Cisco has published an unauthenticated SQL injection in Secure Email Gateway, already exploited. No workaround, and a second critical advisory the same day.
Vulnerabilities & Alerts
SQL injection exploited in Cisco Secure Email Gateway
by •
Category: Vulnerabilities & Alerts
Bulletins on critical vulnerabilities, exploitation analyses and alerts tracked as they break. Microsoft Patch Tuesday, the CISA KEV catalogue, CERT-FR and CERT-UA advisories, actively exploited zero-days, Sigma, YARA and Suricata detection rules, and patch prioritisation.
Vulnerabilities & Alerts
Six permission bypasses in Mistral Vibe
by •
HiddenLayer published six critical CVEs in Mistral’s coding agent. All target the same authorisation layer, and no fix has shipped.
CTI & OSINT, Vulnerabilities & Alerts
RoguePlanet: a new Microsoft Defender zero-day disclosed in the wake of Patch Tuesday
by •
RoguePlanet: a new Microsoft Defender zero-day disclosed in the wake of Patch Tuesday Threat Intelligence · Vulnerability June 10, 2026 · Marc-Frédéric Gomez · 6 min read Just hours after the June 2026 fixes shipped, the researcher Nightmare Eclipse published a new exploit targeting Microsoft Defender. It works against Windows systems that are already up…
Vulnerabilities & Alerts
Project Glasswing
by •
Artificial Intelligence — vulnerabilities-anthropic What the First Public Update on Claude Mythos Reveals Anthropic published on May 22, 2026 the results of the first month of its defensive initiative. More than 10,000 vulnerabilities of high or critical severity identified, a bottleneck that has shifted from detection to remediation, and an access strategy that draws a…
Vulnerabilities & Alerts
Reading Root-Owned Files Without Privilege
by •
Technical Analysis · Linux Kernel Vulnerability Reading Root-Owned Files Without Privilege: What CVE-2026-46333 Reveals About Nine Years of Blind Spot in the Linux Kernel A race window in the Linux kernel ptrace access control allows, via pidfd_getfd(2), the theft of file descriptors held by SUID root binaries about to terminate. Two public exploits exfiltrate SSH…
CTI & OSINT, Vulnerabilities & Alerts
Two Windows zero-days disclosed without coordination
by •
CTI Analysis · Critical Vulnerability BitLocker Is No Longer a Promise: What the YellowKey Case Reveals Two Windows zero-days disclosed without coordination, a researcher openly challenging Microsoft, and a phantom component in the Windows Recovery Environment whose true nature, bug or backdoor, no one can yet determine. Published May 14, 2026 Reading time 15 minutes…
CTI & OSINT, Vulnerabilities & Alerts
CVE-2026-40361: zero-click use-after-free vulnerability in the Outlook rendering engine (wwlib.dll)
by •
Remote code execution via the Reading Pane, without user interaction Executive summary On May 12, 2026, as part of the monthly Patch Tuesday cycle, Microsoft released a fix for CVE-2026-40361, a critical use-after-free vulnerability (CWE-416) officially classified by the vendor as a “Microsoft Office Word Remote Code Execution Vulnerability” (1) (2). Researcher Haifei Li, founder…
Vulnerabilities & Alerts
Dirty Frag (CVE-2026-43284 and CVE-2026-43500)
by •
Universal Local Privilege Escalation in the Linux Kernel Executive summary On May 7, 2026, researcher Hyunwoo Kim (alias @v4bel) publicly disclosed a new class of Linux kernel vulnerabilities named Dirty Frag (1) (2). This disclosure, brought forward as a result of an embargo break by an unrelated third party, exposes an exploitation chain combining two…
Vulnerabilities & Alerts
Microsoft Patch Tuesday April 2026
by •
Vulnerabilities & Alerts
Russian Intelligence Services Espionage Campaign Targeting Signal Accounts and Encrypted Messaging Applications
by •
Technical and Strategic AnalysisFBI/CISA PSA I-032026-PSA — March 20, 2026 | TLP:CLEAR 1. Executive Summary — Board Level / Strategic View On March 20, 2026, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) jointly published a public service announcement (PSA I-032026-PSA) alerting the public to an active campaign by…
