Researchers Uncover ProxySmart Software Powering 90+ SIM Farms
Infrawatch says ProxySmart platform enables SIM farm activity at “industrial scale”
Threat Intelligence Feed
Aggregating 5001 articles from trusted cybersecurity sources
LATEST CVEs
CVE-2026-53430
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip
CVE-2026-48854
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers
CVE-2026-48853
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grp
HIGH · CVE-2026-48723
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions pri
CVE-2026-48599
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc
CVE-2026-12205
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.
Crypt::DS
CVE-2026-5064
Potential security vulnerabilities have been identified in the HP One
Agent for certain HP PC products, which might all
CRIT · CVE-2026-48714
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno
CRIT · CVE-2026-48713
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missi
MED · CVE-2026-48157
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.
HIGH · CVE-2026-48017
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate
CVE-2026-12087
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the l
CVE-2026-11832
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.
The default nonce was genera
CRIT · CVE-2026-9691
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For
CRIT · CVE-2026-52703
Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
HIGH · CVE-2026-52702
Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.
HIGH · CVE-2026-52700
Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
HIGH · CVE-2026-52699
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
HIGH · CVE-2026-52697
Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
HIGH · CVE-2026-52695
Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.
HIGH · CVE-2026-52694
Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.
CRIT · CVE-2026-52693
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
HIGH · CVE-2026-52692
Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.
CRIT · CVE-2026-49781
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
HIGH · CVE-2026-49780
Customer Privilege Escalation in Dokan <= 5.0.2 versions.
CRIT · CVE-2026-49776
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websit
MED · CVE-2026-49775
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
MED · CVE-2026-49773
Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
CRIT · CVE-2026-49770
Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
CRIT · CVE-2026-49769
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
CRIT · CVE-2026-49768
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
CRIT · CVE-2026-49766
Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
CRIT · CVE-2026-49765
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <=
CRIT · CVE-2026-49764
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
CRIT · CVE-2026-49763
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.
HIGH · CVE-2026-49112
Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.
HIGH · CVE-2026-49110
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.
CRIT · CVE-2026-49109
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, N
CRIT · CVE-2026-49106
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.
CRIT · CVE-2026-49105
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <=
Latest News
UK Faces a Cyber ‘Perfect Storm’ Driven by Tech Advances and Nation State Threats, NCSC Warns
The convergence of global tensions and rapid technological change is driving a new era of cyber risk, the NCSC warns
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
Winter 2025 SOC 1 report is now available with 184 services in scope
Amazon Web Services (AWS) is pleased to announce that the Winter 2025 System and Organization Controls (SOC) 1 report is now available. The report covers 184...
Evolution of Chinese-Language Guarantee Telegram Marketplaces
Chinese-language, Telegram-based “guarantee” marketplaces are increasingly popular among Chinese-speaking criminal groups despite the widely publicized shutd...
AI Hype vs. Reality: Is AI Really Rewriting the Vulnerability Equation?
AI vulnerability research and discovery capabilities are improving, but they have not changed the fundamentals of vulnerability management.
[local] Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation
Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation
[webapps] WordPress Plugin 5.2.0 - Broken Access Control
WordPress Plugin 5.2.
[local] AVAST Antivirus 25.11 - Unquoted Service Path
AVAST Antivirus 25.
Oracle April 2026 Critical Patch Update Addresses 241 CVEs
Oracle addresses 241 CVEs in its second quarterly update of 2026 with 481 patches, including 34 critical updates. Key takeaways: The second Critical Patch Up...
Trojanized Android App Fuels New Wave of NFC Fraud
NGate malware abuses HandyPay app to steal NFC card data and PINs in Brazil
Data Breaches
Maine closes data breach portal to the public after fake reports
Maine is still allowing companies to report breaches, but won’t make the portal easily available to the public until after it completes an audit of its proce...
Council of Europe investigates ShinyHunters data breach claims
The Council of Europe, the continent's oldest intergovernmental body, is probing claims of a data breach made by the ShinyHunters extortion group over the we...
Adriatic Port Cyber-Attack by Anubis Sparks Warning Over Maritime Security Risks
How the Anubis ransomware group stole and leaked an Italian Adriatic port authority's data
Chinese hackers breach REDCap servers, steal medical research
A China-linked espionage campaign targeted exposed REDCap servers to deploy the InfiniteRed malware and steal sensitive data from a medical institution in No...
15th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Univer...
Maine forced to take down data breach portal after fake notices filed with authorities
The US state of Maine has taken its public data breach notification portal offline after someone submitted fraudulent breach disclosures impersonating two we...
Novo Nordisk Confirms Data Theft: What Attackers Took and What They Didn’t
Novo Nordisk suffered a cyberattack where clinical trial data was copied. The breach is confirmed, but no threat actor has claimed responsibility.
Infinite Campus data breach affects 137,000 school staff accounts
The ShinyHunters extortion gang stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the w...
Handala Hacking Group Claims Breach of California Water Service
The Handala hacking group claims it has targeted California Water Service, leaking 5GB of customer database and GPS network files in its latest infrastructur...
Maine Takes Breach Reporting Portal Offline After Fake Entries
The Office of the Maine Attorney General has suspended its breach reporting portal
SHADOWBYT3$ Allegedly Claims Nintendo Breach and Theft of Sensitive Data
Threat intelligence sources have flagged a potential cybersecurity incident involving Nintendo after threat actor “SHADOWBYT3$” allegedly claimed responsibil...
Maine Disables Data Breach Portal Due to Fake Submissions
Someone posted fake VRChat and Discord data breach reports on the system, prompting the Maine AG to take action. The post Maine Disables Data Breach Portal D...