214Articles
8Categories
2026-04-23Date
🚨
U.S. CISA adds a flaw in Microsoft Defender to its Known Exploited Vulnerabilities catalogThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Microsoft Defender to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in Microsoft Defender, tracked as CVE-2026-33825 (CVSS s…
KEV
πŸ›
CVE-2026-27820 zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
πŸ›
CVE-2026-5928 Static buffer overflow in deprecated nis_local_principal
πŸ›
CVE-2026-35239
πŸ›
CVE-2026-34271
πŸ›
CVE-2026-35238
πŸ›
CVE-2026-34267
πŸ›
CVE-2026-22005
πŸ›
CVE-2026-22015
πŸ›
CVE-2026-31452 ext4: convert inline data to extents when truncate exceeds inline size
πŸ›
CVE-2026-31455 xfs: stop reclaim before pushing AIL during unmount
πŸ›
CVE-2026-31476 ksmbd: do not expire session on binding failure
πŸ›
CVE-2026-31474 can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
πŸ›
CVE-2026-31464 scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
πŸ›
CVE-2026-31461 drm/amd/display: Fix drm_edid leak in amdgpu_dm
πŸ›
CVE-2026-31441 dmaengine: idxd: Fix memory leak when a wq is reset
πŸ›
CVE-2026-31454 xfs: save ailp before dropping the AIL lock in push callbacks
πŸ›
CVE-2026-31432 ksmbd: fix OOB write in QUERY_INFO for compound requests
πŸ›
CVE-2026-31502 team: fix header_ops type confusion with non-Ethernet ports
πŸ›
CVE-2026-31495 netfilter: ctnetlink: use netlink policy range checks
πŸ›
CVE-2026-31448 ext4: avoid infinite loops caused by residual data
πŸ›
CVE-2026-31439 dmaengine: xilinx: xdma: Fix regmap init error handling
πŸ›
CVE-2026-31477 ksmbd: fix memory leaks and NULL deref in smb2_lock()
πŸ›
CVE-2026-31530 cxl/port: Fix use after free of parent_port in cxl_detach_ep()
πŸ›
CVE-2026-31480 tracing: Fix potential deadlock in cpu hotplug with osnoise
πŸ›
CVE-2026-31512 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
πŸ›
CVE-2026-31450 ext4: publish jinode after initialization
πŸ›
CVE-2026-31493 RDMA/efa: Fix use of completion ctx after free
πŸ›
CVE-2026-31521 module: Fix kernel panic when a symbol st_shndx is out of bounds
πŸ›
CVE-2026-41445 KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()
πŸ›
CVE-2026-5358 Static buffer overflow in deprecated nis_local_principal
πŸ›
CVE-2026-34278
πŸ›
CVE-2026-21998
πŸ›
CVE-2026-35237
πŸ›
CVE-2026-22009
πŸ›
CVE-2026-34270
πŸ›
CVE-2026-34293
πŸ›
CVE-2026-22002
πŸ›
CVE-2026-22017
πŸ›
CVE-2026-34303
πŸ›
CVE-2026-34308
πŸ›
CVE-2026-34304
πŸ›
CVE-2026-34276
πŸ›
CVE-2026-22004
πŸ›
CVE-2026-22001
πŸ›
CVE-2026-35240
πŸ›
CVE-2026-35236
πŸ›
CVE-2026-40706
πŸ›
CVE-2026-3219 pip doesn't reject concatenated ZIP and tar archives
πŸ›
CVE-2026-40890 github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer
πŸ›
CVE-2026-31524 HID: asus: avoid memory leak in asus_report_fixup()
πŸ›
CVE-2026-31486 hwmon: (pmbus/core) Protect regulator operations with mutex
πŸ›
CVE-2026-31487 spi: use generic driver_override infrastructure
πŸ›
CVE-2026-31496 netfilter: nf_conntrack_expect: skip expectations in other netns via proc
πŸ›
CVE-2026-31515 af_key: validate families in pfkey_send_migrate()
πŸ›
CVE-2026-31516 xfrm: prevent policy_hthresh.work from racing with netns teardown
πŸ›
CVE-2026-31488 drm/amd/display: Do not skip unrelated mode changes in DSC validation
πŸ›
CVE-2026-31527 driver core: platform: use generic driver_override infrastructure
πŸ›
CVE-2026-31506 net: bcmasp: fix double free of WoL irq
πŸ›
CVE-2026-31458 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
πŸ›
CVE-2026-31504 net: fix fanout UAF in packet_release() via NETDEV_UP race
πŸ›
