Browse public community intelligence reports, source analysis, and threat research.
239 intel reports
A 12-year-old critical flaw in PostgreSQL's logical decoding allows low-privileged replication accounts to execute arbitrary code and achieve full superuser persistence.
An unauthenticated attacker can achieve root Remote Code Execution on SonicWall GMS by chaining multiple patch bypasses for legacy vulnerabilities.
An unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin (CVE-2026-19949) enables remote code execution through malicious WordPress trackbacks and archive restoration.
A suspected Chinese-speaking threat actor exploited vulnerabilities in ownCloud and WordPress to exfiltrate nuclear research records and naval contractor data in the Philippines.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
Unauthenticated attackers are chaining signature algorithm confusion and OpenSSL error handling vulnerabilities to bypass authentication and gain administrator access on WordPress sites using the miniOrange SAML SSO plugin.
Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.
Keycloak has patched two critical vulnerabilities, including a password reset bypass (CVE-2026-18963) and a PII leak (CVE-2026-17059) affecting administrative endpoints.
