000221211937656562440679408609867095947265625,"epssPct":0.4475000000000000088817841970012523233890533447265625,"outlets":[],"articles":[],"firstSeen":1793732432,"score":25,"buzz":"","advisories":[8]},"CVE-2026-125086":{"id":"CVE-2026-125086","title":"A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of…","titleSrc":"nvd","products":[],"name":"","desc":"A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-10T01:17:19","kev":null,"epss":0.006060000000000000282274204010946050402708351612091064453125,"epssPct":0.49504999999999999005240169935859739780426025390625,"outlets":[],"articles":[],"firstSeen":1794276012,"score":25,"buzz":"","advisories":[]},"CVE-2026-107360":{"id":"CVE-2026-107360","title":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code…","titleSrc":"nvd","products":[],"name":"","desc":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed…","cvss":9.5999999999999996447286321199499070644378662109375,"severity":"CRITICAL","published":"2026-11-12T20:18:14","kev":null,"epss":null,"epssPct":null,"outlets":[],"articles":[],"firstSeen":1794517217,"score":24,"buzz":"","advisories":[]},"CVE-2026-124002":{"id":"CVE-2026-124002","title":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command…","titleSrc":"nvd","products":[],"name":"","desc":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands…","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-12T20:18:21","kev":null,"epss":null,"epssPct":null,"outlets":[],"articles":[],"firstSeen":1794517217,"score":24,"buzz":"","advisories":[]},"CVE-2026-124004":{"id":"CVE-2026-124004","title":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows…","titleSrc":"nvd","products":[],"name":"","desc":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date…","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-12T20:18:22","kev":null,"epss":null,"epssPct":null,"outlets":[],"articles":[],"firstSeen":1794517217,"score":24,"buzz":"","advisories":[]},"CVE-2026-124010":{"id":"CVE-2026-124010","title":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows…","titleSrc":"nvd","products":[],"name":"","desc":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.","cvss":9.300000000000000710542735760100185871124267578125,"severity":"CRITICAL","published":"2026-11-12T20:18:24","kev":null,"epss":null,"epssPct":null,"outlets":[],"articles":[],"firstSeen":1794517217,"score":24,"buzz":"","advisories":[]},"CVE-2026-119260":{"id":"CVE-2026-119260","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":["google chrome"],"name":"","desc":"Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-10-30T01:16:44","kev":null,"epss":0.0024199999999999998422095526251496266922913491725921630859375,"epssPct":0.155530000000000001580957587066222913563251495361328125,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":23,"buzz":"","advisories":[]},"CVE-2026-118314":{"id":"CVE-2026-118314","title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","titleSrc":"news","products":["google chrome","google android"],"name":"","desc":"Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: High)","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-10-27T23:16:59","kev":null,"epss":0.00169999999999999990528409821166633264510892331600189208984375,"epssPct":0.0645300000000000040234482412415673024952411651611328125,"outlets":["sans"],"articles":[78],"firstSeen":1794340816,"score":22,"buzz":"","advisories":[]},"CVE-2026-125346":{"id":"CVE-2026-125346","title":"Chrome zero-day whack-a-mole continues as 2026 tally hits 8","titleSrc":"news","products":[],"name":"","desc":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-11-10T18:17:34","kev":null,"epss":null,"epssPct":null,"outlets":["register"],"articles":[116],"firstSeen":1794319210,"score":21,"buzz":"","advisories":[]},"CVE-2026-120868":{"id":"CVE-2026-120868","title":"Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass","titleSrc":"news","products":[],"name":"","desc":"","cvss":null,"severity":"","published":"","kev":null,"epss":null,"epssPct":null,"outlets":["thn"],"articles":[23],"firstSeen":1794502809,"score":18,"buzz":"","advisories":[]},"CVE-2026-113964":{"id":"CVE-2026-113964","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without…","cvss":5.4000000000000003552713678800500929355621337890625,"severity":"MEDIUM","published":"2026-11-09T22:18:26","kev":null,"epss":0.0032299999999999997983557431524559433455578982830047607421875,"epssPct":0.25629000000000001779909553079050965607166290283203125,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":16,"buzz":"","advisories":[]},"CVE-2026-113968":{"id":"CVE-2026-113968","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts.","cvss":5.4000000000000003552713678800500929355621337890625,"severity":"MEDIUM","published":"2026-11-09T22:18:26","kev":null,"epss":0.0032299999999999997983557431524559433455578982830047607421875,"epssPct":0.25629000000000001779909553079050965607166290283203125,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":16,"buzz":"","advisories":[]},"CVE-2026-114406":{"id":"CVE-2026-114406","title":"Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session","titleSrc":"news","products":[],"name":"","desc":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA…","cvss":6.79999999999999982236431605997495353221893310546875,"severity":"MEDIUM","published":"2026-10-21T21:17:58","kev":null,"epss":0.0030999999999999998910593657086565144709311425685882568359375,"epssPct":0.2415599999999999969446662362315692007541656494140625,"outlets":["register"],"articles":[150],"firstSeen":1794240013,"score":16,"buzz":"","advisories":[]},"CVE-2026-113965":{"id":"CVE-2026-113965","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction.","cvss":5.4000000000000003552713678800500929355621337890625,"severity":"MEDIUM","published":"2026-11-09T22:18:26","kev":null,"epss":0.003000000000000000062450045135165055398829281330108642578125,"epssPct":0.2308300000000000073985262361020431853830814361572265625,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":15,"buzz":"","advisories":[]},"CVE-2026-124014":{"id":"CVE-2026-124014","title":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write…","titleSrc":"nvd","products":[],"name":"","desc":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger…","cvss":8.800000000000000710542735760100185871124267578125,"severity":"HIGH","published":"2026-11-12T20:18:25","kev":null,"epss":null,"epssPct":null,"outlets":[],"articles":[],"firstSeen":1794517217,"score":15,"buzz":"","advisories":[]},"CVE-2026-113969":{"id":"CVE-2026-113969","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts.","cvss":null,"severity":"","published":"2026-11-09T22:18:26","kev":null,"epss":0.002150000000000000001387778780781445675529539585113525390625,"epssPct":0.1193700000000000038813396940895472653210163116455078125,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":14,"buzz":"","advisories":[]},"CVE-2026-113971":{"id":"CVE-2026-113971","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.","cvss":3.5,"severity":"LOW","published":"2026-11-09T22:18:27","kev":null,"epss":0.00158000000000000002421673972463622703799046576023101806640625,"epssPct":0.05000000000000000277555756156289135105907917022705078125,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":13,"buzz":"","advisories":[]},"CVE-2026-113960":{"id":"CVE-2026-113960","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined.","cvss":null,"severity":"","published":"2026-11-09T22:18:25","kev":null,"epss":0.001809999999999999976962872239028001786209642887115478515625,"epssPct":0.077369999999999994333421682313201017677783966064453125,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":13,"buzz":"","advisories":[]},"CVE-2026-111760":{"id":"CVE-2026-111760","title":"Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","titleSrc":"news","products":[],"name":"","desc":"","cvss":null,"severity":"","published":"","kev":null,"epss":null,"epssPct":null,"outlets":["thn"],"articles":[104],"firstSeen":1794340816,"score":12,"buzz":"","advisories":[]},"CVE-2026-113963":{"id":"CVE-2026-113963","title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","titleSrc":"news","products":[],"name":"","desc":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.","cvss":5.5,"severity":"MEDIUM","published":"2026-11-09T22:18:26","kev":null,"epss":0.00137999999999999993331722958345153529080562293529510498046875,"epssPct":0.032620000000000003159694728083195514045655727386474609375,"outlets":["sans"],"articles":[119],"firstSeen":1794315608,"score":12,"buzz":"","advisories":[]},"CVE-2026-77708":{"id":"CVE-2026-77708","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":8.800000000000000710542735760100185871124267578125,"severity":"","published":"","kev":null,"epss":0.00659000000000000037136960173711486277170479297637939453125,"epssPct":0.52029000000000003023359340659226290881633758544921875,"outlets":[],"articles":[],"firstSeen":1793995214,"score":8,"buzz":"","advisories":[6]},"CVE-2026-77709":{"id":"CVE-2026-77709","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":8.800000000000000710542735760100185871124267578125,"severity":"","published":"","kev":null,"epss":0.00659000000000000037136960173711486277170479297637939453125,"epssPct":0.52029000000000003023359340659226290881633758544921875,"outlets":[],"articles":[],"firstSeen":1793995214,"score":8,"buzz":"","advisories":[6]},"CVE-2026-107154":{"id":"CVE-2026-107154","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":8.800000000000000710542735760100185871124267578125,"severity":"","published":"","kev":null,"epss":0.0068999999999999998834265824143585632555186748504638671875,"epssPct":0.53300000000000002930988785010413266718387603759765625,"outlets":[],"articles":[],"firstSeen":1793995214,"score":8,"buzz":"","advisories":[6]},"CVE-2026-107155":{"id":"CVE-2026-107155","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":8.800000000000000710542735760100185871124267578125,"severity":"","published":"","kev":null,"epss":0.007519999999999999774902281757249511429108679294586181640625,"epssPct":0.55518999999999996131094803786254487931728363037109375,"outlets":[],"articles":[],"firstSeen":1793995214,"score":8,"buzz":"","advisories":[6]},"CVE-2026-82308":{"id":"CVE-2026-82308","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":8.800000000000000710542735760100185871124267578125,"severity":"","published":"","kev":null,"epss":0.0059500000000000004274358644806852680630981922149658203125,"epssPct":0.489200000000000023714363805993343703448772430419921875,"outlets":[],"articles":[],"firstSeen":1793995214,"score":7,"buzz":"","advisories":[6]},"CVE-2026-109594":{"id":"CVE-2026-109594","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":9.0999999999999996447286321199499070644378662109375,"severity":"","published":"","kev":null,"epss":0.003810000000000000018596235662471372052095830440521240234375,"epssPct":0.325610000000000010533796057643485255539417266845703125,"outlets":[],"articles":[],"firstSeen":1793732432,"score":5,"buzz":"","