Breaking
Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Hackers Hide Credit Card Stealer in Pixel-Sized SVG Images Targeting Magento Stores Microsoft Suspends Developer Accounts for High-Profile Open Source Projects European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Ransomware Attacks Surge in 2026: Healthcare and Finance Most Targeted Google Chrome Zero-Day Vulnerability Actively Exploited – Update Immediately Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Hackers Hide Credit Card Stealer in Pixel-Sized SVG Images Targeting Magento Stores Microsoft Suspends Developer Accounts for High-Profile Open Source Projects European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack Ransomware Attacks Surge in 2026: Healthcare and Finance Most Targeted Google Chrome Zero-Day Vulnerability Actively Exploited – Update Immediately
Latest Threat Intel Zero-Days Data Breaches Analysis
Live threat feed July 29, 2026 | 07:33 UTC
8771 CVEs This Month
25 Actively Exploited
0 Ransomware Activity
30 Breaches YTD
Threat Investigation Portal
Investigate an IOC in the live graph workspace.
Investigate IOC
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
Cybersecurity News | Exclusive
Seven Malicious Vite npm Packages Use Blockchain C2 to...
Thirumala Rao Padilam Thirumala Rao Padilam July 18, 2026
OpenSSL HollowByte Flaw Can Exhaust Server Memory With Minimal TLS Request
Vulnerabilities
OpenSSL HollowByte Flaw Can Exhaust Server Memory With...
New wp2shell WordPress Core Flaw Allows Unauthenticated Code Execution
Vulnerabilities
New wp2shell WordPress Core Flaw Allows Unauthenticated Code...
Latest Threats
View all ->
Vulnerability Watch

Top 10 CVEs This Week

Prioritized using CISA KEV, EPSS, CVSS, and recency.

Full watchlist ->
CVE-2026-16812 KEV CVSS 10 EPSS 0.0098

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

Known exploited vulnerability affecting Arista VeloCloud Orchestrator with active defender relevance.

CVE-2026-17191 CVSS 9.1 EPSS 0.0283

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Critical severity issue in affected software published this week.

CVE-2026-48030 CVSS 9.9 EPSS 0.0155

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.

Critical severity issue in affected software published this week.

CVE-2026-61511 CVSS 9.8 EPSS 0.0127

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

Critical severity issue in affected software published this week.

CVE-2026-17192 CVSS 8.5 EPSS 0.0234

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Newly published issue in affected software with notable risk signals for defenders.

Vulnerability Watch
All Stories ->
error: Content is protected !!