CVE-2026-31462 drm/amdgpu: prevent immediate PASID reuse case
πŸ›
CVE-2026-31523 nvme-pci: ensure we're polling a polled queue
πŸ›
CVE-2026-31497 Bluetooth: btusb: clamp SCO altsetting table indices
πŸ›
CVE-2026-31440 dmaengine: idxd: Fix leaking event log memory
πŸ›
CVE-2026-31505 iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
πŸ›
CVE-2026-31431 crypto: algif_aead - Revert to operating out-of-place
πŸ›
CVE-2026-31489 spi: meson-spicc: Fix double-put in remove path
πŸ›
CVE-2026-31469 virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
πŸ›
CVE-2026-31510 Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
πŸ›
CVE-2026-31449 ext4: validate p_idx bounds in ext4_ext_correct_indexes
πŸ›
CVE-2026-31482 s390/entry: Scrub r12 register on kernel entry
πŸ›
CVE-2026-31518 esp: fix skb leak with espintcp and async crypto
πŸ›
CVE-2026-31446 ext4: fix use-after-free in update_super_work when racing with umount
πŸ›
CVE-2026-31520 HID: apple: avoid memory leak in apple_report_fixup()
πŸ›
CVE-2026-31519 btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
πŸ›
CVE-2026-31433 ksmbd: fix potencial OOB in get_file_all_info() for compound requests
πŸ›
CVE-2026-31485 spi: spi-fsl-lpspi: fix teardown order issue (UAF)
πŸ›
CVE-2026-31483 s390/syscalls: Add spectre boundary for syscall dispatch table
πŸ›
CVE-2026-31507 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
πŸ›
CVE-2026-31500 Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
πŸ›
CVE-2026-31447 ext4: reject mount if bigalloc with s_first_data_block != 0
πŸ›
CVE-2026-31444 ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
πŸ›
CVE-2026-31522 HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
πŸ›
CVE-2026-31478 ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
πŸ›
CVE-2026-31509 nfc: nci: fix circular locking dependency in nci_close_device
πŸ›
CVE-2026-31451 ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
πŸ›
CVE-2026-31528 perf: Make sure to use pmu_ctx->pmu for groups
πŸ›
CVE-2026-31503 udp: Fix wildcard bind conflict check when using hash2
πŸ›
CVE-2026-31498 Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
πŸ›
CVE-2026-31453 xfs: avoid dereferencing log items after push callbacks
πŸ›
CVE-2026-31525 bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
πŸ›
CVE-2026-31467 erofs: add GFP_NOIO in the bio completion if needed
πŸ›
CVE-2026-31492 RDMA/irdma: Initialize free_qp completion before using it
πŸ›
CVE-2026-31494 net: macb: use the current queue number for stats
πŸ›
CVE-2026-31473 media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
πŸ›
CVE-2026-6507 Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing
πŸ›
CVE-2026-28808 ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
πŸ›
CVE-2026-6409 Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input
πŸ›
CVE-2026-5187 Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
πŸ›
Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case
πŸ›
Attackers Exploit LMDeploy Flaw in the Wild Within 12 Hours of Advisory
πŸ›
Apple Patches Exploited Notification Flaw, (Thu, Apr 23rd)
πŸ›
VU#748485: Unauthenticated configuration modification vulnerability in Central Office Services - Content Hosting Component
πŸ›
iOS Flaw Let Deleted Notifications Linger, Apple Issues Fix
πŸ›
UAT-4356's Targeting of Cisco Firepower Devices
⚠️
Malicious pgserve, automagik developer tools found in npm registry
⚠️
Claude Mythos signals a new era in AI-driven security, finding 271 flaws in Firefox
⚠️
Riddled with flaws, serial-to-Ethernet converters endanger critical infrastructure
⚠️
SLAM, scam, thank you ma’am.