advisories":[8]},"CVE-2026-119249":{"id":"CVE-2026-119249","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":7.79999999999999982236431605997495353221893310546875,"severity":"","published":"","kev":null,"epss":0.0033500000000000001131039706336878225556574761867523193359375,"epssPct":0.272459999999999979980458419959177263081073760986328125,"outlets":[],"articles":[],"firstSeen":1793308999,"score":4,"buzz":"","advisories":[10]},"CVE-2026-119250":{"id":"CVE-2026-119250","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":7.79999999999999982236431605997495353221893310546875,"severity":"","published":"","kev":null,"epss":0.003000000000000000062450045135165055398829281330108642578125,"epssPct":0.2295599999999999862865251998300664126873016357421875,"outlets":[],"articles":[],"firstSeen":1793308999,"score":3,"buzz":"","advisories":[10]},"CVE-2026-19703":{"id":"CVE-2026-19703","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":8.800000000000000710542735760100185871124267578125,"severity":"","published":"","kev":null,"epss":0.00188999999999999996995458939608170112478546798229217529296875,"epssPct":0.0860100000000000031175062531474395655095577239990234375,"outlets":[],"articles":[],"firstSeen":1793995214,"score":1,"buzz":"","advisories":[6]},"CVE-2026-119251":{"id":"CVE-2026-119251","title":"","titleSrc":"kev","products":[],"name":"","desc":"","cvss":7.79999999999999982236431605997495353221893310546875,"severity":"","published":"","kev":null,"epss":0.00153999999999999991930066389755893396795727312564849853515625,"epssPct":0.04564000000000000001332267629550187848508358001708984375,"outlets":[],"articles":[],"firstSeen":1793308999,"score":1,"buzz":"","advisories":[10]}},"articles":[{"exploit":false,"breach":false,"title":"Google smart glasses privacy features cover wearers and the people around them","link":"https://www.helpnetsecurity.com/2026/11/13/google-smart-glasses-privacy-protections/","src":"helpnet","date":1794527143,"desc":"Google has built its Gemini-powered intelligent eyewear to stop taking photos and video when someone covers or tampers with the outward-facing recording light. Shahram Izadi, Google’s VP and GM of XR, laid out that safeguard along with face redaction, limits…","auth":false,"cves":[],"topics":["OpenAI / AI agents"]},{"exploit":false,"breach":false,"title":"Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters","link":"https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/","src":"helpnet","date":1794525323,"desc":"EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers. Each page showed what looked like a routine verification check. Behind it, the page quietly copied a…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14","link":"https://www.helpnetsecurity.com/2026/11/13/postgresql-security-update-november-2026/","src":"helpnet","date":1794524733,"desc":"The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs. Most of those code execution bugs are memory errors or type confusion, where…","auth":false,"cves":[],"topics":["PostgreSQL"]},{"exploit":false,"breach":false,"title":"New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks","link":"https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/","src":"bleeping","date":1794523990,"desc":"A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.","auth":false,"cves":[],"topics":["ConnectWise"]},{"exploit":false,"breach":true,"title":"Hackers compromise 4,800 GitHub accounts to steal cloud credentials","link":"https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/","src":"bleeping","date":1794522330,"desc":"A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.","auth":false,"cves":[],"topics":["GitHub"]},{"exploit":false,"breach":false,"title":"Cyber Experts Weigh In: How to Fight Artex & AntiFox","link":"https://www.darkreading.com/cybersecurity-operations/cyber-experts-fight-artex-antifox","src":"darkread","date":1794518332,"desc":"Cybercriminals using agentic pen-testing tools is a proverbial genie out of the bottle at this point, so enterprises need to get a defense plan in place right away.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Rogue remote-access campaign spread through ScreenConnect add-on, researchers say","link":"https://cyberscoop.com/connectwise-screenconnect-sckit-attack/","src":"cyberscoop","date":1794517097,"desc":"ConnectWise disabled five third-party extensions across about 400 partner environments after researchers linked a worm-like toolkit to one of them.","auth":false,"cves":["CVE-2026-84869"],"topics":["ConnectWise"]},{"exploit":false,"breach":false,"title":"Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams","link":"https://www.securityweek.com/microsoft-365-outage-disrupts-outlook-exchange-online-and-teams/","src":"secweek","date":1794516930,"desc":"Microsoft says failed server health checks disrupted Outlook and other Microsoft 365 services. The company is still investigating the cause and has disclosed no evidence of a cyberattack.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"OpenAI launches security products, tells orgs they’re doomed if they don’t use them","link":"https://www.theregister.com/security/2026/11/12/openai-launches-security-products-tells-orgs-theyre-doomed-if-they-dont-use-them/5309500","src":"register","date":1794516525,"desc":"Meanwhile, a group of nonprofits sue AI giants and cite AI-driven cyberattacks","auth":false,"cves":[],"topics":["OpenAI / AI agents"]},{"exploit":false,"breach":false,"title":"Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot worldwide","link":"https://www.bleepingcomputer.com/news/microsoft/massive-microsoft-365-outage-disrupts-outlook-teams-copilot-worldwide/","src":"bleeping","date":1794514516,"desc":"Microsoft is investigating a widespread outage affecting multiple Microsoft 365 services, including Outlook, Microsoft Teams, and Copilot, as users report connectivity problems worldwide.","auth":false,"cves":[],"topics":["Microsoft","OpenAI / AI agents"]},{"exploit":false,"breach":false,"title":"Extortion Group Luna Moth Flits Into Law Firms a Second Time","link":"https://www.darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time","src":"darkread","date":1794514181,"desc":"The cybercriminals are retargeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Lego marketplace BrickLink in pieces after 'unusual activity' takes it offline for almost a week","link":"https://www.theregister.com/security/2026/11/12/lego-marketplace-bricklink-in-pieces-after-unusual-activity-takes-it-offline-for-almost-a-week/5309425","src":"register","date":1794514088,"desc":"Lego fans demand answers as outage approaches a week with no confirmed cause","auth":false,"cves":[],"topics":[]},{"exploit":true,"breach":false,"title":"New N-able \"4EverAble2Shell\" zero-day exploited hours after PoC released","link":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","src":"bleeping","date":1794513076,"desc":"Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed \"4EverAble2Shell\" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including 19 running the…","auth":false,"cves":[],"topics":["N-able"]},{"exploit":true,"breach":false,"title":"Apache HTTP Server patches critical HTTP/2 remote code execution flaw","link":"https://www.bleepingcomputer.com/news/security/apache-http-server-patches-critical-http-2-remote-code-execution-flaw/","src":"bleeping","date":1794510775,"desc":"A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution (RCE).","auth":false,"cves":[],"topics":["Apache"]},{"exploit":false,"breach":false,"title":"Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them","link":"https://thehackernews.com/2026/11/your-soc-sees-alert-but-does-it-know.html","src":"thn","date":1794506835,"desc":"Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what can they access? A suspicious login might belong to an…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Self-hosted Claude Managed Agents keeps agent credentials in your environment","link":"https://www.helpnetsecurity.com/2026/11/12/anthropic-self-hosted-claude-managed-agents/","src":"helpnet","date":1794506820,"desc":"Anthropic has released a self-hosted version of Claude Managed Agents. Companies can run the agent harness, sandboxes, credentials, and session history in their cloud or on-premise. The option opened as a private beta on November 12, and customers request…","auth":false,"cves":[],"topics":["OpenAI / AI agents"]},{"exploit":false,"breach":false,"title":"Software Samaritan revamps borked Indian certs to block smart TV ads","link":"https://www.theregister.com/security/2026/11/12/software-samaritan-revamps-borked-indian-certs-to-block-smart-tv-ads/5309467","src":"register","date":1794506575,"desc":"A little tinkering can black hole obnoxious Samsung TV ads and some tracking, until a firmware fix ruins the fun","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories","link":"https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html","src":"thn","date":1794506571,"desc":"A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there. Attackers are…","auth":false,"cves":[],"topics":["Linux"]},{"exploit":true,"breach":false,"title":"New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access","link":"https://thehackernews.com/2026/11/new-signdrop-zero-day-exploit-turns.html","src":"thn","date":1794505827,"desc":"Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Don’t put Section 702 spying law renewal in defense bill, groups urge Hill leaders","link":"https://cyberscoop.com/section-702-reauthorization-ndaa-debate/","src":"cyberscoop","date":1794502800,"desc":"CyberScoop is exclusively reporting on the letter to the Hill on the controversial snooping authorities under the Foreign Intelligence Surveillance Act.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"International operation dismantles malware networks, exposes 6.4 million stolen credentials","link":"https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol/","src":"cyberscoop","date":1794502534,"desc":"The Operation Endgame action dismantled the loaders, remote access trojans and infostealers that give ransomware gangs their way into corporate networks.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry","link":"https://thehackernews.com/2026/11/critical-red-hat-quay-flaw-lets.html","src":"thn","date":1794500821,"desc":"A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account. When it is…","auth":false,"cves":[],"topics":[]},{"exploit":true,"breach":false,"title":"New Windows SignDrop zero-day gives hackers SYSTEM privileges","link":"https://www.bleepingcomputer.com/news/security/new-windows-signdrop-zero-day-gives-hackers-system-privileges/","src":"bleeping","date":1794499440,"desc":"Security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) has released a new Windows zero-day exploit that can let attackers gain SYSTEM privileges.