Scaling AI Agents with Confidence
Palo Alto Networks wins Global Technology Google Cloud Partner of the Year Award! Our Google Cloud, Google Cloud Next partnership delivers AI-driven security.
Threat Intelligence Feed
Aggregating 5055 articles from trusted cybersecurity sources
LATEST CVEs
CVE-2026-53430
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip
CVE-2026-48854
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers
CVE-2026-48853
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grp
HIGH · CVE-2026-48723
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions pri
CVE-2026-48599
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc
CVE-2026-12205
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.
Crypt::DS
CVE-2026-5064
Potential security vulnerabilities have been identified in the HP One
Agent for certain HP PC products, which might all
CRIT · CVE-2026-48714
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno
CRIT · CVE-2026-48713
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missi
MED · CVE-2026-48157
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.
HIGH · CVE-2026-48017
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate
CVE-2026-12087
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the l
CVE-2026-11832
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.
The default nonce was genera
CRIT · CVE-2026-9691
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For
CRIT · CVE-2026-52703
Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
HIGH · CVE-2026-52702
Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.
HIGH · CVE-2026-52700
Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
HIGH · CVE-2026-52699
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
HIGH · CVE-2026-52697
Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
HIGH · CVE-2026-52695
Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.
HIGH · CVE-2026-52694
Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.
CRIT · CVE-2026-52693
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
HIGH · CVE-2026-52692
Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.
CRIT · CVE-2026-49781
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
HIGH · CVE-2026-49780
Customer Privilege Escalation in Dokan <= 5.0.2 versions.
CRIT · CVE-2026-49776
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websit
MED · CVE-2026-49775
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
MED · CVE-2026-49773
Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
CRIT · CVE-2026-49770
Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
CRIT · CVE-2026-49769
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
CRIT · CVE-2026-49768
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
CRIT · CVE-2026-49766
Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
CRIT · CVE-2026-49765
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <=
CRIT · CVE-2026-49764
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
CRIT · CVE-2026-49763
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.
HIGH · CVE-2026-49112
Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.
HIGH · CVE-2026-49110
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.
CRIT · CVE-2026-49109
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, N
CRIT · CVE-2026-49106
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.
CRIT · CVE-2026-49105
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <=
Latest News
Cisco Catalyst SD-WAN Vulnerabilities
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an attacker to access an affected system, elevate privileges ...
NCSC Unveils SilentGlass, a Plug-In Device to Protect Monitors from Cyber-Attacks
The UK’s cybersecurity agency said the devices will be available for purchase by organizations around the world
Oracle Critical Patch Update, April 2026 Security Update Review
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 481 security vulnerabilities.
UK Commits £90m for Cybersecurity and Pushes for ‘Resilience Pledge’
UK unveils £90m cybersecurity funding at CYBERUK to boost SME resilience, promote Cyber Essentials and a new Cyber Resilience Pledge, sparking industry debate
Palo Alto Networks Joins DNS-OARC as a Platinum Member
Palo Alto Networks joining DNS-OARC as a Platinum Member to collaborate on DNS research and security and improve internet resilience. The post Palo Alto Netw...
Surge in Silent Subject Phishing Attacks Targets VIP Users
Null subject phishing campaigns bypass filters and target VIPs with QR code and RMM abuse
Making Rust Workers reliable: panic and abort recovery in wasm‑bindgen
Panics in Rust Workers were historically fatal, poisoning the entire instance. By collaborating upstream on the wasm‑bindgen project, Rust Workers now suppor...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-33825 Microsoft...
Proofpoint CEO on AI Security Innovations | Nasdaq at RSAC 2026
Former Ransomware Negotiator Pleads Guilty to Working For BlackCat Cyber Gang
A former ransomware negotiator has pleaded guilty to abusing his position by working with noted cybercrime group BlackCat
When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks
Unit 42 research reveals AirSnitch attacks bypass WPA2/3 Wi-Fi encryption and client isolation, exposing critical infrastructure vulnerabilities. The post Wh...
Data Breaches
Maine closes data breach portal to the public after fake reports
Maine is still allowing companies to report breaches, but won’t make the portal easily available to the public until after it completes an audit of its proce...
Council of Europe investigates ShinyHunters data breach claims
The Council of Europe, the continent's oldest intergovernmental body, is probing claims of a data breach made by the ShinyHunters extortion group over the we...
Adriatic Port Cyber-Attack by Anubis Sparks Warning Over Maritime Security Risks
How the Anubis ransomware group stole and leaked an Italian Adriatic port authority's data
Chinese hackers breach REDCap servers, steal medical research
A China-linked espionage campaign targeted exposed REDCap servers to deploy the InfiniteRed malware and steal sensitive data from a medical institution in No...
15th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Univer...
Maine forced to take down data breach portal after fake notices filed with authorities
The US state of Maine has taken its public data breach notification portal offline after someone submitted fraudulent breach disclosures impersonating two we...
Novo Nordisk Confirms Data Theft: What Attackers Took and What They Didn’t
Novo Nordisk suffered a cyberattack where clinical trial data was copied. The breach is confirmed, but no threat actor has claimed responsibility.
Infinite Campus data breach affects 137,000 school staff accounts
The ShinyHunters extortion gang stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the w...
Handala Hacking Group Claims Breach of California Water Service
The Handala hacking group claims it has targeted California Water Service, leaking 5GB of customer database and GPS network files in its latest infrastructur...
Maine Takes Breach Reporting Portal Offline After Fake Entries
The Office of the Maine Attorney General has suspended its breach reporting portal
SHADOWBYT3$ Allegedly Claims Nintendo Breach and Theft of Sensitive Data
Threat intelligence sources have flagged a potential cybersecurity incident involving Nintendo after threat actor “SHADOWBYT3$” allegedly claimed responsibil...
Maine Disables Data Breach Portal Due to Fake Submissions
Someone posted fake VRChat and Discord data breach reports on the system, prompting the Maine AG to take action. The post Maine Disables Data Breach Portal D...