⚠️
Apple Patches Privacy Issue Exposing Signal Message Data Through Notifications
⚠️
Claude Mythos Exposes 271 Zero-Day Security Flaws in Firefox
⚠️
Apple fixes iOS privacy flaw that allowed Signal message retrieval
⚠️
Vercel Finds More Compromised Accounts in Context.ai-Linked Breach
⚠️
Microsoft taps Anthropic’s Mythos to strengthen secure software development
⚠️
Researchers Uncover 10 In-the-Wild Prompt Injection Payloads Targeting AI Agents
⚠️
Apple fixes iOS bug that kept deleted notifications, including chat previews
⚠️
[Webinar] Mythos Reality Check: Beating Automated Exploitation at AI Speed
⚠️
Google gets agent-ready for the Mythos age
⚠️
DNN vulnerability puts 750,000 websites at risk​ | Cybernews
⚠️
Flaw in Microsoft-owned GitHub repository allowed RCE via issue submission | news | SC Media
⚠️
Trailmark turns code into graphs
⚠️
Vercel Confirms Security Breach Affecting Customer Accounts
⚠️
Offer customers passkeys by default, UK’s NCSC tells enterprises
⚠️
House Republicans unveil data privacy law that would override state protections
⚠️
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
⚠️
Vercel says some of its customers’ data was stolen prior to its recent hack
⚠️
Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite
⚠️
Sony to enforce age checks for PlayStation users in the UK starting in June
⚠️
Five steps to become Mythos ready
⚠️
Surveillance vendors exploit telecom weaknesses.
⚠️
Luxury cosmetics giant Rituals discloses data breach impacting member personal details
⚠️
Recent Microsoft Defender Vulnerability Exploited as Zero-Day - SecurityWeek
⚠️
Surveillance companies exploiting telecom system to spy on targets’ locations, research shows
⚠️
CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March
⚠️
Surveillance campaigns use commercial surveillance tools to exploit long-known telecom vulnerabilities
⚠️
Microsoft Offers First-Ever Retirement Buyouts to Thousands of Employees
⚠️
3 practical ways AI threat detection improves enterprise cyber resilience
⚠️
The curious case of Sean Plankey’s derailed CISA nomination
⚠️
Your signal is showing.
⚠️
Back to (or Start) Fundamentals? - Rajesh Khazanchi - PSW #923
⚠️
AI threats in the wild: The current state of prompt injections on the web
⚠️
Supply Chain Defense Limits
⚠️
Vercel attack fallout expands to more customers and third-party systems
⚠️
Bitwarden CLI password manager trojanized in supply chain attack
πŸ“’
NCSC Backs Passkeys, Hailing a New Era of Sign-in
πŸ“’
Defending Against China-Nexus Covert Networks of Compromised Devices | CISA
πŸ“’
Trump’s pick for CISA director withdraws from consideration
πŸ“’
China disguises cyberattacks with β€˜covert network’ botnets, US and allies warn
πŸ“’
A dozen allied agencies say China is building covert hacker networks out of everyday routers
πŸ“’
Trump’s pick to run US cyber agency CISA asks to drop out
πŸ“’
US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied
πŸ”₯
How does AI change the economics of cybercrime?