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass","link":"https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html","src":"thn","date":1794497929,"desc":"Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact…","auth":false,"cves":["CVE-2026-120868"],"topics":["Citrix"]},{"exploit":false,"breach":false,"title":"Apache Patches Critical HTTP Server RCE Found by Anthropic, Google","link":"https://www.securityweek.com/apache-patches-critical-http-server-rce-found-by-anthropic-google/","src":"secweek","date":1794497911,"desc":"The mod_http2 race condition, CVE-2026-119618, could let unauthenticated attackers execute code on servers with HTTP/2 enabled.","auth":false,"cves":["CVE-2026-119618"],"topics":["Apache"]},{"exploit":false,"breach":false,"title":"186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers","link":"https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html","src":"thn","date":1794496540,"desc":"Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Police dismantle Gootloader, CastleRAT, StealC malware infrastructure","link":"https://www.bleepingcomputer.com/news/security/police-dismantles-gootloader-castlerat-stealc-malware-infrastructure/","src":"bleeping","date":1794496040,"desc":"Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Picus puts AI agents on the offensive with autonomous pentesting","link":"https://www.helpnetsecurity.com/2026/11/12/picus-autonomous-penetration-testing/","src":"helpnet","date":1794495902,"desc":"Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Attackers breached 10 organizations with an open-source AI pentest framework","link":"https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/","src":"helpnet","date":1794495629,"desc":"Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026. Palo Alto Networks’ Unit 42 found that the attackers gained unauthorized access or…","auth":false,"cves":[],"topics":["Palo Alto"]},{"exploit":false,"breach":true,"title":"Your Endpoint Management Platform Could Be Your Biggest Security Risk","link":"https://www.bleepingcomputer.com/news/security/your-endpoint-management-platform-could-be-your-biggest-security-risk/","src":"bleeping","date":1794495610,"desc":"Endpoint management platforms can become powerful attack tools when compromised, allowing hackers to deploy malware, execute commands, and disrupt thousands of devices. Action1 explains how customer-controlled cryptographic authorization can prevent attackers…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era","link":"https://www.theregister.com/saas/2026/11/12/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/5309401","src":"register","date":1794495300,"desc":"Upgrade, migrate, but don't prevaricate – time has run out","auth":false,"cves":["CVE-2026-118207"],"topics":["Microsoft"]},{"exploit":false,"breach":true,"title":"Apify rotates API tokens, prompts 2FA resets after breach","link":"https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/","src":"bleeping","date":1794494207,"desc":"Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Chrome, Firefox Updates Patch Over 180 Vulnerabilities","link":"https://www.securityweek.com/chrome-firefox-updates-patch-180-vulnerabilities/","src":"secweek","date":1794490929,"desc":"Google fixed 83 flaws with a new Chrome 157 release, and Mozilla addressed 99 bugs in Firefox 160.","auth":false,"cves":[],"topics":["Google Chrome","Mozilla"]},{"exploit":false,"breach":false,"title":"Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign","link":"https://www.securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/","src":"secweek","date":1794490743,"desc":"Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.","auth":false,"cves":[],"topics":["GitHub"]},{"exploit":false,"breach":false,"title":"Operation Endgame malware takedown turns up over 6 million stolen logins","link":"https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown/","src":"helpnet","date":1794490454,"desc":"Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6 million credentials stolen from infected computers. Europol announced the action as the latest…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Daylight Lands $80 Million for AI-Powered Security Operations","link":"https://www.securityweek.com/daylight-lands-80-million-for-ai-powered-security-operations/","src":"secweek","date":1794489131,"desc":"The company plans to accelerate product development, hire new talent, expand its US presence, and enter new markets.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths","link":"https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html","src":"thn","date":1794488908,"desc":"The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group…","auth":false,"cves":["CVE-2026-84869"],"topics":["ConnectWise"]},{"exploit":false,"breach":false,"title":"Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs","link":"https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361","src":"register","date":1794488520,"desc":"ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA","auth":false,"cves":[],"topics":["ConnectWise"]},{"exploit":false,"breach":false,"title":"Microsoft: Recent Windows updates cause SQL Server performance issues","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-recent-windows-updates-cause-sql-server-performance-issues/","src":"bleeping","date":1794485471,"desc":"Microsoft has confirmed that Windows updates released since the October 2026 Patch Tuesday are causing SQL Server performance and stability issues.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs","link":"https://thehackernews.com/2026/11/google-cloud-warns-three-amd-turin-cpu.html","src":"thn","date":1794485354,"desc":"Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between VMs and the host…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Siemens Desigo, Gridscale","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-02","src":"cisa","date":1794484800,"desc":"View CSAF Summary On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as \"Node2Shell\" (tracked as CVE-2026-111497). The vulnerability is an…","auth":true,"cves":["CVE-2026-111497"],"topics":["Siemens","Node.js"]},{"exploit":false,"breach":false,"title":"Siemens RUGGEDCOM APE1808","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-05","src":"cisa","date":1794484800,"desc":"View CSAF Summary Palo Alto Networks has published information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult…","auth":true,"cves":["CVE-2026-109618","CVE-2026-109619"],"topics":["PHP","Palo Alto","Siemens"]},{"exploit":false,"breach":false,"title":"Siemens RUGGEDCOM APE1808","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-04","src":"cisa","date":1794484800,"desc":"View CSAF Summary Palo Alto Networks has published information on a vulnerability in PAN-OS related to the Node2Shell vulnerability. This advisory lists the related Siemens Industrial products affected by this vulnerability. Customers are advised to consult…","auth":true,"cves":["CVE-2026-111497"],"topics":["Palo Alto","Siemens"]},{"exploit":false,"breach":false,"title":"Siemens Building Automation and Energy Products","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-01","src":"cisa","date":1794484800,"desc":"View CSAF Summary On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as \"php2shell\" (tracked as CVE-2026-109618 and…","auth":true,"cves":["CVE-2026-109618","CVE-2026-109619"],"topics":["PHP","Siemens"]},{"exploit":false,"breach":false,"title":"Siemens Industrial Edge Management","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-03","src":"cisa","date":1794484800,"desc":"View CSAF Summary Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected…","auth":true,"cves":["CVE-2026-111497"],"topics":["Siemens"]},{"exploit":true,"breach":false,"title":"Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)","link":"https://isc.sans.edu/diary/rss/33514","src":"sans","date":1794484584,"desc":"CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was…","auth":false,"cves":["CVE-2026-102895"],"topics":[]},{"exploit":false,"breach":false,"title":"New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access","link":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","src":"thn","date":1794484303,"desc":"N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. \"Based on our initial review, the server issue described depends on a…","auth":false,"cves":[],"topics":["Microsoft","N-able"]},{"exploit":false,"breach":false,"title":"Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign","link":"https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html","src":"thn","date":1794484291,"desc":"Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution","link":"https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html","src":"thn","date":1794483195,"desc":"PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of a…","auth":false,"cves":["CVE-2026-126325"],"topics":[]},{"exploit":false,"breach":false,"title":"European tech buyers add digital sovereignty to cyber shopping list","link":"https://www.theregister.com/security/2026/11/12/european-tech-buyers-add-digital-sovereignty-to-cyber-shopping-list/5309216","src":"register","date":1794483060,"desc":"Sales from EU HQ'd vendor rocket in two years. The Trump affect? Yes but NIS2 and DORA are factors too","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Notion Customer Data Compromised in Fireworks AI Hack","link":"https://www.securityweek.com/notion-customer-data-compromised-in-fireworks-ai-hack/","src":"secweek","date":1794481732,"desc":"The attackers accessed chat transcripts for fewer than 1% of Notion workspaces. Most transcripts were unattributable.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Microsoft Entra adds a seven-day safeguard against irreversible identity deletion","link":"https://www.helpnetsecurity.com/2026/11/12/microsoft-entra-hard-deletion-protection/","src":"helpnet","date":1794481464,"desc":"Microsoft Entra’s Hard Deletion Protection, now in preview, gives administrators a seven-day window to recover selected identities before they can be permanently erased. The feature is designed to help organizations respond to accidental or malicious deletion…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Stolen Claude API keys can turn Claude Code into a remote-controlled implant","link":"https://www.helpnetsecurity.com/2026/11/12/stolen-claude-api-keys-remote-controlled-implant/","src":"helpnet","date":1794481221,"desc":"Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was…","auth":false,"cves":[],"topics":["OpenAI / AI agents"]},{"exploit":false,"breach":true,"title":"Inside an AI Attack Against a US Retailer","link":"https://www.darkreading.com/cyberattacks-data-breaches/inside-ai-attack-us-retailer","src":"darkread","date":1794481200,"desc":"When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Hackers Deploy Malware in Fresh ScreenConnect Campaign","link":"https://www.securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/","src":"secweek","date":1794479974,"desc":"The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication.","auth":false,"cves":[],"topics":["ConnectWise"]},{"exploit":false,"breach":false,"title":"Microsoft confirms Windows security updates installation issues","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-kb5132061-installation-issues-0x80070306-0x800f0989-0x800f0993-errors/","src":"bleeping","date":1794479047,"desc":"Microsoft has confirmed reports that the November 2026 security updates are failing to install on Windows 11 systems with the October preview update.