Active vulnerabilities, advisories, and threat intelligence — filtered for IT practitioners.
Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - SICAM EGS Devi...
Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. E...
Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server. The following versions of Rockwell Automation FactoryTalk DataMosaix are affected: DataMos...
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected: Core...
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability CVE-202...
Successful exploitation these vulnerabilities could allow an attacker to execute arbitrary code in the context of the current process. The following versions of Rockwell Automation Arena are affected: Arena <=V17.00.0...
Developed by CISA, the National Security Agency (NSA) and international partners, this joint guidance contains best practices for software manufacturers and online service providers to design and implement a coordinat...
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Over...
Successful exploitation of this vulnerability could allow an attacker to read or delete files, stop tasks, modify memory, and change I/O states, potentially impacting the confidentiality, integrity, and availability o...
ABB became aware of vulnerability in the products versions listed as affected in the advisory, where an incorrect version of Online Builder (ONB) was included in the media. An update is available that resolves the vul...
ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities. An attacker who successfully exploited any of these vul...
ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE‑2026...
Update July 16, 2026 : CISA has updated this Alert to reflect the addition of CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) Catalog on July 16, 2026. CISA is aware of active exploitation of vulnerabiliti...
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability This type of vulne...
Microsoft patched a zero-day in the Windows Common Log File System driver that ransomware operators Storm-0506 and RansomEXX actively exploited to escalate from standard user to SYSTEM before deploying payloads.
A critical stack-based buffer overflow in Ivanti Connect Secure VPN was exploited as a zero-day by UNC5221 (China-nexus) to deploy TRAILBLAZE dropper and BRUSHFIRE passive backdoor on edge devices globally.
A zero-click NTLM hash leak via .library-ms files is being actively exploited in phishing campaigns targeting government and private sector organizations in Poland and Romania.
A sandbox escape in Google Chrome was exploited as a zero-day in a targeted espionage campaign against media organizations, educational institutions, and government entities in Russia.
Five vulnerabilities in the Kubernetes ingress-nginx controller, collectively dubbed IngressNightmare, allow unauthenticated attackers with access to the admission webhook to achieve cluster-level code execution.
A trivial header injection in Next.js allows attackers to skip middleware execution entirely, bypassing authentication, authorization, and security checks on any route protected only by Next.js middleware.