πŸ”₯
Checkmarx KICS Docker Repo Hijacked in Malicious Code Injection Attack
πŸ”₯
Breach School
πŸ”₯
Xinference PyPI Breach Exposes Developers to Cloud Credential Theft
πŸ”₯
Lazarus Lures Developers With Backdoored Coding Tests
πŸ”₯
Malicious npm Package Hijacks Hugging Face for Malware Delivery
πŸ”₯
RAMP Uncovered: Anatomy of Russia’s Ransomware Marketplace
πŸ”₯
Discord-Linked Group Accessed Anthropic’s Claude Mythos AI in Vendor Breach
πŸ”₯
Most Serious Cyberattacks Against the UK Now From Russia, Iran and China, Cyber Chief Says - SecurityWeek
πŸ”₯
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
πŸ”₯
How cyberattacks on companies affect everyone
πŸ”₯
Bitwarden CLI backdoored in Checkmarx supply chain attack
πŸ”₯
UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware
πŸ•΅οΈ
ISC Stormcast For Thursday, April 23rd, 2026 https://isc.sans.edu/podcastdetail/9904, (Thu, Apr 23rd)
πŸ•΅οΈ
Fake TradingView AI Site Spreads Needle Stealer Through Phony TradingClaw App
πŸ•΅οΈ
Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access
πŸ•΅οΈ
Fake Wallpaper App, YouTube Channel Used to Spread notnullOSX Malware
πŸ•΅οΈ
Microsoft Graph API misused by new GoGra Linux malware for hidden communication
πŸ•΅οΈ
What Is Square? Pricing, Features & How It Works
πŸ•΅οΈ
North Korean Fake IT Workers Infiltrate Firms to Dodge Sanctions
πŸ•΅οΈ
Brave brings β€œShred” to Android for one-tap tracking data deletion
πŸ•΅οΈ
China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
πŸ•΅οΈ
Outlook Mailboxes Used to Conceal Linux GoGra Backdoor Traffic
πŸ•΅οΈ
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System
πŸ•΅οΈ
FBI Extracts Deleted Signal Messages from iPhone Notification Database
πŸ•΅οΈ
GitLab Fixes Flaws That Could Allow Attackers to Hijack User Sessions
πŸ•΅οΈ
Outlook Mailboxes Abused to Conceal Linux GoGra Backdoor Traffic
πŸ•΅οΈ
Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens
πŸ•΅οΈ
FBI: Americans Lost More Than $20 billion to Fraud Last Year
πŸ•΅οΈ
Phishing reclaims the top initial access spot, attackers experiment with AI tools - Help Net Security
πŸ•΅οΈ
Microsoft releases emergency patches for critical ASP.NET flaw
πŸ•΅οΈ
Cloud Security Isn’t What You Think
πŸ•΅οΈ
Apple’s $599 Mac mini Just Sold Out Everywhere
πŸ•΅οΈ
AI-written software creates hassles for wary security teams
πŸ•΅οΈ
Google’s Pixel Update Sparks β€˜Severe’ Battery Drain Across Multiple Models
πŸ•΅οΈ
Researcher claims Claude Desktop installs β€œspyware” on macOS
πŸ•΅οΈ
Iran-nexus threat groups refine attacks against critical infrastructure
πŸ•΅οΈ
New Pentagon Plan Would Pour $54B Into Drones, AI Combat Systems
πŸ•΅οΈ
Apple Fixes iPhone Bug After FBI Retrieved Signal Messages
πŸ•΅οΈ
TikTok Invests $1.16 Billion in New Finland Facility to Localize European Data
πŸ•΅οΈ
Samsung Galaxy Connect Now Works on Any Windows 11 PC
πŸ•΅οΈ
Hackers Use Hidden Website Instructions in New Attacks on AI Assistants
πŸ•΅οΈ
India’s App Boom Has a Revenue Problem
πŸ•΅οΈ
Dragos: Despite AI use, new malware targeting water plants is β€˜hype’
πŸ•΅οΈ
Frontier AI and the Future of Defense: Your Top Questions Answered
🌐
TrendAIℒ’s AI Security Brief podcast joins the N2K CyberWire network.
🌐
China-linked hackers targeted Mongolian government using Slack, Discord for covert communications
🌐
Newly Deciphered Sabotage Malware May Have Targeted Iran’s Nuclear Programβ€”and Predates Stuxnet
πŸ“‘
Section 702 survives for now.
πŸ“‘
Roblox clamps down on chats and age checks as legal pressure builds
πŸ“‘
Cyber-Attacks Surge 63% Annually in Education Sector
πŸ“‘
Google Introduces Unique AI Agent Identities in New Gemini Enterprise Platform
πŸ“‘
Project Glasswing Proved AI Can Find the Bugs. Who's Going to Fix Them?
πŸ“‘
Surveillance vendors caught abusing access to telcos to track people’s phone locations, researchers say
πŸ“‘
Apple Fixes iOS Notification Bug Exposing Deleted Messages
πŸ“‘
Medical data of 500,000 Britons put up for sale on Chinese website
πŸ“‘
Spam and phishing targeting taxpayers | Kaspersky official blog
πŸ“‘
Google Favors General‑Purpose Gemini Models Over Cybersecurity‑Specific AI
πŸ“‘
It pays to be a forever student
πŸ“‘
India drops national ID app mandate.
πŸ“‘
US sanctions Cambodian senator for millions earned through scam compounds
πŸ“‘
fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet