Active vulnerabilities, advisories, and threat intelligence — filtered for IT practitioners.
CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935 , affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cybe...
CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771 , CVE-2026-88772 , CVE-2026-88773 , CVE-2026-88774 , CVE-2026-88...
A sandbox escape in Google Chrome was exploited as a zero-day in a targeted espionage campaign against media organizations, educational institutions, and government entities in Russia.
The widely-used tj-actions/changed-files GitHub Action was compromised in a supply chain attack, executing malicious code that printed CI/CD secrets to workflow logs in hundreds of repositories.
A Windows Management Console security feature bypass was exploited by the Russian-linked Water Gamayun group to execute malicious .msc files, bypassing Windows file reputation and MotW protections.
