10122 matches found
CVE-2026-48207
creationtimestamp| type| source ---|---|--- 2026-05-21 17:20:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmewkfjyo22j 2026-05-21 19:05:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf4gxjw3k2o 2026-05-21 20:01:11+00:00| seen|...
Claude Enterprise Meets the Security Graph: Wiz Integrates with Anthropic's Compliance API
Security and compliance teams can now monitor Claude activity directly in Wiz, extending the workflows they already rely on to AI...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
Linux Kernel nftables: Vulnerability involving local privilege escalation after free operations; nftchainlookupbyid fails to check whether a chain is active, and CAPNETADMIN is present in any user or network namespace...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fixed a possible use-after-free during activity updates. The “rule activity update” process periodically traverses a list of configured rules and queries their activity from the device. As part of this...
CVE-2026-7284
creationtimestamp| type| source ---|---|--- 2026-05-20 03:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116604667946550443 2026-05-20 03:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmavz62j2w2w 2026-05-20 03:00:44+00:00| seen|...
Malicious code in @shinzepelly/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957954ced5e6fb2e8ab6a666adf496ca2edc7575a4e202b593d6698b5d89809f Package impersonates the legitimate libsignal-node library description copied verbatim: "Open Whisper Systems' libsignal for Node.js" under an...
PT-2026-42146
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4 Description An issue exists where the Symbol.for override in setup-sandbox.js only intercepts a small portion of dangerous Node.js cross-realm symbols. This is compounded by the bridge's set, defineProperty, and...
PT-2026-42147
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4 Description A security check in nodevm.js designed to block the combination of nesting: true and require: false is bypassed because it uses strict equality options.require === false. If the require option is omitte...
GenAI-Driven Threat Detection with Microsoft Security Copilot
Defending against today's increasingly sophisticated cyberattacks requires security analysts to continuously translate evolving attacker tradecraft into detection logic. This places defenders in a reactive posture, requiring constantly updated expertise across an increasingly fragmented security...
CVE-2026-34358 CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any...
CVE-2026-45498
creationtimestamp| type| source ---|---|--- 2026-05-19 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1878 2026-05-20 10:16:09+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-av26-489 2026-05-20 14:10:08+00:00| seen|...
MAL-2026-4172 Malicious code in @piewasm/pie-web-npm-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27940c7a5e80299a3ab5976317ca47edd6560422fdf60ee02a4a8974dba1aa51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Activity Log versions = 5.6.3...
MAL-2026-4169 Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 940faf3ecfa6ee3c09c995a5f124d4a3b53bf2e2e5eaccea8156ce7bd25494eb The package paysafe-gbp-virtual-assistant-lib-fe was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in identitysecuretokenserv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2704e731d0b82aa5927cf3713f741111b03fe8efb2d886cb0ef472a24705c5e3 The package identitysecuretokenserv was found to contain malicious code. Source: ghsa-malware...
ScadaBR
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to perform unauthenticated remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network...
MAL-2026-3856 Malicious code in @antv/calendar-heatmap (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
How Storm-2949 turned a compromised identity into a cloud-wide breach
In this article 1. Attack chain overview 1. Cloud compromise: Microsoft Entra ID and Microsoft 365 2. Initial access and persistence through targeted social engineering and SSPR abuse 3. Directory discovery and persistence 4. Microsoft 365 discovery and exfiltration 5. Cloud compromise: Microsoft...
CERTFR-2026-ACT-022
creationtimestamp| type| source ---|---|--- 2026-05-18 11:39:08+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mm4s3dwvnz2n 2026-05-18 11:39:09+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116595382450086436...
