Find what you’re looking for
Browse everything
6,854 results in Threat Reports
GitLab's Maximum-Severity Vulnerability: A Supply Chain Security Wake-Up Call
CVE-2026-85706, a maximum-severity path traversal vulnerability in GitLab Community and Enterprise Editions, is being actively exploited by threat actors to compromise software supply chains. The flaw, which received a CVSS score of 10.0, allows unauthenticated attackers to read arbitrary files from GitLab servers, including sensitive credentials and CI/CD secrets. GitLab disclosed and patched the vulnerability on September 10, 2026, but CISA added it to their Known Exploited Vulnerabilities catalog within days due to observed exploitation in the wild. Researchers detected rapid escalation from initial probes to full exploitation, with attackers extracting configuration files and SSH credentials that could enable complete system compromise and lateral movement into development environments. This incident highlights the growing threat to software supply chains as adversaries increasingly target development platforms to gain privileged access to source code, build processes, and deployment pipelines across multiple organizations.
CareCam CM2507 IP Cameras: Seven Critical Vulnerabilities Expose Enterprise Networks
The CareCam CM2507 IP camera contains seven critical vulnerabilities (CVE-2026-88259 through CVE-2026-81321) that collectively allow complete device compromise. These flaws include missing authentication for video streaming, empty passwords in ONVIF services, cleartext credential storage, weak password hashing, and unauthorized script execution from removable media. Attackers can exploit these vulnerabilities to access live video feeds, extract stored credentials, execute arbitrary code, and pivot to connected networks. The vendor has not responded to CISA's coordination attempts, leaving deployed devices unpatched. This incident highlights the persistent security challenges in IoT devices deployed across commercial facilities worldwide, particularly as organizations increasingly rely on IP cameras for security monitoring while threat actors actively target poorly secured IoT infrastructure for initial access and lateral movement.
CISA Elevates Cisco Email Gateway SQL Injection to Critical Threat Status
CISA has added CVE-2026-76461, a critical SQL injection vulnerability in Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, system compromise, and lateral movement within enterprise networks. The addition to the KEV Catalog under Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of this high-risk vulnerability on publicly exposed assets. This incident highlights the continued targeting of email security infrastructure by threat actors seeking initial access to enterprise environments. As organizations increasingly rely on cloud-based email security solutions, vulnerabilities in these critical gateway systems present attractive attack vectors for data exfiltration and ransomware deployment campaigns.
Critical Siemens Reyrolle 7SR5 Vulnerabilities Threaten Power Grid Security
Siemens Reyrolle 7SR5 protection relay systems before version 2.70 are affected by 14 critical vulnerabilities, including authentication bypass, session hijacking, and buffer overflow conditions. These vulnerabilities in the Cesanta Mongoose Web Server component allow unauthenticated remote attackers to gain administrative access, execute arbitrary code, and cause denial-of-service conditions on critical power grid protection equipment deployed worldwide. The highest severity vulnerability (CVE-2026-62645) achieves a CVSS score of 9.8, enabling complete system compromise through predictable session identifiers and missing authentication controls. These vulnerabilities highlight the growing cybersecurity risks in operational technology (OT) environments, particularly as critical infrastructure becomes increasingly connected and exposed to network-based attacks targeting industrial control systems.
Chinese APT UTA0560 Weaponizes Chrome-Windows Zero-Day Chain in GRIMWEDGE Campaign
In September 2026, Chinese threat actor UTA0560 conducted a sophisticated spear-phishing campaign targeting multiple NGOs using a zero-day exploit chain dubbed BlueMoon. The attackers chained three vulnerabilities - CVE-2026-85046 and CVE-2026-87491 in Chrome, plus CVE-2026-85880 in Windows ALPC - to deploy the GRIMWEDGE JavaScript backdoor. The campaign leveraged reflected XSS vulnerabilities on legitimate university websites to redirect victims to malicious infrastructure hosting the multi-stage exploit chain, demonstrating advanced persistent threat capabilities. This incident highlights the growing threat of patch-gap exploitation, where attackers rapidly weaponize vulnerabilities that are patched in open-source codebases but not yet released in stable versions. With AI-powered exploit development accelerating vulnerability research timelines, organizations face compressed windows to defend against sophisticated nation-state campaigns targeting critical infrastructure and NGOs.
Critical Hardcoded Key Vulnerabilities Expose Maritime Infrastructure in Wärtsilä FOS-Onboard Systems
Critical vulnerabilities CVE-2026-78225 and CVE-2026-81855 were discovered in Wärtsilä FOS-Onboard version 5.07.0923.01, affecting maritime transportation systems worldwide. Both vulnerabilities involve hardcoded cryptographic keys - one in the deployer-ng Update Controller component and another in the robot testing framework component. With CVSS scores of 9.0 and 9.1 respectively, successful exploitation could allow attackers to deliver unauthorized updates, execute arbitrary code, or extract credentials to impersonate privileged clients. Wärtsilä has developed security patches and states the vulnerabilities are not exploitable when the product is installed according to recommendations. This incident highlights the growing threat to maritime critical infrastructure as operational technology systems become increasingly connected and targeted by sophisticated adversaries seeking to disrupt global supply chains.
