Insights & Intelligence
Stay ahead of evolving threats with expert analysis, practical guides, and a live vulnerability feed from our security team.
Actively Exploited Vulnerabilities
Severity scores say what could happen. This board tracks what is happening: every entry has confirmed exploitation in the wild, per CISA’s Known Exploited Vulnerabilities catalog, ranked by date added and scored with FIRST’s EPSS exploit-probability model.
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and dele...
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able ...
Containerd has image-pull DoS via crafted OCI index graph amplification
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth ...
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent...
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
social-auth-core has a Session Fixation issue
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
social-auth-core has an Improper Authentication issue
Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomp...
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-4643...
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
zbateson/mail-mime-parser has CRLF header injection via attachment filename
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted M...
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti...
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti...
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that coul...
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload h...
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that ...
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that ...
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti...
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code exec...
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator tha...
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect gen...
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanSta...
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that ...
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused ...
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused ...
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a...
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoin...
jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints...
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balance...
Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could re...
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privile...
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding...
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerabili...
Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that al...
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers...
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a...
Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creatio...
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching ...
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects ...
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)....
Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to dis...
Latest Articles
Why AI-Powered Threat Detection is the New Standard
Traditional rule-based detection misses 60% of novel attacks. Learn how machine learning is changing the game for threat identification.
The Hidden Risks of Shadow AI in Your Organization
Over 70% of employees use unauthorized AI tools. Discover how to find, assess, and control shadow AI before it becomes a data breach.
Zero Trust Architecture: A Practical Implementation Guide
Moving beyond buzzwords — a step-by-step framework for implementing zero trust that actually works for mid-market organizations.
Red Team vs. Pen Test: Which Does Your Business Need?
Understanding the difference between penetration testing and red team engagements, and when each approach delivers the most value.
Need Help Addressing These Threats?
Our team can assess your exposure and implement protections against the latest vulnerabilities.
Schedule a Consultation