other
U.S. federal agency under DHS that protects critical infrastructure and government networks from cyber and physical threats, issuing advisories and guidance.
No evidence-backed relationships are recorded.
Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.
Reality
CISA says an integer underflow in MikroTik RouterOS web management gives an unauthenticated attacker root with one crafted request on versions below 7.24. No exploitation has been reported, but MikroTik's fix advice sets a 7.23 floor that CISA's own affected range still covers.
Perspective Coverage
3 publishersReality
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
Perspective Coverage
12 publishersReality
CISA added Citrix NetScaler flaw CVE-2026-88779 to its exploited-vulnerabilities catalog on 4 October, citing evidence of active exploitation. For anyone running the appliance, confirmed use by attackers puts this fix ahead of work ranked by severity score alone.
Reality
Cisco confirmed on September 9 that attackers are exploiting a CVSS 10.0 bypass in its Firewall Management Center to run code as root. CISA added it to its Known Exploited Vulnerabilities list the same day, with a three-day deadline for federal agencies.
Reality
The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishersReality
DIVD says an attacker chained two unpublished Zammad bugs from an unauthenticated web session to root on its helpdesk host. Its claim that an autonomous AI agent did it is still a first-party assessment with no independent confirmation yet.
Reality
Microsoft says Star Blizzard has sent fake event invitations to more than 100 organizations since January, many from hacked WordPress and cPanel sites. The group, long known for stealing email passwords, now uses the messages to install a Windows backdoor.
Perspective Coverage
8 publishersReality
Microsoft says attackers are using CVE-2026-73570 to run commands on Zimbra mail servers with one crafted email and no login. Zimbra shipped the fix in 10.1.20 on July 20, 24 days before disclosure, so anyone who waited for the advisory to patch was already late.
Perspective Coverage
4 publishersReality
Cisco confirmed attackers are exploiting CVE-2026-76460, a CVSS 10.0 flaw giving unauthenticated root on Identity Services Engine. ISE decides which devices join the network, so a rooted node hands over every access decision and the device credentials it stores.
Reality
Warlock, the group Microsoft tracks as Storm-2603, hit four organizations in Spanish- or Portuguese-speaking countries in two months, Symantec says. It works like the Chinese state groups it first appeared beside and extorts like a ransomware crew.
Perspective Coverage
6 publishersReality
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
Two exploited Citrix NetScaler zero-days and a CVSS 9.8 Cisco SD-WAN Manager flaw top a weekly DACH OT risk bulletin. For many operators, both products enforce segmentation into OT, so an attacker who takes one over is standing in front of the control systems.
Reality
NLnet Labs' Unbound 1.26.1 fixes CVE-2026-81642, a DNSSEC heap overflow its vendor says could allow remote code execution. A related CoreDNS flaw in its newer transport listeners gives resolver operators a second check, this one in their configuration.
Reality
Attackers chained two self-hosted JFrog Artifactory flaws, both patched more than a month before exploitation, to take admin and install backdoor plugins. Either fix breaks the chain, yet on the published tables only release 7.133.28 closes both.
Reality
NVD logged CVEs for four MCP servers in about 35 hours, each because every tool it exposes needs no authentication. A fifth MCP flaw, LiteLLM's authentication bypass, is already on CISA's exploited-vulnerabilities list.
Reality
vm2's maintainer patched a CVSS 9.5 flaw in 3.12.2 where the module allowlist matched an approved path as a bare prefix and cleared a neighboring package. With NodeVM's default host context, the unapproved sibling ran with full Node authority.
Reality
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
7 publishersReality
GitLab patched CVE-2026-90970, a sandbox escape that lets any authenticated Duo Agent Platform user run arbitrary commands on a self-hosted AI Gateway. Customers on GitLab's hosted gateway are already protected, so the upgrade falls to Self-Managed shops that run their own.
Perspective Coverage
4 publishersReality
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishersReality
Security · October 2, 2026 · 3 publishers
Build · October 2, 2026 · 1 publisher
Security · October 1, 2026 · 8 publishers
Build · October 2, 2026 · 1 publisher
Build · October 1, 2026 · 1 publisher
Security · October 1, 2026 · 1 publisher
Security · October 1, 2026 · 1 publisher
Security · October 1, 2026 · 1 publisher
Security · October 1, 2026 · 1 publisher
Security · October 1, 2026 · 1 publisher
Security · September 30, 2026 · 9 publishers
Build · October 1, 2026 · 1 publisher
Build · October 1, 2026 · 1 publisher
Leadership · October 1, 2026 · 1 publisher
Security · September 30, 2026 · 4 publishers
Security · September 30, 2026 · 4 publishers
Security · September 30, 2026 · 21 publishers
Build · September 30, 2026 · 2 publishers
Build · September 30, 2026 · 1 publisher
Security · September 30, 2026 · 1 publisher
Build · September 29, 2026 · 1 publisher
Build · September 29, 2026 · 1 publisher
Security · September 29, 2026 · 1 publisher
Security · September 29, 2026 · 1 publisher
Security · September 29, 2026 · 1 publisher
Security · September 29, 2026 · 1 publisher
Security · September 29, 2026 · 1 publisher
Leadership · September 29, 2026 · 2 publishers
Invest · September 28, 2026 · 2 publishers
Security · September 28, 2026 · 1 publisher
Product · September 28, 2026 · 2 publishers
Build · September 28, 2026 · 3 publishers
Security · September 25, 2026 · 4 publishers
Security · September 27, 2026 · 3 publishers
Security · September 25, 2026 · 4 publishers
Security · September 27, 2026 · 5 publishers
Invest · September 27, 2026 · 3 publishers
Build · September 27, 2026 · 1 publisher
Build · September 26, 2026 · 1 publisher
Build · September 26, 2026 · 1 publisher