Critical SAML Flaw in Siemens Mendix Enables Account Hijacking Across Industrial Systems
A critical authentication bypass vulnerability (CVE-2026-80465) was discovered in Siemens Mendix SAML modules across multiple versions, scoring 8.7 on the CVSS scale. The flaw stems from improper validation of SAML response signatures, allowing unauthenticated remote attackers to hijack user accounts and sessions in specific Single Sign-On (SSO) configurations. Affected versions include Mendix 9.24, 10, and 11 compatible modules, with the vulnerability impacting critical manufacturing and IT infrastructure worldwide. Siemens has released patches requiring immediate updates to versions 3.6.27 or 4.2.3 depending on the Mendix platform version. This incident highlights the growing trend of authentication protocol vulnerabilities targeting enterprise SSO systems, particularly as organizations increasingly rely on federated identity management for cloud and hybrid environments.
Critical XSS Vulnerability in Siemens Teamcenter Exposes Manufacturing Systems to Web-Based Attacks
A reflected cross-site scripting (XSS) vulnerability (CVE-2026-58113) was discovered in Siemens Teamcenter's authentication redirect flow, affecting multiple versions across V2412, V2506, V2512, and V2606 product lines. The vulnerability allows unauthenticated remote attackers to inject malicious JavaScript into authenticated user sessions through crafted URLs, potentially enabling data theft and unauthorized actions within victims' Teamcenter sessions. Siemens has released patches for all affected versions and recommends immediate updates to mitigate the CVSS 6.1 rated vulnerability. This incident highlights the persistent threat of web application vulnerabilities in critical manufacturing systems, particularly as organizations increasingly rely on web-based PLM platforms for sensitive industrial operations and intellectual property management.
Cisco Email Gateway Under Attack: CVE-2026-76461 Grants Root Access via Malicious Emails
In September 2026, Cisco disclosed CVE-2026-76461, a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway with a CVSS score of 9.8. The flaw stems from insufficient validation in email parsing logic, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted email messages containing malicious SQL statements. Cisco confirmed active exploitation in the wild and directly contacted customers whose devices showed signs of compromise. The U.S. CISA immediately added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies apply patches by September 17, 2026. This incident highlights the escalating threat to email security infrastructure as attackers increasingly target messaging gateways to gain initial foothold and root-level access, coinciding with broader campaigns against network appliances like the concurrent Fortinet VPN credential attacks reported in late August 2026.
Critical LiteSpeed Enterprise Flaw Exposes Shared Hosting Infrastructure to Root Access Attacks
A critical privilege escalation vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 allows low-privilege hosting account users to gain root access on shared hosting servers. Disclosed by cPanel on September 14, 2026, the flaw bypasses security controls including CageFS that normally isolate hosting accounts from each other. The vulnerability enables attackers with basic hosting accounts to access or alter other customers' websites and compromise the entire server infrastructure. LiteSpeed released version 6.3.7 on September 11 to address the issue, though specific technical details and CVE assignment remain pending. This represents the third LiteSpeed-related privilege escalation flaw reported since May 2026, highlighting ongoing security challenges in shared hosting environments where multiple customer websites coexist on single servers.
Vite Development Servers Under Attack: Mass Campaign Steals Cloud Credentials
In 2024, cybersecurity researchers from F5 Labs disclosed a mass-scanning campaign targeting exposed Vite development servers to extract sensitive cloud credentials and configuration data. The automated attack systematically scanned internet-facing Vite instances, exploiting misconfigurations to steal AWS and Microsoft Azure credentials, infrastructure state files, and other sensitive development artifacts. The campaign demonstrated how exposed development environments can become critical attack vectors for cloud infrastructure compromise, potentially leading to broader cloud account takeovers and data breaches across multiple organizations. This incident highlights the growing threat to cloud-native development workflows as attackers increasingly target DevOps toolchains and CI/CD pipelines. With organizations rapidly adopting cloud-first development practices and infrastructure-as-code approaches, securing development servers and preventing credential exposure has become a critical security imperative for preventing cloud account compromise.
Critical Vulnerability in Schneider Electric SCADAPack x70 Systems Exposes Industrial Infrastructure
Schneider Electric disclosed a critical vulnerability (CVE-2026-81861) affecting all versions of its SCADAPack x70 Remote Terminal Units used in critical infrastructure worldwide. The insufficiently protected credentials vulnerability could allow unauthorized access to RTU configuration through the legacy Secure Lock functionality, potentially compromising confidentiality of industrial control systems. The vulnerability affects SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 products deployed globally in critical manufacturing and energy sectors. Industrial control system vulnerabilities continue to represent a significant threat vector as critical infrastructure increasingly becomes a target for nation-state actors and ransomware groups seeking to disrupt essential services and cause maximum societal impact.