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Photos: IRISSCON 2026 cybercrime conference","link":"https://www.helpnetsecurity.com/2026/11/12/irisscon-2026-photos/","src":"helpnet","date":1794478567,"desc":"IRISSCON 2026, the annual cybercrime conference organized by IRISSCERT, took place at the Aviva Stadium in Dublin on November 11. The all-day event gives attendees a look at the cyber threats businesses are facing right now, along with practical advice on how…","auth":false,"cves":[],"topics":[]},{"exploit":true,"breach":false,"title":"Hackers Target N-central Zero-Days as N-able Rushes Patches","link":"https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/","src":"secweek","date":1794476395,"desc":"The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones.","auth":false,"cves":[],"topics":["N-able"]},{"exploit":true,"breach":false,"title":"Hackers plant GSocket on Linux servers for persistent access","link":"https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/","src":"bleeping","date":1794476280,"desc":"Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access.","auth":false,"cves":[],"topics":["Linux"]},{"exploit":false,"breach":false,"title":"London hotel put admin login for booking website on whiteboard behind the front desk","link":"https://www.theregister.com/security/2026/11/12/london-hotel-put-admin-login-for-booking-website-on-whiteboard-behind-the-front-desk/5308889","src":"register","date":1794475800,"desc":"You could check out more than your room","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover","link":"https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html","src":"thn","date":1794475500,"desc":"A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent…","auth":false,"cves":["CVE-2026-118383"],"topics":[]},{"exploit":false,"breach":false,"title":"Critical Red Hat Quay Vulnerability Could Expose Private Container Images","link":"https://www.securityweek.com/critical-red-hat-quay-vulnerability-could-expose-private-container-images/","src":"secweek","date":1794475401,"desc":"Attackers could exploit a critical Red Hat Quay flaw to steal private container images, overwrite repositories and maintain persistent access.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Maersk Confirms Data Theft Amid $5 Million Extortion Attempt","link":"https://www.securityweek.com/maersk-confirms-data-theft-amid-5-million-extortion-attempt/","src":"secweek","date":1794472727,"desc":"The WhiteArmor ransomware group claims it stole 100GB of data from the shipping giant’s systems.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data","link":"https://thehackernews.com/2026/11/nodejs-fixes-16-flaws-including-http2.html","src":"thn","date":1794471637,"desc":"A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses…","auth":false,"cves":[],"topics":["Node.js"]},{"exploit":false,"breach":false,"title":"Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories","link":"https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html","src":"thn","date":1794465767,"desc":"Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and…","auth":false,"cves":[],"topics":["GitHub"]},{"exploit":false,"breach":false,"title":"Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely","link":"https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html","src":"thn","date":1794460346,"desc":"A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with…","auth":false,"cves":["CVE-2026-119618"],"topics":["Apache"]},{"exploit":false,"breach":false,"title":"ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients","link":"https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html","src":"thn","date":1794458388,"desc":"ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a…","auth":false,"cves":[],"topics":["ConnectWise"]},{"exploit":false,"breach":false,"title":"Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates","link":"https://www.theregister.com/security/2026/11/12/disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates/5309244","src":"register","date":1794457338,"desc":"Couldn’t get the hardware it needed to generate certs, so tried to code a workaround","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"ISC Stormcast For Thursday, November 12th, 2026 https://isc.sans.edu/podcastdetail/10176, (Thu, Nov 12th)","link":"https://isc.sans.edu/diary/rss/33512","src":"sans","date":1794448803,"desc":"(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Chinese AI Project Scouts Spies in Taiwan Chip Industry","link":"https://www.darkreading.com/threat-intelligence/chinese-ai-project-scouts-spies-taiwan-chip-industry","src":"darkread","date":1794445200,"desc":"The CCP built a Big Data system to scrape reams of information and learn about individuals abroad, to potentially target and exploit them. Think Alice Huang Lite.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise","link":"https://www.darkreading.com/cybersecurity-operations/japan-emergency-funding-cybersecurity-ai-assisted-breaches","src":"darkread","date":1794441600,"desc":"The package adds public-private cyber responders, an AI-focused team run by the economic ministry, and more leeway to use the government's new active cyber-defense powers.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Baker Tilly notifies clients of data breach at third-party provider","link":"https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/","src":"bleeping","date":1794438091,"desc":"The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Active ScreenConnect attacks breach MSPs, impact dozens of organizations","link":"https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/","src":"bleeping","date":1794437781,"desc":"ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.","auth":false,"cves":[],"topics":["ConnectWise"]},{"exploit":false,"breach":false,"title":"AIを活用したサイバー攻撃の増加を受け、日本がサイバーセキュリティへの緊急資金拠出を推進","link":"https://www.darkreading.com/cybersecurity-operations/japan-emergency-funding-cybersecurity-ai-assisted-breaches-japanese","src":"darkread","date":1794435284,"desc":"この対策パッケージには、官民合同のサイバー対応チーム、経済省が主導するAI専門チーム、および政府の新たな能動的サイバー防衛権限の行使に関する裁量の拡大が含まれている。","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Attackers Say 'Hello' to a Different Scale of Cloud Attack","link":"https://www.darkreading.com/cloud-security/attackers-hello-scale-cloud-attack","src":"darkread","date":1794433444,"desc":"Researchers dubbed an attack chain \"Greeter\" after discovering that attackers deliberately covered their trail by leaving \"hello\" messages in logs.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"eMudhra revokes 8 more CA certificates after private key mishap","link":"https://www.bleepingcomputer.com/news/security/emudhra-revokes-8-more-ca-certificates-after-private-key-mishap/","src":"bleeping","date":1794432460,"desc":"Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"AI Raises the Stakes for Cyber Resilience","link":"https://www.darkreading.com/cyber-risk/ai-raises-stakes-cyber-resilience","src":"darkread","date":1794432041,"desc":"An organization's ability to quickly recover from a business disruption will be a competitive advantage in an era of AI-driven threats and business enablement.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"N-able Takes N-central Platform Offline After Discovery of 33 Flaws","link":"https://www.darkreading.com/endpoint-security/n-able-n-central-offline-33-flaws","src":"darkread","date":1794427518,"desc":"The RMM provider also released a hotfix as a recommended mitigation to address public exploits for the alleged zero-days, which allow for attacker takeover.","auth":false,"cves":[],"topics":["N-able"]},{"exploit":false,"breach":false,"title":"Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)","link":"https://isc.sans.edu/diary/rss/33508","src":"sans","date":1794421723,"desc":"Microsoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Microsoft Edge. 
","auth":false,"cves":["CVE-2026-124194","CVE-2026-119958","CVE-2026-109459","CVE-2026-119967","CVE-2026-116710","CVE-2026-119963","CVE-2026-119964","CVE-2026-113859","CVE-2026-118309","CVE-2026-118314","CVE-2026-118321","CVE-2026-119260"],"topics":["Microsoft","Google Chrome"]},{"exploit":false,"breach":false,"title":"Who Runs the Ransomware Group Qilin?","link":"https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/","src":"krebs","date":1794420361,"desc":"The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator…","auth":false,"cves":[],"topics":["Ransomware: Qilin"]},{"exploit":false,"breach":false,"title":"Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation","link":"https://thehackernews.com/2026/11/critical-zoom-workplace-flaw-could.html","src":"thn","date":1794413566,"desc":"Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score…","auth":false,"cves":["CVE-2026-108186"],"topics":["Microsoft","Zoom"]},{"exploit":false,"breach":true,"title":"AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets","link":"https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html","src":"thn","date":1794411267,"desc":"Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. \"In several…","auth":false,"cves":[],"topics":["AWS"]},{"exploit":true,"breach":false,"title":"Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits","link":"https://thehackernews.com/2026/11/hackers-target-qlik-sense-servers-with.html","src":"thn","date":1794405660,"desc":"Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October…","auth":false,"cves":[],"topics":["Microsoft","Veeam"]},{"exploit":false,"breach":false,"title":"Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords","link":"https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html","src":"thn","date":1794399580,"desc":"Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Shipping giant Maersk probes 'IT security incident,' data theft","link":"https://www.theregister.com/security/2026/11/11/shipping-giant-maersk-probes-it-security-incident-data-theft/5309096","src":"register","date":1794398734,"desc":"Says it 'strongly' suspects attack limited to legacy system, and that nothing sensitive is at