Breaking
Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Hackers Hide Credit Card Stealer in Pixel-Sized SVG Images Targeting Magento Stores Microsoft Suspends Developer Accounts for High-Profile Open Source Projects European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Ransomware Attacks Surge in 2026: Healthcare and Finance Most Targeted Google Chrome Zero-Day Vulnerability Actively Exploited – Update Immediately Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Hackers Hide Credit Card Stealer in Pixel-Sized SVG Images Targeting Magento Stores Microsoft Suspends Developer Accounts for High-Profile Open Source Projects European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Ransomware Attacks Surge in 2026: Healthcare and Finance Most Targeted Google Chrome Zero-Day Vulnerability Actively Exploited – Update Immediately
Latest Threat Intel Zero-Days Data Breaches Analysis
Live threat feed August 18, 2026 | 01:22 UTC
6421 CVEs This Month
10 Actively Exploited
0 Ransomware Activity
34 Breaches YTD
Threat Investigation Portal
Investigate an IOC in the live graph workspace.
Investigate IOC
Researchers Uncover Malware Attacks Exploiting Google Password Manager Synced Passkeys
Vulnerabilities | Exclusive
Researchers Uncover Malware Attacks Exploiting Google Password Manager Synced...
Thirumala Rao Padilam Thirumala Rao Padilam August 4, 2026
Midnight Blizzard Targets Hotel Wi-Fi to Breach Microsoft 365 Accounts
Threat Intelligence
Midnight Blizzard Targets Hotel Wi-Fi to Breach Microsoft...
Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users in Targeted Supply Chain Attack
Supply Chain Incidents
Malicious npm Packages Deliver Cross-Platform RAT to Alibaba...
Latest Threats
View all ->
Vulnerability Watch

Top 10 CVEs This Week

Prioritized using CISA KEV, EPSS, CVSS, and recency.

Full watchlist ->
CVE-2026-19977 CVSS 10 EPSS 0.0071

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Critical severity issue in affected software published this week.

CVE-2026-74843 CVSS 10 EPSS 0

A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Critical severity issue in affected software published this week.

CVE-2026-74872 CVSS 9.8 EPSS 0

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

Critical severity issue in affected software published this week.

CVE-2026-74875 CVSS 9.8 EPSS 0

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

Critical severity issue in affected software published this week.

CVE-2026-74876 CVSS 9.8 EPSS 0

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

Critical severity issue in affected software published this week.

Vulnerability Watch
All Stories ->
error: Content is protected !!