Permiso launches risk score engine for unified identity security
The Risk Score Engine generates three key outputs: Identity Risk Scores to rank the riskiest identities, Session Scores to flag immediate investigation needs...
Threat Intelligence Feed
Aggregating 7418 articles from trusted cybersecurity sources
LATEST CVEs
HIGH · CVE-2026-59858
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/cco
MED · CVE-2026-59857
Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in s
HIGH · CVE-2026-59856
Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/p
CVE-2026-59855
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts in
MED · CVE-2026-59854
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts at
MED · CVE-2026-59853
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint ret
HIGH · CVE-2026-59834
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/searc
CVE-2026-59833
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content t
HIGH · CVE-2026-59832
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler ser
MED · CVE-2026-59831
GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace
CVE-2026-57501
Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance
MED · CVE-2026-44342
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0
HIGH · CVE-2026-33655
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0
MED · CVE-2026-59828
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions tha
MED · CVE-2026-58144
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users wi
HIGH · CVE-2026-58143
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attacke
CRIT · CVE-2026-58123
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attacker
CRIT · CVE-2026-58122
Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attacker
MED · CVE-2026-57054
A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS o
MED · CVE-2026-57032
An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Jun
MED · CVE-2026-57031
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper N
MED · CVE-2026-57030
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the packe
MED · CVE-2026-57029
A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series
HIGH · CVE-2026-57028
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolve
MED · CVE-2026-57027
A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Netw
HIGH · CVE-2026-57026
An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on
MED · CVE-2026-57025
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and
MED · CVE-2026-57024
A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos O
HIGH · CVE-2026-57023
An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS
MED · CVE-2026-57022
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper N
MED · CVE-2026-57021
An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows
MED · CVE-2026-57020
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper N
MED · CVE-2026-57019
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Net
MED · CVE-2026-55689
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skippe
MED · CVE-2026-55605
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hos
HIGH · CVE-2026-55604
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-
CVE-2026-55424
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured
CVE-2026-55170
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the dat
HIGH · CVE-2026-53963
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second
MED · CVE-2026-53962
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG s
Latest News
Hong Kong SFC mandates stronger login security for crypto platforms
The SFC has mandated that all virtual asset trading platforms and internet brokers must replace one-time password (OTP) logins, including those sent via SMS ...
The Intercept warns of compromised Signal tipline username
An analysis by Dr. Martin Shelton of the Freedom of the Press Foundation suggests several ways the Signal username could have been compromised.
Mount Royal University hit by ransomware attack, data stolen and deleted
The cyberattack, claimed by the threat group CMD Organization, involved the theft of data from the university's "H drive," which contained information for cu...
Nextcloud exposes sensitive data due to hosting misconfiguration
The exposed data included employee emails, client company details, contracts, and scripts.
New Helix data extortion group uses identity-focused tactics to target SharePoint
Helix initiates contact through vishing, sometimes impersonating managers via caller ID spoofing, to trick targets into device-code phishing schemes for acco...
HalluSquatting: New AI attack method enables scalable botnets and large-scale infections
HalluSquatting, short for adversarial hallucination squatting, leverages the inability of LLMs to accurately distinguish between legitimate and fabricated re...
HP DeskJet 2800 series printers vulnerable to sensitive data exposure
AssuranceAmerica confirms data breach affecting 6.9 million driver's licenses
AssuranceAmerica discovered unauthorized access to its systems on March 17, concluding its investigation on June 15.
NCSC outlines national cyber shield plans using frontier AI
The NCSC's Cyber Shield initiative is a response to the escalating scale, speed, and sophistication of cyber threats, particularly from state-sponsored actor...
Critical Gitea flaw allows authentication bypass via single HTTP header
The vulnerability stems from an insecure default configuration in Gitea's official Docker images (versions prior to 1.26.
Keyfactor secures over $1 billion in funding to expand encryption management
Keyfactor's platform, AgileSec, helps organizations manage and secure their encryption keys and other cryptographic assets like digital certificates.
Data Breaches
Dutch police suspect Dutch hackers in Odido data breach
The breach, which occurred on February 7 and was disclosed on February 12, affected 6.2 million Odido customers.
Miinto customer data accessed in security incident
The breach, which Miinto reported to the police and data protection authorities, may have compromised customer names, email addresses, physical addresses, an...
Police suspects Dutch hackers were involved in Odido breach
The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunicatio...
The Good, the Bad and the Ugly in Cybersecurity – Week 28
Authorities launch Operation First Light 2026, attackers deploy Forg365 to hijack Microsoft accounts, and rival cyberspies breach Pakistani police networks.
Regulatory frameworks are enablers, not burdens
When done correctly, regulations can help companies restore operations quickly and maintain trust after a breach.
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops
Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA b...
AssuranceAmerica confirms data breach affecting 6.9 million driver's licenses
AssuranceAmerica discovered unauthorized access to its systems on March 17, concluding its investigation on June 15.
AssuranceAmerica Breach Exposes 7 Million Driver’s Licenses After Employee Account Hack
AssuranceAmerica confirmed a breach exposing nearly 7 million driver’s licenses after hackers compromised an employee account and stole customer data. U.
12 Million Impacted by Data Breach at Japanese Telco KDDI
Hackers exploited a zero-day vulnerability in a third-party system to access a KDDI email system for ISPs. The post 12 Million Impacted by Data Breach at Jap...
AssuranceAmerica Confirms Massive Data Breach Exposing Driver’s License and Insurance Data
AssuranceAmerica, a U.S.
Nike Alleged Breach: Threat Actors Claim Leak of Millions of Customer Records
A threat actor on a prominent cybercrime forum has claimed responsibility for leaking data allegedly belonging to Nike and Alcon, posting the purported datas...
AssuranceAmerica data breach exposes records of 6.9 million drivers
American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attackers gained access to its systems earli...