risk","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.","link":"https://thehackernews.com/2026/11/we-built-agent-that-broke-all-of-our.html","src":"thn","date":1794398519,"desc":"We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise","link":"https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html","src":"thn","date":1794398453,"desc":"The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company…","auth":false,"cves":[],"topics":["Python"]},{"exploit":false,"breach":false,"title":"Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes","link":"https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html","src":"thn","date":1794385073,"desc":"Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":true,"title":"Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges","link":"https://thehackernews.com/2026/11/railway-says-stolen-customer-ai-keys.html","src":"thn","date":1794383344,"desc":"AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons","link":"https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html","src":"thn","date":1794381665,"desc":"An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":true,"breach":false,"title":"Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches","link":"https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html","src":"thn","date":1794377042,"desc":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active…","auth":false,"cves":["CVE-2026-20320"],"topics":["Cisco"]},{"exploit":false,"breach":false,"title":"OpenAI builds a kill switch for its research models","link":"https://www.theregister.com/ai-and-ml/2026/11/11/openai-builds-a-kill-switch-for-its-research-models/5309006","src":"register","date":1794374456,"desc":"How much damage can a rogue agent do in 35 seconds? Asking cos that’s how long it might take to shut one down","auth":false,"cves":[],"topics":["OpenAI / AI agents"]},{"exploit":false,"breach":false,"title":"ISC Stormcast For Wednesday, November 11th, 2026 https://isc.sans.edu/podcastdetail/10174, (Wed, Nov 11th)","link":"https://isc.sans.edu/diary/rss/33510","src":"sans","date":1794362403,"desc":"(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"CISA director pick already drawing concern from Hill Dems over Palantir connection","link":"https://cyberscoop.com/michael-losapio-cisa-director-nomination-palantir-scrutiny/","src":"cyberscoop","date":1794350296,"desc":"Others touted Michael LoSapio as a fit for the job due to his technical credentials as CISO for the company.","auth":false,"cves":[],"topics":[]},{"exploit":true,"breach":false,"title":"November Patch Tuesday boasts over 1,000 bugs, one already under attack","link":"https://www.theregister.com/security/2026/11/10/november-patch-tuesday-boasts-over-1000-bugs-one-already-under-attack/5308946","src":"register","date":1794350221,"desc":"Microsoft admins wail and gnash their teeth","auth":false,"cves":["CVE-2026-124194","CVE-2026-116928","CVE-2026-119958","CVE-2026-112967"],"topics":["Microsoft"]},{"exploit":true,"breach":false,"title":"November Patch Tuesday: An Overflowing Cornucopia of CVEs","link":"https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves","src":"darkread","date":1794349611,"desc":"Microsoft serves up an actively exploited Outlook zero-day, and a wave of critical Exchange, SharePoint, Windows Search, and LDAP bugs that exhausted defenders need to prioritize fast.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":true,"breach":false,"title":"Microsoft Fixes Nearly 1,100 Security Vulnerabilities","link":"https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/","src":"krebs","date":1794347703,"desc":"Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software. This month's Patch Tuesday addresses 63 critical flaws -- including a zero-day in…","auth":false,"cves":["CVE-2026-124194","CVE-2026-125350"],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"The US wants its quantum lead to turn into factories and supply chains","link":"https://cyberscoop.com/us-quantum-computing-industry-manufacturing-push/","src":"cyberscoop","date":1794347446,"desc":"There’s bipartisan support for further investment in the U.S. quantum industry, along with worries that America’s industrial capacity won’t keep up with demand.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Microsoft fixes over 1,000 vulnerabilities in November Patch Tuesday","link":"https://cyberscoop.com/microsoft-patch-tuesday-november-2026/","src":"cyberscoop","date":1794347221,"desc":"Microsoft’s November security update addresses roughly 1,090 vulnerabilities across Windows, Office, Azure and the company’s other product lines, the second consecutive monthly release to exceed the totals of all previous years. The release formally lists…","auth":false,"cves":["CVE-2026-124194","CVE-2026-116928"],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Ring robots ready to patrol paranoids’ pads","link":"https://www.theregister.com/offbeat/2026/11/10/ring-robots-ready-to-patrol-paranoids-pads/5308932","src":"register","date":1794347145,"desc":"Amazon calls its home security drone and business patrol bot 'proactive protection'","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon","link":"https://www.darkreading.com/cyberattacks-data-breaches/artex-ai-pen-test-tool-hackers-weapon","src":"darkread","date":1794344474,"desc":"Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches at machine speed across multiple industries.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"F-Secure Identifies 26 Ways AI Can Harm Consumers, and Where to Stop Them","link":"https://www.darkreading.com/application-security/f-secure-26-ways-ai-harm-consumers-where-to-stop-them","src":"darkread","date":1794343305,"desc":"New AI Harms Taxonomy traces how harm moves through AI systems, from misleading chatbot answers to compromised autonomous agents, and identifies where defenses can intervene.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Checkmarx Appoints Kobi Sivilya as Chief Information Security Officer","link":"https://www.darkreading.com/cybersecurity-careers/checkmarx-appoints-kobi-sivilya-chief-information-security-officer","src":"darkread","date":1794342934,"desc":"Sivilya brings deep cybersecurity and technology leadership to Checkmarx as AI transforms software development.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"How to Assess OT Incident Response Preparedness","link":"https://www.darkreading.com/ics-ot-security/assess-ot-incident-response-preparedness","src":"darkread","date":1794341923,"desc":"Cloud Range's free 28-question OT Cyber Readiness Assessment helps organizations identify gaps in operational technology (OT) incident response.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones","link":"https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html","src":"thn","date":1794338590,"desc":"A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2…","auth":false,"cves":["CVE-2026-111760"],"topics":[]},{"exploit":false,"breach":false,"title":"SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users","link":"https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html","src":"thn","date":1794338379,"desc":"An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Barracuda’s email security gateways bitten by make-me-root vulns","link":"https://www.theregister.com/security/2026/11/10/barracudas-email-security-gateways-bitten-by-make-me-root-vulns/5308883","src":"register","date":1794336695,"desc":"Someone's fishing for exposed devices","auth":false,"cves":["CVE-2026-116606","CVE-2026-111560"],"topics":["Barracuda"]},{"exploit":false,"breach":false,"title":"AI Coding Agents Leak Thousands of Secrets to GitHub","link":"https://www.darkreading.com/cyber-risk/ai-coding-agents-leak-secrets-github","src":"darkread","date":1794336382,"desc":"A command in Claude Code inadvertently saves files with credentials and other sensitive data to public Git repositories, creating security gaps for organizations.","auth":false,"cves":[],"topics":["GitHub","OpenAI / AI agents"]},{"exploit":true,"breach":false,"title":"Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access","link":"https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html","src":"thn","date":1794334341,"desc":"French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Vanderbilt University reels following ransomware attack claimed by BYOD group","link":"https://cyberscoop.com/vanderbilt-university-ransomware-attack-byod/","src":"cyberscoop","date":1794332789,"desc":"Some services began returning online Tuesday following a ransomware incident detected on Monday across Vanderbilt systems and applications.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem","link":"https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html","src":"thn","date":1794332603,"desc":"Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Trump taps Palantir security chief to run battered US cyber defense agency","link":"https://www.theregister.com/security/2026/11/10/trump-taps-palantir-security-chief-to-run-battered-us-cyber-defense-agency/5308763","src":"register","date":1794327300,"desc":"Michael LoSapio could inherit a depleted workforce and a political headache or two, courtesy of his current employer","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor","link":"https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html","src":"thn","date":1794326455,"desc":"Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early October 2026, involves the exploitation of a chain…","auth":false,"cves":["CVE-2026-105133","CVE-2026-105134"],"topics":["Python"]},{"exploit":false,"breach":false,"title":"Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America","link":"https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html","src":"thn","date":1794326324,"desc":"The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats","link":"https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html","src":"thn","date":1794324839,"desc":"Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a \"limited…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Fireworks AI gets burned twice as customer data exposure widens","link":"https://www.theregister.com/cyber-crime/2026/11/10/fireworks-ai-gets-burned-twice-as-customer-data-exposure-widens/5308722","src":"register","date":1794324480,"desc":"Inference biz pins latest breach on cloud provider and LLMJacking miscreants","auth":false,"cves":[],"topics":[]},{"exploit":true,"breach":false,"title":"Chrome zero-day whack-a-mole continues as 2026 tally hits 8","link":"https://www.theregister.com/security/2026/11/10/chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8/5308732","src":"register","date":1794317280,"desc":"Another Chrome memory bug gets squashed, but not before attackers got their hands on it","auth":false,"cves":["CVE-2026-125350","CVE-2026-125346"],"topics":["Google Chrome"]},{"exploit":false,"breach":false,"title":"AI Makes Reverse Engineering Mainstream Software & Malware Far Easier","link":"https://www.darkreading.com/application-security/ai-reverse-engineering-apps","src":"darkread","date":1794315600,"desc":"Researchers unpacked, mapped, and recreated complex software and the Turla malware, raising opportunities and concerns for organizations and cybersecurity analysts.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Ransomware threat blares from Vanderbilt University computers during cyberattack","link":"https://www.theregister.com/cyber-crime/2026/11/10/ransomware-threat-blares-from-vanderbilt-university-computers-during-cyberattack/5308687","src":"register","date":1794315600,"desc":"BYOD claims extensive data theft as campus Wi-Fi returns, most systems remain restricted, and classes carry on","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Apple Patches Everyting: November 2026 Edition, (Tue, Nov 10th)","link":"https://isc.sans.edu/diary/rss/33506","src":"sans","date":1794314935,"desc":"
