Low
No critical-grade activity in the monitored windows.- CISA KEV Catalog37 m ago
- NVD CVE 2.023 h agoerr
- GitHub Security Advisories37 m ago
- OSV.dev124 d agoerr
- Microsoft MSRC125 d agoerr
- CISA ICS-CERT advisories2 h ago
- CISA Cybersecurity Advisories22 h ago
- abuse.ch URLhaus124 d agoerr
- abuse.ch ThreatFox10 d agoerr
- Nuclei templates23 h ago
Zero-day attacks · live
All recent CISA KEV additions, ransomware-linked CVEs, supply-chain attacks, and vendor zero-day disclosures.
Severity mix
1,000 CVEs · 30 d- critical0
- high0
- medium221
- low779
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compr
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requeste
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-110447
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-114625
SUSE-SU-2026%3A4889-1
CVE-2026-63887 · CVE-2026-68158
SUSE-SU-2026%3A4888-1
CVE-2026-63795 · CVE-2026-63887 · CVE-2026-68158
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2026-102208
Windows Network Load Balancing Remote Code Execution Vulnerability
CVE-2026-83862
Distrust compromised intermediate certificates in crypto/x509
CVE-2026-111943
VU#763488: Memory corruption vulnerabilities in PHP
CVE-2026-109618 · CVE-2026-109619
aka PCPCat, ShellForce, DeadCatx3, SHADOW-WATER-058 +1
aka UNC6240, Bling Libra
aka Storm-2697, GOLD SHERWOOD
aka UNC1549, TA455, COBALT SMOKEY
aka NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima +2
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
CVE-2026-111497
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CVE-2026-110447
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)