PT-2026-4523

Name of the Vulnerable Software and Affected Versions RuoYi version 4.8.2 Description An access control issue exists in the update function of the software. This allows unauthorized modification of data beyond the intended scope. Recommendations Update to a newer version that contains a fix for...

Under Armour ransomware breach: data of 72 million customers appears on the dark web

When reports first emerged in November 2025 that sportswear giant Under Armour had been hit by the Everest ransomware group, the story sounded depressingly familiar: a big brand, a huge trove of data, and a lot of unanswered questions. Since then, the narrative around what actually happened has...

Exploit for SQL Injection in Progress Moveit_Cloud

MOVEit Transfer 2023 Mass Data Breach Overview This reposi...

MAL-2026-384 Malicious code in @mikudev/signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dddb766a44047fdc14156a60478172f91323f76100b8fc519f26d26397a2a915 The package @mikudev/signal was found to contain malicious code. Source: ghsa-malware f71f53e3538af5a0731e164d819b83390317e35e73a710f46338da15f2c82b4...

Everest Ransomware Claims McDonalds India Breach Involving Customer Data

The notorious Everest ransomware group is claiming to have breached McDonald's India, the Indian subsidiary of the American…...

CVE-2025-55130

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

CVE-2025-55130

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

The Ultimate CISO Dashboard: A Complete Guide

Traditional vulnerability management can feel like a never-ending game of whack-a-mole. You patch one critical issue, and three more pop up, leaving your team feeling burnt out and perpetually behind. A modern dashboard changes the game entirely. By integrating real-world threat intelligence, it...

RansomHouse Claims Data Breach at Major Apple Contractor Luxshare

RansomHouse claims to have breached Apple contractor Luxshare, but no evidence has been released. Links are offline and the breach remains unverified...

CVE-2025-14977

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the /wp-json/dokan/v1/settings REST API endpoint due to missing validation on a...

MiracleLinux 8 : bubblewrap-0.4.0-2.el8_10, flatpak-1.12.9-3.el8_10 (AXSA:2024-8785:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8785:01 advisory. flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 Tenable has extracted the preceding description block directly...

PT-2026-3714

Name of the Vulnerable Software and Affected Versions Oracle Hospitality OPERA 5 versions 5.6.19.23 through 5.6.27.4 Description An easily exploitable issue exists in the Oracle Hospitality OPERA 5 product, specifically within the Opera Servlet component. An unauthenticated attacker with network...

Huawei HarmonyOS Memo Module Privilege Control Vulnerability (CNVD-2026-13996)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege control vulnerability exists in the Huawei HarmonyOS memo module, which can be exploited by an attacker to compromise confidentiality...

Huawei HarmonyOS Print Module Improper Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An improper privilege control vulnerability exists in the Huawei HarmonyOS printing module, which can be exploited by an attacker to compromise confidentiali...

What Is Exposure Management Cybersecurity? A Guide

For too long, security has been a defensive game of whack-a-mole. A new threat appears, and we scramble to patch it. But what if we could see our organizations the way an attacker does? Attackers don’t care about your patching cadence or your CVSS scores. They look for the path of least...

What is Breach and Attack Simulation (BAS)? A Guide

If you’re on a vulnerability management team, you’re likely drowning in a sea of CVEs. Your scanners produce massive lists of potential weaknesses, but with limited time and resources, which ones do you fix first? A high CVSS score doesn't always translate to real-world risk. You need context to...

MiracleLinux 7 : rh-mariadb101-mariadb-10.1.19-6.el7 (AXSA:2016-1178:02)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1178:02 advisory. MariaDB is a community developed branch of MySQL. MariaDB is a multi-user, multi-threaded SQL database server. It is a client/server implementation...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001399)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001399 advisory. A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux kernel. This flaw allows a local attacker with a...

Hacker Claims Full Breach of Russia’s Max Messenger, Threatens Public Leak (Update: Fake Breach)

A hacker claims a full breach of Russia’s Max Messenger, threatening to leak user data and backend systems if demands are not met...

How Cybercrime Markets Launder Breach Proceeds and What Security Teams Miss

Explore how cybercrime markets turn stolen data into laundered funds using dollar‑pegged assets, mixers and exchanges-and why tracking BTC USDT price and stablecoin flows now matters for security, fraud and AML teams...