","auth":false,"cves":["CVE-2026-113971","CVE-2026-113960","CVE-2026-113961","CVE-2026-113963","CVE-2026-113964","CVE-2026-113965","CVE-2026-113968","CVE-2026-113969","CVE-2026-113970"],"topics":["Apple"]},{"exploit":false,"breach":false,"title":"Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed","link":"https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html","src":"thn","date":1794312931,"desc":"An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26…","auth":false,"cves":[],"topics":["Apple","GitHub"]},{"exploit":false,"breach":false,"title":"Google DeepMind melds humans and AI agents to vet Signal's secure messaging techniques","link":"https://www.theregister.com/ai-and-ml/2026/11/10/google-deepmind-melds-humans-and-ai-agents-to-vet-signals-secure-messaging-techniques/5308625","src":"register","date":1794312000,"desc":"Post-quantum handshake and Triple Ratchet get a formal security check","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog","src":"cisa","date":1794312000,"desc":"CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability CVE-2026-111560…","auth":true,"cves":["CVE-2026-20320","CVE-2026-111560","CVE-2026-111793","CVE-2026-116606","CVE-2026-124194","CVE-2026-125350"],"topics":["Cisco","Barracuda"]},{"exploit":false,"breach":false,"title":"Beyond the Alert: The Case for Rich Network Data","link":"https://thehackernews.com/2026/11/beyond-alert-case-for-rich-network-data.html","src":"thn","date":1794310693,"desc":"At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Spyware attacks trend toward hitting just about anyone","link":"https://cyberscoop.com/spyware-attacks-trend-everyday-people-iverify-report/","src":"cyberscoop","date":1794308400,"desc":"iVerify’s report Tuesday adds to evidence of spyware’s increasingly indiscriminate targeting.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities","link":"https://thehackernews.com/2026/11/apple-patches-imessage-group-chat.html","src":"thn","date":1794305811,"desc":"An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before…","auth":false,"cves":[],"topics":["Apple"]},{"exploit":false,"breach":false,"title":"Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers","link":"https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html","src":"thn","date":1794305249,"desc":"The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails…","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution","link":"https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html","src":"thn","date":1794304960,"desc":"Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on…","auth":false,"cves":[],"topics":["SAP"]},{"exploit":false,"breach":false,"title":"Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments","link":"https://cyberscoop.com/russian-turla-group-used-new-toolset-to-silently-pilfer-emails-from-kazakhstan-romanian-governments/","src":"cyberscoop","date":1794304800,"desc":"Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites","link":"https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html","src":"thn","date":1794301700,"desc":"An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Anthropic's Claude Fable 5.2 Beats GPT-6 Cyber in Multi-Stage Cyberattack Benchmark","link":"https://thehackernews.com/2026/11/anthropics-claude-fable-52-beats-gpt-6.html","src":"thn","date":1794298574,"desc":"Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers \"complete otherwise-infeasible…","auth":false,"cves":[],"topics":["OpenAI / AI agents"]},{"exploit":true,"breach":false,"title":"Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026","link":"https://thehackernews.com/2026/11/google-issues-chrome-security-update.html","src":"thn","date":1794293574,"desc":"Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: 8.8), has been described as…","auth":false,"cves":["CVE-2026-125350"],"topics":["Google Chrome"]},{"exploit":false,"breach":false,"title":"N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits","link":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html","src":"thn","date":1794293076,"desc":"N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. \"As a…","auth":false,"cves":[],"topics":["N-able"]},{"exploit":false,"breach":false,"title":"CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws","link":"https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html","src":"thn","date":1794292302,"desc":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of…","auth":false,"cves":["CVE-2026-123218"],"topics":["OpenSSH"]},{"exploit":false,"breach":false,"title":"Trump picks Palantir’s LoSapio to head CISA","link":"https://cyberscoop.com/trump-picks-palantirs-losapio-to-head-cisa/","src":"cyberscoop","date":1794281891,"desc":"The Cybersecurity and Infrastructure Security Agency has gone without a Senate-confirmed director for all of Trump’s second term, and Michael LoSapio could face resistance, too.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"ISC Stormcast For Tuesday, November 10th, 2026 https://isc.sans.edu/podcastdetail/10172, (Tue, Nov 10th)","link":"https://isc.sans.edu/diary/rss/33504","src":"sans","date":1794276002,"desc":"(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Anthropic's super bug-finding Mythos model is going into Cisco and IBM products","link":"https://www.theregister.com/ai-and-ml/2026/11/10/anthropics-super-bug-finding-mythos-model-is-going-into-cisco-and-ibm-products/5308616","src":"register","date":1794268820,"desc":"Enterprise security tools will offer its capabilities without handing customers the model itself","auth":false,"cves":[],"topics":["Cisco"]},{"exploit":false,"breach":false,"title":"People Are Getting Weird About AI","link":"https://www.darkreading.com/cyber-risk/people-are-getting-weird-about-ai","src":"darkread","date":1794265582,"desc":"Dark Reading Confidential Episode 22: You can love AI without being blind to cybersecurity being sacrificed for utility. The tendency for humans to anthropomorphize the conversations and interactions we're having with AI is growing into potential delusion.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"France blames Iran for supermarket hack meltdowns","link":"https://www.theregister.com/security/2026/11/09/france-blames-iran-for-supermarket-hack-meltdowns/5308591","src":"register","date":1794264321,"desc":"The 'first cyber offensive campaign carried out purely for the purpose of sabotage on national territory'","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"CISA Announces Enhanced Reporting Form for Cyber Incidents","link":"https://www.darkreading.com/cyberattacks-data-breaches/cisa-announces-enhanced-reporting-form-cyber-incidents","src":"darkread","date":1794260300,"desc":"New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion","link":"https://www.darkreading.com/application-security/microsoft-rce-bug-windows-paint-confusion","src":"darkread","date":1794258744,"desc":"Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India","link":"https://www.darkreading.com/cybersecurity-operations/black-hat-india-2026-landmark-debut","src":"darkread","date":1794255596,"desc":"Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days of cutting-edge research, technical exchange and strategic dialogue.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":true,"title":"Attackers backdoor trusted AWS integrations to steal secrets","link":"https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553","src":"register","date":1794254390,"desc":"Wiz researchers uncovered the secret-stealing supply-chain attack","auth":false,"cves":[],"topics":["AWS"]},{"exploit":false,"breach":false,"title":"Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)","link":"https://isc.sans.edu/diary/rss/33502","src":"sans","date":1794248295,"desc":"Just saw a new (to me) URL in our honeypot data today: 
","auth":false,"cves":["CVE-2025-31324"],"topics":["SAP"]},{"exploit":false,"breach":false,"title":"Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux","link":"https://www.darkreading.com/endpoint-security/attackers-claude-office-party-flaw-malicious-code-linux","src":"darkread","date":1794247710,"desc":"Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a user's machine.","auth":false,"cves":[],"topics":["Linux","OpenAI / AI agents"]},{"exploit":true,"breach":true,"title":"Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data","link":"https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html","src":"thn","date":1794246681,"desc":"An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses…","auth":false,"cves":[],"topics":["AWS"]},{"exploit":false,"breach":false,"title":"Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware","link":"https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html","src":"thn","date":1794245788,"desc":"Attackers used the Ethersphere project's own release automation to publish malicious versions of two of its tools for the Swarm decentralized storage network: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both releases download and run code built to steal the…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns","link":"https://www.theregister.com/security/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns/5308483","src":"register","date":1794245460,"desc":"Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US","auth":false,"cves":[],"topics":["Android"]},{"exploit":false,"breach":false,"title":"PwC's CISO on AI, Robots & What's Next for Security","link":"https://www.darkreading.com/cybersecurity-operations/pwc-ciso-ai-robots-security","src":"darkread","date":1794244643,"desc":"As AI accelerates change across the enterprise, PwC's James Shira explains why security teams must rethink their approach to risk and adapt their strategies.","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":false,"title":"NIST: Solo Shouldn't Mean Less Secure","link":"https://www.darkreading.com/cybersecurity-operations/nist-solo-shouldnt-mean-less-secure","src":"darkread","date":1794239170,"desc":"New guidance provides a basic framework for less-technical solo business owners, but it may miss the mark on how to secure technology that requires no human oversight.