BeyondTrust warns of critical flaws in remote access software
The vulnerabilities, tracked as CVE-2026-40138 and CVE-2026-40139, affect specific versions of BeyondTrust's RS and PRA software.
Threat Intelligence Feed
Aggregating 7473 articles from trusted cybersecurity sources
LATEST CVEs
HIGH · CVE-2026-55175
Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, a
HIGH · CVE-2026-44383
Multiple connections to the backend using the same charging station ID
are allowed, which could allow an attacker to de
HIGH · CVE-2026-42952
Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could al
CRIT · CVE-2026-20744
The charging station websocket endpoint accepts connections without
proper authentication, which could lead to privileg
CVE-2026-15089
vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.
CVE-2026-15087
vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
CVE-2026-15086
vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter
CRIT · CVE-2026-14480
OpenPLC Runtime v3 contains an authenticated arbitrary file write
vulnerability in the legacy web UI program‑upload wor
CVE-2026-14286
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-11915
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions
CVE-2026-11914
vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.
CVE-2026-11913
vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
CVE-2026-59155
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET
CVE-2026-58591
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox al
CVE-2026-58590
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: f
CVE-2026-58589
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: f
CVE-2026-58588
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canv
CVE-2026-58587
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canv
CVE-2026-58503
Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via
CVE-2026-57584
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a def
CVE-2026-55884
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP
CVE-2026-55883
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebS
CVE-2026-55882
Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD serv
CVE-2026-55852
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Imp
CVE-2026-55810
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphin
CVE-2026-55809
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance f
CVE-2026-55808
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core
CVE-2026-55807
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue af
CVE-2026-55806
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This is
CVE-2026-55804
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow
CVE-2026-55803
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allow
MED · CVE-2026-55187
Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is
CVE-2026-54736
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the
MED · CVE-2026-52761
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.
HIGH · CVE-2026-52747
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to
CVE-2026-49844
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces
CVE-2026-49394
Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_pag
HIGH · CVE-2026-49213
TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHtt
CVE-2026-48127
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach
CVE-2026-47422
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked approp
Latest News
UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge
Two announcements on July 7, 2026, demonstrate the government’s determination to improve the level of cybersecurity within the UK. The post UK Government Rol...
UK government launches Cyber Resilience Pledge with M&S and Capita signing up
Marks & Spencer has become one of the first companies to sign up to the UK government's new Cyber Resilience Pledge, following a year where the retailer ...
Suspected Chinese spies target universities with Roundcube exploit
Hackers selling UK government login credentials on dark web amid FortiBleed campaign
The FortiBleed campaign targets internet-facing Fortinet VPNs and firewalls, with over 70,000 devices in 194 countries believed to be affected.
Assail Inc. launches Sidewinder, an autonomous security platform
Sidewinder represents a significant redesign of Assail's Ares platform, moving from a script-following scanner to a system that plans its own security engage...
The Hidden Security Risks of Reduced Summer IT Coverage
Security operations don't slow down when IT teams take vacation, but staffing levels often do. Kaseya explains how AI-driven automation can help organization...
Why we cannot wait for better post-quantum signature algorithms
NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and ar...
Vibe-Coded Malware Caught in Active Directory Attack
Huntress found a threat actor using vibe-coded PowerShell to map an Active Directory network
Paris Peace Forum launches initiative to combat AI threats to internet infrastructure
INTAiC will gather researchers and civil society experts from government and the private sector to analyze current AI cyber threats and produce forward-looki...
AI coding assistants bypass safety filters through workflow manipulation
Researchers Abhishek Kumar and Carsten Maple from the Alan Turing Institute discovered this vulnerability, termed "workflow-level jailbreak construction.
CyberProof launches agentic AI service to automate security investigations
The new service, CyberProof Agentic MXDR, is a form of managed extended detection and response that integrates AI agents with human security experts.
Data Breaches
Dutch police suspect Dutch hackers in Odido data breach
The breach, which occurred on February 7 and was disclosed on February 12, affected 6.2 million Odido customers.
Miinto customer data accessed in security incident
The breach, which Miinto reported to the police and data protection authorities, may have compromised customer names, email addresses, physical addresses, an...
Police suspects Dutch hackers were involved in Odido breach
The Dutch National Police (Politie) says it has found "strong indications" that Dutch hackers have been involved in a February breach at the telecommunicatio...
The Good, the Bad and the Ugly in Cybersecurity – Week 28
Authorities launch Operation First Light 2026, attackers deploy Forg365 to hijack Microsoft accounts, and rival cyberspies breach Pakistani police networks.
Regulatory frameworks are enablers, not burdens
When done correctly, regulations can help companies restore operations quickly and maintain trust after a breach.
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops
Other noteworthy stories that might have slipped under the radar: Abnormal AI sued by Anthropic, AssuranceAmerica data breach affects 7 million people, NSA b...
AssuranceAmerica confirms data breach affecting 6.9 million driver's licenses
AssuranceAmerica discovered unauthorized access to its systems on March 17, concluding its investigation on June 15.
AssuranceAmerica Breach Exposes 7 Million Driver’s Licenses After Employee Account Hack
AssuranceAmerica confirmed a breach exposing nearly 7 million driver’s licenses after hackers compromised an employee account and stole customer data. U.
12 Million Impacted by Data Breach at Japanese Telco KDDI
Hackers exploited a zero-day vulnerability in a third-party system to access a KDDI email system for ISPs. The post 12 Million Impacted by Data Breach at Jap...
AssuranceAmerica Confirms Massive Data Breach Exposing Driver’s License and Insurance Data
AssuranceAmerica, a U.S.
Nike Alleged Breach: Threat Actors Claim Leak of Millions of Customer Records
A threat actor on a prominent cybercrime forum has claimed responsibility for leaking data allegedly belonging to Nike and Alcon, posting the purported datas...
AssuranceAmerica data breach exposes records of 6.9 million drivers
American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attackers gained access to its systems earli...