● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability This type of vulnerability is a frequent attack vector …
An attacker can exploit multiple vulnerabilities in FreeBSD Project FreeBSD OS to escalate their privileges, disclose information, manipulate files, conduct a denial of service attack, and execute arbitrary code.
A remote, authenticated attacker can exploit multiple vulnerabilities in Microsoft GitHub Enterprise Server to conduct a cross-site scripting attack, bypass security measures, and disclose confidential information.
A remote, anonymous attacker can exploit multiple vulnerabilities in UltraVNC to execute arbitrary code, disclose confidential information, manipulate data, and cause a denial of service.
An attacker can exploit multiple vulnerabilities in LiteLLM to bypass security measures, execute arbitrary code, and manipulate files.
An attacker from an adjacent network can exploit a vulnerability in IBM InfoSphere Information Server to disclose information.
An attacker can exploit multiple vulnerabilities in IBM WebSphere Application Server Liberty to perform an unspecified attack and to bypass security measures.
Adobe has fixed multiple vulnerabilities in Adobe ColdFusion versions 25.9, 23.20, and earlier versions. The vulnerabilities in Adobe ColdFusion include unrestricted upload of dangerous file types, improper input validation, path traversal, reflected Cross-Site Scripting (XSS), a…
SkyBridge MB-A100/MB-A110 provided by Seiko Solutions Inc. contains an OS command injection vulnerability.
On July 1, 2026, we released version 18.8.11 for GitLab Community Edition and Enterprise Edition. These versions resolve regressions and bugs. This patch release does not include any security fixes. When database load balancing is in use, database connections may not be returned …
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
Multiple vulnerabilities have been discovered in Adobe ColdFusion. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and data confidentiality breaches.
Multiple vulnerabilities have been discovered in Citrix products. Some of them allow an attacker to cause remote denial of service, data confidentiality breaches, and an unspecified security issue by the vendor.
A vulnerability has been discovered in Mozilla Firefox. It allows an attacker to cause remote arbitrary code execution.
On July 1, 2026, we released version 18.8.11 for GitLab Community Edition and Enterprise Edition. These versions resolve regressions and bugs. This patch release does not include any security fixes. When database load balancing is in use, database connections may not be returned …
Citrix has fixed vulnerabilities in NetScaler ADC and NetScaler Gateway related to insufficient input validation, improper access control, and incorrect memory release. The vulnerabilities with CVE-2026-8451 and CVE-2026-10817 arise from insufficient input validation, where the s…
Serial number: AV26-645 Date: June 30, 2026 Updated: July 2, 2026 On June 30, 2026, Citrix published a security advisory to address critical vulnerabilities in the following products: NetScaler ADC and NetScaler Gateway - versions 14.1 before 14.1-72.61 NetScaler ADC and NetScale…
Serial number: AV26-644 Date: June 30, 2026 On June 30, 2026, Mozilla published a security advisory to address a vulnerability in the following product: Firefox – versions prior to 152.04 Thunderbird – versions prior to 140.12.1 Thunderbird – versions prior to 152.01 The Cyber Ce…
Impact A small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing through public OpenAPI.NET reader APIs and has been confirmed across both JSON and YAML re…
Serial number: AV26-643 Date: June 30, 2026 On June 23, 2026, wolfSSL published a security advisory to address vulnerabilities in the following product: wolfSSL – versions prior to 5.9.2 The Cyber Centre encourages users and administrators to review the provided web links and app…
Serial number: AV26-642 Date: June 30, 2026 On May 26, 2026, SimpleHelp published a security update to address vulnerabilities in the following product: SimpleHelp – versions 5.5.0 to versions prior to 5.5.16 SimpleHelp – versions 6.0 to versions prior to 6.0 RC2 On June 29, 2026…
View CSAF Summary Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to enumerate all user accounts and role assignments on a FUXA SCADA/HMI instance. The following versions of Frangoteam FUXA SCADA/HMI are affected: FUXA SCADA/HMI <=1.3.…
View CSAF Summary Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Data Center Expert. The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehen…
View CSAF Summary An update is available that resolves vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the product to stop or corrupt memory data. The following versions of XZ Utils vu…
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to gain broad unauthorized access, execute arbitrary commands with root privileges, steal sensitive data, and perform actions on behalf of legitimate users across interconnected systems. The …
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to remotely issue commands, modify operational values, interfere with control logic, and alter device behavior without authentication or privilege enforcement. The following versions of Del…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes. The following versions of OFFIS DCMTK Toolkit are affected: DCMTK <=3.7.…
View CSAF Summary Successful exploitation of these vulnerabilities can allow an attacker to cause unauthorized access and exposure of sensitive information when the unauthenticated attacker accesses credentials stored within firmware or system files. The following versions of Sch…
View CSAF Summary Successful exploitation of these vulnerabilities could allow a local attacker to tamper with or destroy information in the affected product, cause a denial-of-service condition in the affected product, or execute arbitrary code when a specially crafted archive f…
Apple has fixed multiple vulnerabilities in iOS and iPadOS. The vulnerabilities include out-of-bounds access, use-after-free, memory handling errors, insufficient input validation, type confusion, double free, stack overflow, race conditions, and path handling issues. These error…
Apple has fixed multiple vulnerabilities in macOS Tahoe. The vulnerabilities included out-of-bounds access, use-after-free, memory handling errors, type confusion, double free, stack overflow, insufficient input validation, and race conditions. These could lead to unexpected cras…
RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability.
DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability.
Multiple vulnerabilities have been discovered in Apache Tomcat. Some of them allow an attacker to cause remote indirect code injection (XSS), security policy bypass, and an unspecified security issue by the vendor.
Multiple vulnerabilities have been discovered in Apple products. Some of them allow an attacker to cause data confidentiality breaches, data integrity breaches, and security policy bypass.
Multiple vulnerabilities have been discovered in Synology MailPlus Server. Some of them allow an attacker to cause remote denial of service, data confidentiality breaches, and data integrity breaches.
Multiple vulnerabilities were discoverd in Nginx, a high-performance web and reverse proxy server, which could result in remote code execution, denial of service or memory disclosure. https://security-tracker.debian.org/tracker/DSA-6374-1
Bulletin ID: 2026-048-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/29/2026 11:15 PM PDT Description: AWS WAF is a web application firewall that monitors the HTTP(S) requests that are forwarded to your protected web application resources. We ide…
Serial number: AV26-641 Date: June 29, 2026 On June 29, 2026, Apple published security advisories to address vulnerabilities in the following products: iOS and iPadOS – versions prior to 26.5.2 macOS Tahoe – versions prior to 26.5.2 Safari – versions prior to 26.5.2 The Cyber Cen…
Serial number: AV26-640 Date: June 29, 2026 On June 26, 2026, Microsoft published a security update to address vulnerabilities in the following product: Microsoft Edge Stable Channel – versions prior to 149.0.4022.98 The Cyber Centre encourages users and administrators to review …
Serial number: AV26-639 Date: June 29, 2026 Between June 22 and 28, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following: IBM Cloud Pak System – version 2.3.5.0 IBM Observability with Instana (Ag…
Serial number: AV26-638 Date: June 29, 2026 Between June 22 and 28, 2026, Dell published security advisories to address vulnerabilities in multiple products: Dell PowerProtect Data Manager Appliance DM5510 – versions prior to 20.1.0.0 Dell Networking OS10 – versions prior to 10.6…
Serial number: AV26-637 Date: June 29, 2026 Between June 22 and 28, 2026, CISA published ICS advisories to address vulnerabilities in the following products: ABB Freelance Security Lock – all versions B&R Industrial Automation GmbH APROL – versions prior to APROL-AutoYaST-DVD- V4…
Serial number: AV26-636 Date: June 29, 2026 Between June 22 and 28, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products: Red Hat CodeReady Linu…
Serial number: AV26-635 Date: June 29, 2026 Between June 22 and 28, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products: Ubuntu 20.04 LTS Ubuntu 22.04 LTS Ubuntu 26.04 LTS The Cyber Centre encourages users and ad…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48558 SimpleHelp Authentication Bypass Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors an…
MISP has fixed multiple vulnerabilities in the MISP platform. The vulnerabilities include manipulating client-supplied primary and foreign keys by authenticated users, leading to unauthorized data overwriting, ownership transfer, and modification of record scopes. Furthermore, th…
n8n has fixed multiple vulnerabilities in the n8n workflow automation platform, specifically in versions prior to 1.123.55, 2.24.0, 2.25.7, 2.26.1, and 2.26.2. The vulnerabilities affect various components of the n8n platform. Authenticated users with workflow editing rights can …