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session","link":"https://www.theregister.com/security/2026/11/09/microsofts-azure-linux-gets-470-plus-security-fixes-in-one-almighty-patching-session/5308434","src":"register","date":1794236520,"desc":"A mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams","auth":false,"cves":["CVE-2026-114406"],"topics":["Linux","Microsoft"]},{"exploit":false,"breach":true,"title":"Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia","link":"https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html","src":"thn","date":1794234689,"desc":"The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. \"PapRAT has…","auth":false,"cves":[],"topics":["Fortinet"]},{"exploit":false,"breach":false,"title":"Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed","link":"https://www.theregister.com/security/2026/11/09/who-gives-a-crap-hackers-apparently-after-toilet-paper-makers-customer-data-exposed/5308419","src":"register","date":1794234600,"desc":"UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways","link":"https://www.theregister.com/applications/2026/11/09/outlookcom-bounces-legit-emails-as-microsofts-authentication-crackdown-goes-sideways/5308428","src":"register","date":1794231000,"desc":"Missing DMARC or wobbly SPF means your mail may be treated as suspicious","auth":false,"cves":[],"topics":["Microsoft"]},{"exploit":false,"breach":true,"title":"⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More","link":"https://thehackernews.com/2026/11/weekly-recap-sshole-exploited-apt-root.html","src":"thn","date":1794230905,"desc":"A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":true,"title":"Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk","link":"https://www.theregister.com/cyber-crime/2026/11/09/japanese-homeware-giant-pulls-online-store-after-cloud-breach-puts-77m-records-at-risk/5308377","src":"register","date":1794228420,"desc":"No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog","src":"cisa","date":1794225600,"desc":"CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire FreeSwitch Code Injection…","auth":true,"cves":["CVE-2026-102895","CVE-2026-116779","CVE-2026-123158","CVE-2026-123218"],"topics":["OpenSSH"]},{"exploit":false,"breach":false,"title":"Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars","link":"https://thehackernews.com/2026/11/default-adminadmin-server-password.html","src":"thn","date":1794223673,"desc":"The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed…","auth":false,"cves":[],"topics":[]},{"exploit":true,"breach":false,"title":"Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety","link":"https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html","src":"thn","date":1794221785,"desc":"Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the…","auth":false,"cves":[],"topics":["Apple"]},{"exploit":false,"breach":false,"title":"LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks","link":"https://thehackernews.com/2026/11/lnbits-urges-all-operators-to-shut-down.html","src":"thn","date":1794218481,"desc":"Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they…","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Linus Torvalds sees signs AI-prompted patch flood has peaked","link":"https://www.theregister.com/security/2026/11/09/linus-torvalds-sees-signs-ai-prompted-patch-flood-has-peaked/5308345","src":"register","date":1794199988,"desc":"Fixes are arriving faster than new bug reports for one major Linux project","auth":false,"cves":[],"topics":["Linux"]},{"exploit":false,"breach":false,"title":"Huawei says it’s made a 100 percent Chinese PC","link":"https://www.theregister.com/systems/2026/11/09/huawei-says-its-made-a-100-percent-chinese-pc/5308335","src":"register","date":1794190457,"desc":"PLUS: Japan declares infosec emergency; Apple makes biggest school Mac sale, ever, anywhere, in the Philippines; And more!","auth":false,"cves":[],"topics":["Apple"]},{"exploit":false,"breach":false,"title":"ISC Stormcast For Monday, November 9th, 2026 https://isc.sans.edu/podcastdetail/10170, (Mon, Nov 9th)","link":"https://isc.sans.edu/diary/rss/33500","src":"sans","date":1794189910,"desc":"(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)","link":"https://isc.sans.edu/diary/rss/33498","src":"sans","date":1794152673,"desc":"Our honeypots use \"Cowrie\" to collect SSH data. With the emergence of the \"sshole\" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first…","auth":false,"cves":["CVE-2026-123158"],"topics":[]},{"exploit":false,"breach":true,"title":"NHS breach helpline left staff carrying a 'significant emotional burden'","link":"https://www.theregister.com/security/2026/11/07/nhs-breach-helpline-left-staff-carrying-a-significant-emotional-burden/5308201","src":"register","date":1794047400,"desc":"Team given a day's notice faced distressed callers, safeguarding decisions during project that stretched from 2 weeks to 11","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Agents reveal secrets when offered to team up with each other","link":"https://www.theregister.com/security/2026/11/06/agents-reveal-secrets-when-offered-to-team-up-with-each-other/5308260","src":"register","date":1794001163,"desc":"If you wouldn't put it on GitHub, don't give models access to it","auth":false,"cves":[],"topics":["GitHub"]},{"exploit":false,"breach":false,"title":"UK Wades Into Tech Sovereignty Amid AI Policy Changes","link":"https://www.darkreading.com/cybersecurity-operations/uk-tech-sovereignty-ai-policy","src":"darkread","date":1794000456,"desc":"The UK is betting on domestic AI and cyber investment to reduce reliance on US tech — but security leaders question whether the funding is too fragmented and too late.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"AI Gave Your Incident Archive a Second Job","link":"https://www.darkreading.com/cyber-risk/ai-gave-your-incident-archive-second-job","src":"darkread","date":1793989650,"desc":"Security records are increasingly being used by vendors to train their models, creating new risks for enterprises.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Why Europe's Freezer Hacks Spread So Far, So Fast","link":"https://www.darkreading.com/ics-ot-security/europes-freezer-hacks-spread-so-far-so-fast","src":"darkread","date":1793973600,"desc":"Europe's supermarket freezer hacks show how security issues can cascade across an industry, disrupting supply chains at scale.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"DigiCert admits 16-month security lapse exposed customer information","link":"https://www.theregister.com/security/2026/11/06/digicert-admits-16-month-security-lapse-exposed-customer-information/5308097","src":"register","date":1793970900,"desc":"Botched server move left the door open, and DigiCert took months to notice someone had wandered in","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"CISA Adds One Known Exploited Vulnerability to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog","src":"cisa","date":1793966400,"desc":"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability This type of vulnerability is a…","auth":true,"cves":["CVE-2026-19868"],"topics":["SonicWall"]},{"exploit":false,"breach":false,"title":"UK ministers seek powers to investigate when AI agents are let off the leash","link":"https://www.theregister.com/ai-and-ml/2026/11/06/uk-ministers-seek-powers-to-investigate-when-ai-agents-are-let-off-the-leash/5307889","src":"register","date":1793962800,"desc":"Cyber Security and Resilience Bill could pave way for searches, seizures, and inspections when operators lose control of automated systems","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"UK Warns Its Critical Infrastructure Faces Grave Risk","link":"https://www.darkreading.com/cybersecurity-operations/uk-warns-critical-infrastructure-grave-risk","src":"darkread","date":1793955600,"desc":"Britain's new Labour-led government is making a concerted push to get ahead of the AI risks to its national networks and the industrial complex.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Hospital gave very sick doctor a special PC for his very personal use","link":"https://www.theregister.com/security/2026/11/06/hospital-gave-very-sick-doctor-a-special-pc-for-his-very-personal-use/5307750","src":"register","date":1793946660,"desc":"Support chap told to either allow blatant policy violations or find a new job","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"AI agents are a 'bane' for some website operators, says Cloudflare","link":"https://www.theregister.com/networks/2026/11/06/ai-agents-are-a-bane-for-some-website-operators-says-cloudflare/5308022","src":"register","date":1793939114,"desc":"CEO says sovereigns probably exploited PHP2SHELL ages ago, and suggests containers are dead","auth":false,"cves":[],"topics":["PHP","Cloudflare"]},{"exploit":false,"breach":false,"title":"ISC Stormcast For Friday, November 6th, 2026 https://isc.sans.edu/podcastdetail/10168, (Fri, Nov 6th)","link":"https://isc.sans.edu/diary/rss/33494","src":"sans","date":1793930402,"desc":"(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.","auth":false,"cves":[],"topics":[]},{"exploit":false,"breach":false,"title":"Threat actor targets Indian fintechs on weekends when defenders aren’t watching","link":"https://www.theregister.com/security/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/5308000","src":"register","date":1793927860,"desc":"CERT-IN warns of ‘significant escalation’ in AI-powered attacks, some after victims tried to improve defences","auth":false,"cves":[],"topics":[]}],"advisories":[{"id":"wf-4bf30ab09ed83ba51c4a48f8cec0367a","title":"PSA: Critical Apache HTTP/2 Vulnerability: What WordPress Site Owners Should Know","date":1794494357,"link":"https://www.wordfence.com/blog/2026/11/cve-2026-119618-apache-http2/","summary":"Apache has released a fix for a critical vulnerability in the HTTP/2 module of Apache HTTP Server. The issue, CVE-2026-119618, can lead to remote code execution on affected servers. If your WordPress site is hosted on Apache, check your host’s website or announcements to see if they have already fixed this. If you…","src":"wordfence","srcName":"Wordfence","severity":"critical","cvss":null,"cves":["CVE-2026-119618"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"CVE-2026-118207","title":"CVE-2026-118207 Microsoft Exchange Server Remote Code Execution Vulnerability","date":1794326400,"link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118207","summary":"Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.","src":"msrc","srcName":"Microsoft MSRC","severity":"","cvss":null,"cves":["CVE-2026-118207"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"CVE-2026-124194","title":"CVE-2026-124194 Microsoft Outlook Spoofing Vulnerability","date":1794326400,"link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194","summary":"Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.","src":"msrc","srcName":"Microsoft MSRC","severity":"","cvss":null,"cves":["CVE-2026-124194"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"CVE-2026-119958","title":"CVE-2026-119958 