Threat research
What is being exploited, and what to do about it
Advisories on specific vulnerabilities and briefings on attacker techniques, each with clear actions your team can take today.
Live from official sources
Actively exploited (CISA Known Exploited list)
- Not yet scored CVE-2026-118527 · IvantiIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- Not yet scored CVE-2026-111357 · IvantiIvanti Connect Secure Missing Authentication for Critical Function Vulnerability
- Not yet scored CVE-2026-76418 · CiscoCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Not yet scored CVE-2026-97229 · GitLabGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Not yet scored CVE-2026-41709 · BroadcomBroadcom VMWare ESX Insufficient Logging Vulnerability
- Not yet scored CVE-2026-46300 · LinuxLinux Kernel Missing Initialization of a Variable Vulnerability
Latest critical CVEs (NVD)
- Critical CVE-2026-62048Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /…
- Critical CVE-2026-120338Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a…
- Critical CVE-2026-120308A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host…
- Critical CVE-2026-120307The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the…
- Critical CVE-2026-120306Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on…
- Critical CVE-2026-120198A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the…
- Informational Adversary-in-the-middle phishing: why basic MFA is not enoughReverse-proxy phishing kits can capture a session after the user completes MFA. Phishing-resistant sign-in and session controls close the gap. Threat briefing · 1 Nov 2026
- Informational Internet-facing edge devices: a favourite way inVPN gateways, firewalls and remote-access appliances sit on the boundary and are frequently targeted. Inventory, patch speed and monitoring decide th… Threat briefing · 27 Oct 2026
- Informational Ransomware precursor signals worth alerting onRansomware rarely starts with encryption. These earlier behaviours give defenders hours or days to intervene if someone is watching. Threat briefing · 22 Oct 2026