● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Summary OliveTin's OAuth2 login handler stores per-login state in an in-memory map (registeredStates) that grows unboundedly. States are added on every /oauth/login request but are never deleted or expired. An unauthenticated attacker can send millions of requests to /oauth/logi…
Serial number: AV26-760 Date: July 30, 2026 As of July 29, 2026, Adobe is affected by vulnerabilities in the following product: Adobe Campaign Classic ALL except 7.4.3 build 9398 Prior to or equal to 7.4.3 build 9397 The Cyber Centre encourages users and administrators to review …
Serial number: AV26-759 Date: July 30, 2026 As of July 30, 2026, Spring is affected by vulnerabilities in the following products: Spring Tools for Eclipse Prior to or equal to 5.2.0 Spring Tools for VSCode / Cursor / Theia Prior to or equal to 2.2.0 The Cyber Centre encourages us…
It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the…
Serial number: AV26-758 Date: July 30, 2026 As of July 29, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.0.5 Prior to 19.1.3 Prior to 19.2.1 The Cyber Centre encourages users and administrators to review the provided web links and apply …
Serial number: AV26-757 Date: July 29, 2026 As of July 29, 2026, Cisco is affected by a vulnerability in the following product: Cisco Secure Firewall Management Center (FMC) Prior to 7.0.9.1 Prior to 7.2.11.1 Prior to 7.4.7.1 Prior to 7.6.5.1 Prior to 7.7.12.1 Prior to 10.0.1.1 C…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of service, or potentially execute arbitrary code. The following versions of o6 Automation open62541 are affected: open62541 on Windows and…
View CSAF Summary Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller. The following versions of Watchfire Controller Software are affected: BC550 12.30 (CVE-2…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all associated traffic. The following versions…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate connected networks and resources. The following versions of Toptech Systems RCU II+ and Multiload II+ are affected: RCU II+ <2…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting attacks, or inject arbitrary HTML content. The following versions of Johnson Controls OpenBlue Employee are affected: OpenBlue…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected: Core Flight System (cFS) Health & Safety (HS) App…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module are affected: ControlLogix 5580 >=V…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device. The following versions of MZ Automation GmbH libiec61850 are affected: libiec61850 <1.6.2 (CVE-2026-66720, CVE-2026-66369, CVE-2026-635…
CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and ot…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the at…
View CSAF Summary Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The IGSS product is a state-of-the-art SCADA system used for monitoring and controlling industrial processes. The IGSS Definit…
View CSAF Summary Successful exploitation of these vulnerabilities could crash the device being accessed. The following versions of MZ Automation lib60870 are affected: lib60870 2.4.0 (CVE-2026-61893, CVE-2026-63033) CVSS Vendor Equipment Vulnerabilities v3 6.5 MZ Automation GmbH…
Open source software (OSS) is embedded in nearly every modern system, from business applications to critical infrastructure. Our new Open Source Software: Security Principles and Practices guidance helps agencies securely use, evaluate, and publish open source software. It covers…
An attacker can exploit multiple vulnerabilities in Golang Go to execute arbitrary program code or bypass security measures.
A local attacker can exploit multiple vulnerabilities in Linux Kernel to cause memory corruption, disclose kernel memory, or trigger denial-of-service conditions.
A remote, anonymous attacker can exploit a vulnerability in Red Hat OpenShift Container Platform to bypass security measures.
An attacker can exploit multiple vulnerabilities in Golang Go to conduct a denial of service attack, execute arbitrary code, bypass security measures, manipulate data, or disclose confidential information.
A remote, authenticated attacker can exploit a vulnerability in the Red Hat OpenShift Container Platform to conduct a denial of service attack.
A remote attacker can exploit multiple vulnerabilities in the Linux Kernel to conduct a denial of service attack and achieve unspecified effects.
A remote, anonymous attacker can exploit multiple vulnerabilities in GNU libc to manipulate files, cause a denial-of-service condition, or carry out other unspecified attacks.
A remote, authenticated attacker can exploit a vulnerability in Red Hat OpenShift Container Platform to bypass security measures.
An attacker can exploit multiple vulnerabilities in OpenSSL to conduct a denial of service attack, disclose sensitive information, or perform other unspecified attacks.
A remote, anonymous or authenticated attacker can exploit multiple vulnerabilities in Internet Systems Consortium BIND to conduct a denial of service attack or bypass security measures.
A remote, anonymous attacker can exploit a vulnerability in the KDE "Konsole" application to execute arbitrary program code.
An attacker can exploit multiple vulnerabilities in GitLab to bypass security measures, conduct cross-site scripting attacks, manipulate data, disclose confidential information, or trigger a denial-of-service condition.
A local attacker can exploit multiple vulnerabilities in the Linux Kernel to conduct a denial of service attack.
An attacker can exploit multiple vulnerabilities in NGINX and NGINX Plus to manipulate data, execute arbitrary code, disclose confidential information, or trigger a denial-of-service condition.
An attacker can exploit multiple vulnerabilities in Check Point SmartConsole to gain elevated privileges, including administrator access, or execute arbitrary code – even with root rights.
An attacker can exploit multiple vulnerabilities in FreeBSD Project FreeBSD OS to escalate privileges, manipulate data, or disclose confidential information.
An attacker can exploit multiple vulnerabilities in NGINX NGINX Plus to execute arbitrary code, carry out a Denial of Service attack, manipulate data, and disclose information.
An attacker can exploit multiple vulnerabilities in Drupal (Token Content Access, Disable Login Page and Powerful Surveys) to bypass security measures and cause unspecified impacts.
An attacker can exploit multiple vulnerabilities in Flowise to execute arbitrary code – even with root privileges – gain elevated privileges, bypass security measures, hijack sessions, and disclose or manipulate data.
A remote, anonymous attacker can exploit a vulnerability in drawio to conduct a cross-site scripting attack.
A remote, anonymous attacker can exploit a vulnerability in nmap to conduct a denial of service attack.
A remote, anonymous attacker can exploit multiple vulnerabilities in Autodesk AutoCAD to execute arbitrary program code with the service's rights, disclose information, or cause a denial of service.
A remote, anonymous attacker can exploit multiple vulnerabilities in SQLite to execute arbitrary program code, disclose information, or cause a denial of service.
An attacker can exploit multiple vulnerabilities in Google Chrome to execute arbitrary code, disclose confidential information, bypass security measures, manipulate data, or trigger a denial-of-service condition.
A remote, authenticated attacker can exploit a vulnerability in Red Hat Quay to disclose information that can be used to impersonate certain accounts.
An attacker can exploit a vulnerability in Red Hat OpenStack Neutron to manipulate data and bypass security measures.
A remote, anonymous attacker can exploit a vulnerability in libtasn1 to carry out a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in Apache log4j to disclose information.
A remote, anonymous attacker can exploit a vulnerability in libxml2 to conduct a Denial of Service attack.
A remote, authenticated attacker can exploit a vulnerability in OpenSSH to bypass security measures.
A remote, anonymous attacker can exploit multiple vulnerabilities in the SCP component of several products to disclose and manipulate data.