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability","date":1794326400,"link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119958","summary":"Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.","src":"msrc","srcName":"Microsoft MSRC","severity":"","cvss":null,"cves":["CVE-2026-119958"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"CVE-2026-120002","title":"CVE-2026-120002 Microsoft SharePoint Server Elevation of Privilege Vulnerability","date":1794326400,"link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120002","summary":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","src":"msrc","srcName":"Microsoft MSRC","severity":"","cvss":null,"cves":["CVE-2026-120002"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"SNWLID-2026-0021","title":"Informational Advisory: SonicOS Client DPI-SSL Trust of Compromised eMudhra Certificate Chain","date":1794301069,"link":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0021","summary":"SonicWall has addressed an issue in SonicOS where appliances with Client DPI-SSL enabled continued to trust certificate chains issued by compromised eMudhra intermediate Certificate Authorities (CAs). Because the firewall’s local certificate store trusted the underlying root certificates, the firewall re-signed…","src":"sonicwall","srcName":"SonicWall PSIRT","severity":"not_defined","cvss":null,"cves":[],"fixed":"","exploit":false,"breach":true,"workaround":false,"notable":true},{"id":"SNWLID-2026-0014","title":"SonicWall SonicOS Affected By Multiple Vulnerabilities","date":1794220808,"link":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014","summary":"1) CVE-2026-107155 - Permissive Cross-domain Policy Vulnerability A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations. CVSS Score: 8.8 CVSS…","src":"sonicwall","srcName":"SonicWall PSIRT","severity":"high","cvss":8.800000000000000710542735760100185871124267578125,"cves":["CVE-2026-77708","CVE-2026-77709","CVE-2026-82308","CVE-2026-107154","CVE-2026-107155","CVE-2026-19703","CVE-2026-19868"],"fixed":"","exploit":false,"breach":false,"workaround":true,"notable":true},{"id":"wf-5a7b0f894f063a91ff13e7ba2f183f75","title":"Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core","date":1793893927,"link":"https://www.wordfence.com/blog/2026/11/attackers-actively-probing-for-upgrade-window-rce-vulnerability-in-wordpress-core/","summary":"On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects…","src":"wordfence","srcName":"Wordfence","severity":"","cvss":null,"cves":["CVE-2026-119977"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"SNWLID-2026-0019","title":"End-Of-Life (EOL) SonicWall GMS Multiple Vulnerabilities","date":1793693791,"link":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019","summary":"1) CVE-2026-109593 - End-of-Life (EOL) SonicWall GMS Unauthenticated File Read Vulnerability An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. CVSS Score: 9.1 CVSS Vector…","src":"sonicwall","srcName":"SonicWall PSIRT","severity":"critical","cvss":9.0999999999999996447286321199499070644378662109375,"cves":["CVE-2026-109593","CVE-2026-109594"],"fixed":"","exploit":false,"breach":false,"workaround":false,"notable":true},{"id":"wf-7efc9e4f8b46fd2cfdf27bde815f3500","title":"HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites","date":1793634488,"link":"https://www.wordfence.com/blog/2026/11/http2shell-wordpress-brotli/","summary":"On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell.","src":"wordfence","srcName":"Wordfence","severity":"critical","cvss":null,"cves":["CVE-2026-111497"],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"ubnt-072","title":"Ubiquiti Security Advisory Bulletin 072: WiFiman Desktop, WiFiman Desktop for macOS","date":1793452401,"link":"https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","summary":"A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device. Affected Products: WiFiman Desktop (Version 1.1.3 and earlier) Mitigation: Update your WiFiman Desktop to Version 1.3.0 or later…","src":"ubiquiti","srcName":"Ubiquiti","severity":"high","cvss":7.79999999999999982236431605997495353221893310546875,"cves":["CVE-2026-119249","CVE-2026-119250","CVE-2026-119251"],"fixed":"Update your WiFiman Desktop to Version 1.3.0 or later. Update your WiFiman Desktop for macOS to Version 1.3.0 or later.","exploit":false,"breach":false,"notable":true},{"id":"wf-3cad13a141c10236a9cb1e76d1c57bc8","title":"WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release","date":1793311124,"link":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","summary":"WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site…","src":"wordfence","srcName":"Wordfence","severity":"","cvss":null,"cves":[],"fixed":"","exploit":true,"breach":false,"notable":true},{"id":"ubnt-071","title":"Ubiquiti Security Advisory Bulletin 071: airMAX M, LTU PTMP, LTU PTP, SolarPoint / SolarSwitch","date":1793060683,"link":"https://community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3","summary":"A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device. Affected Products: airMAX M (Version 6.3.24 and earlier) Mitigation: Update your airMAX M to Version 6.3.26…","src":"ubiquiti","srcName":"Ubiquiti","severity":"high","cvss":8.800000000000000710542735760100185871124267578125,"cves":["CVE-2026-116836","CVE-2026-116837","CVE-2026-116838","CVE-2026-116839"],"fixed":"Update your airMAX M to Version 6.3.26 or later. Update your LTU PTMP to Version 2.4.2 or later. Update your LTU PTP to Version 1.5.7 or later. Update your SolarPoint / SolarSwitch to Version 2.0.3 or later.","exploit":false,"breach":false,"notable":true},{"id":"wp-95c50241fa332fe1c867130c347c8f9c","title":"Critical PHP Security Release","date":1792590249,"link":"https://wordpress.org/news/2026/10/critical-php-security-release/","summary":"The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application…","src":"wordpress","srcName":"WordPress.org","severity":"critical","cvss":null,"cves":[],"fixed":"","exploit":false,"breach":false,"notable":true},{"id":"php-2026-10-21","title":"PHP security releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35","date":1792540800,"link":"https://www.php.net/ChangeLog-8.php","summary":"Security fixes released for PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.","src":"php","srcName":"PHP.net","severity":"security","cvss":null,"cves":[],"fixed":"PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35","exploit":false,"breach":false,"notable":true},{"id":"SNWLID-2026-0018","title":"SonicWall NSM On-Prem Affected By Multiple Vulnerabilities","date":1791960658,"link":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0018","summary":"1) CVE-2026-96540 - SonicWall NSM On-Prem Improper Access Control Vulnerability An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow…","src":"sonicwall","srcName":"SonicWall PSIRT","severity":"high","cvss":8.800000000000000710542735760100185871124267578125,"cves":["CVE-2026-96540","CVE-2026-100232"],"fixed":"","exploit":false,"breach":false,"workaround":false,"notable":true},{"id":"ubnt-070","title":"Ubiquiti Security Advisory Bulletin 070: UniFi Protect AI Key","date":1791953133,"link":"https://community.ui.com/releases/Security-Advisory-Bulletin-070-070/e7ffc9fa-9129-4a90-b5e3-d597c5ee7a73","summary":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device. Affected Products: UniFi Protect AI Key (Version 2.2.6 and earlier) Mitigation: Update your UniFi Protect AI Key to Version 2.2.8 or later…","src":"ubiquiti","srcName":"Ubiquiti","severity":"high","cvss":8.5999999999999996447286321199499070644378662109375,"cves":["CVE-2026-110454","CVE-2026-110455","CVE-2026-110456","CVE-2026-110457","CVE-2026-110458","CVE-2026-110459"],"fixed":"Update your UniFi Protect AI Key to Version 2.2.8 or later.","exploit":false,"breach":false,"notable":true},{"id":"ubnt-068","title":"Ubiquiti Security Advisory Bulletin 068: EdgeMAX EdgeSwitch","date":1791942952,"link":"https://community.ui.com/releases/Security-Advisory-Bulletin-068-068/b95ea5e8-1a80-4ffc-ad42-625eae300cc9","summary":"A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device. Affected Products: EdgeMAX EdgeSwitch (Version 1.12.1 and earlier) Mitigation: Update your EdgeMAX EdgeSwitch to Version…","src":"ubiquiti","srcName":"Ubiquiti","severity":"high","cvss":8.800000000000000710542735760100185871124267578125,"cves":["CVE-2026-77532"],"fixed":"Update your EdgeMAX EdgeSwitch to Version 1.12.2 or later.","exploit":false,"breach":false,"notable":true},{"id":"wp-70369fe75138459c1430233c698eb5f0","title":"WordPress 7.1.3 Maintenance and Security Release","date":1791306000,"link":"https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/","summary":"This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you…","src":"wordpress","srcName":"WordPress.org","severity":"security","cvss":null,"cves":[],"fixed":"WordPress 7.1.3","exploit":false,"breach":false,"notable":true},{"id":"SNWLID-2026-0017","title":"SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities","date":1791279840,"link":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017","summary":"1) CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to…","src":"sonicwall","srcName":"SonicWall PSIRT","severity":"critical","cvss":10,"cves":["CVE-2026-102255","CVE-2026-102256","CVE-2026-102257","CVE-2026-102258"],"fixed":"","exploit":false,"breach":false,"workaround":false,"notable":true},{"id":"ubnt-069","title":"Ubiquiti Security Advisory Bulletin 069: Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, and Dream Wall, Express, Express 7…","date":1790099076,"link":"https://community.ui.com/releases/Security-Advisory-Bulletin-069-069/07e367a7-edec-4d85-a058-f97e5ce9ac9c","summary":"A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device. Affected Products: Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, and Dream Wall (Version 5.1.26 and…","src":"ubiquiti","srcName":"Ubiquiti","severity":"high","cvss":7.5,"cves":["CVE-2026-77544","CVE-2026-77555","CVE-2026-77556","CVE-2026-77558","CVE-2026-95861","CVE-2026-95862"],"fixed":"Update your Dream Machines, Enterprise Firewalls, Dream Routers, Cloud Gateways, and Dream Wall to Version 5.1.31 or later. Update your Express to Version 4.0.21 or later. Update your Express 7 to Version 5.1.31 or later. Update your UniFi Gateways to Version 5.1.26 or later.","exploit":false,"breach":false,"notable":true},{"id":"wp-f35c6075a5ac43fd3e930bdf41c61693","title":"WordPress 7.1.1 Maintenance and Security Release","date":1789674789,"link":"https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/","summary":"This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click…","src":"wordpress","srcName":"WordPress.org","severity":"security","cvss":null,"cves":[],"fixed":"WordPress 7.1.1","exploit":false,"breach":false,"notable":true}],"stats":{"kevWeek":10,"criticalNew":15,"articles":177,"kevTotal":1779}}