How Iranian Cyber Intrusions Unfold Inside Enterprise Networks
Iranian cyber operations have gone from being disruptive single events to ongoing campaigns against governments, infrastructure providers, technology compani...
Threat Intelligence Feed
Aggregating 7579 articles from trusted cybersecurity sources
LATEST CVEs
CVE-2026-58489
HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export
CVE-2026-58486
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was
CVE-2026-58102
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID
CVE-2026-58101
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference.
X509V3_EXT_d2
HIGH · CVE-2026-57856
Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() meth
HIGH · CVE-2026-57855
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api
MED · CVE-2026-15607
A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the fi
CVE-2026-15605
A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download
HIGH · CVE-2026-62328
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack
CRIT · CVE-2026-62327
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack
HIGH · CVE-2026-62242
Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated a
HIGH · CVE-2026-62240
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one
MED · CVE-2026-62239
FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and
HIGH · CVE-2026-62200
OpenClaw versions before 2026.6.1 contain a flaw in host exec environment filtering that could allow Git ext transport t
HIGH · CVE-2026-62199
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup va
MED · CVE-2026-62198
OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allo
HIGH · CVE-2026-62197
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket
HIGH · CVE-2026-62196
OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can s
HIGH · CVE-2026-62195
OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature th
HIGH · CVE-2026-62194
OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that
MED · CVE-2026-62193
OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the in
HIGH · CVE-2026-62192
OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that a
HIGH · CVE-2026-62191
OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling th
HIGH · CVE-2026-62190
OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-t
HIGH · CVE-2026-62189
OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower
HIGH · CVE-2026-62188
OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Fe
HIGH · CVE-2026-62187
OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A low
HIGH · CVE-2026-62186
OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model override
HIGH · CVE-2026-62185
Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access r
HIGH · CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log
HIGH · CVE-2026-61458
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-
CRIT · CVE-2026-59801
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact
HIGH · CVE-2026-58500
MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In
CVE-2026-58488
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attac
CVE-2026-58487
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe
CVE-2026-58411
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities
MED · CVE-2026-56877
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplie
CVE-2026-52533
An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component
CVE-2026-51821
SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitra
CVE-2026-51541
OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit re
Latest News
Copy Fail lands in CISA KEV as actively exploited Linux flaw threatens widespread privilege escalation
The Cybersecurity and Infrastructure Security Agency (CISA) has added another Linux kernel vulnerability, CVE-2026-31431, also known as Copy Fail, to the Kno...
Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries
Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed lures and legitimate em...
CrowdStrike Launches Falcon OverWatch for Defender
10 Anzeichen für einen schlechten CSO
Sind IT-Mitarbeiter unzufrieden, kann das an schlechten Führungskräften oder an einer unzureichenden IT-Strategie liegen. Foto: fizkes – shutterstock.
ISC Stormcast For Tuesday, May 5th, 2026 https://isc.sans.edu/podcastdetail/9918, (Tue, May 5th)
Anthropic Mythos spurs White House to weigh pre-release reviews for high-risk AI models
The Trump administration is in early discussions about whether advanced AI models should be vetted before public release, according to reporting from the New...
Hacking Embodied AI
Embodied AI, intelligent systems in physical forms such as humanoid and quadruped robots, is moving from spectacle to staffing plans.
Elastic Workflows GA: automation where your security data already lives
Elastic Workflows is generally available in 9.4, bringing production-ready security automation with deeper case management integration, human-in-the-loop sup...
Know who to watch before the incident finds you
Elastic Security v9.
AI-generated hunting leads: The hunt starts before you ask the question
Introducing AI-generated hunting leads, proactive, environment-aware threat hypotheses powered by Elastic Entity analytics and integrated AI reasoning.
Your UEBA is lying to you: Why entity record quality decides everything
Most entity analytics systems are confidently wrong. They track users who do not exist, generate risk scores built on noise, and call it behavioral analytics.
Data Breaches
Varonis launches 'Breach at the Beach' Entra ID training CTF
The "Breach at the Beach" CTF, created by Varonis researchers Doron Kapah and Mark Vaitsman, simulates attacks within Entra ID, focusing on how threat actors...
Lidl reports data breach affecting online customers in Germany, Belgium, and the Netherlands
The compromised data includes customer salutations, first and last names, phone numbers, email addresses, dates of birth, and customer numbers.
Argentine Football Association systems reportedly compromised after nearly year-old infostealer infection
The breach was discovered after mass emails were sent from legitimate AFA domains, claiming Argentina "stole" the win from Egypt.
Lidl Notified Online Shop Customers in Germany, Belgium, and the Netherlands of a Data Breach
Lidl disclosed a third-party data breach affecting online shop customers in Germany, Belgium, and the Netherlands. Payment data was not exposed.
Russian celebrity journalist Ksenia Sobchak says hackers accessed Telegram channels via email breach
Following the breach of several of her Telegram channels, controversial Russian journalist Ksenia Sobchak claimed published screenshots of her correspondence...
Hackers breach Lidl’s IT service provider, steal customer data
German discount supermarket chain Lidl has notified customers in Germany, Belgium, and the Netherlands that customer data was stolen after attackers breached...
Lessons Learned from CISA’s Recent GitHub Leak
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA cr...
The Canvas breach exposed higher Ed's third-party identity blind spot
Here are five steps defenders can take in the wake of the Canvas breach.
Lidl discloses online shop breach after service provider hack
German discount supermarket chain Lidl notified customers in Germany, Belgium, and the Netherlands that attackers stole their personal information in a breac...
Breach at the Beach: Play the Ultimate Entra ID CTF
Learn how attackers abuse Entra ID through a free hands-on Capture the Flag. Varonis created the Breach at the Beach CTF to teach defenders how to investigat...
13th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 13th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES U.
Dutch Nationals Suspected in Odido Hack That Exposed Six Million Customers
Dutch police suspect local hackers behind the Odido breach that exposed 6M customers after a phishing attack and seek public help identifying them.