Fortinet confirmed a zero-day in FortiMail (CVE-2026-104286) that allows unauthenticated attackers with network access to the management interface to write arbitrary files, which in-the-wild activity …
A research report published Thursday details four weeks of active exploitation of JFrog Artifactory, in which attackers chain two patched CVEs to escalate a single unauthenticated request into an admi…
Microsoft's September 2026 Patch Tuesday cycle included 964 total CVEs, the largest volume recorded to date, and three high-severity vulnerabilities in the Azure identity stack, all fixed through serv…
The average time from vulnerability disclosure to first attack has dropped from 63 days in 2018 to minus seven days, meaning attackers now exploit holes about a week before vendors ship patches, accor…
JFrog's security team exposed a wave of fabricated SQLite vulnerability advisories, including a fake CVE-2026-51302 that was initially rated 10.0 critical, which had flowed through NVD, CISA, and Red …
Annual CVE disclosures are projected to pass 60,000 in 2026, and AI has made finding vulnerabilities cheap, but the NVD has stopped scoring most CVEs, making remediation the bottleneck. The convention…
A critical nginx vulnerability, CVE-2026-42945, with a CVSS score of 9.2, was discovered by an AI agent in six hours, affecting nearly all nginx versions since 2008. The bug, a heap overflow in the UR…
A newly disclosed vulnerability, CVE-2026-70477, affects Flowise's CSV Agent node, allowing prompt injection via malicious CSV files to hijack chatflows. The fix requires upgrading to Flowise 3.1.3, b…
JFrog reported that six SQLite CVEs published by a new GitHub repository were fake, likely AI-generated, with CVSS scores ranging from 9.8 to 7.5, and none described a reproducible vulnerability. The …
JFrog security researchers found that a batch of SQLite vulnerability advisories published by GitHub user programmervuln in the repo cveadvisory- are AI-generated 'LLM slop' and do not describe real v…
UBEL, a free software composition analysis tool and install-blocking firewall, enforces security policies at install-time to block supply-chain attacks across dependencies, Linux packages, Docker, and…
Aikido Intel, a real-time supply chain intelligence feed from Aikido, detected 19,500 malicious packages out of 7.5 million analyzed in Q2 2026, identifying most within 8 minutes of release. The feed …
Researchers have developed a CVE-TTP Knowledge Graph linking software vulnerabilities to attacker behaviors using the MITRE ATT&CK framework. Transformer-based models like CySecBERT achieved high F1-s…
An anonymous GitHub user known as bikini published Exploitarium, a public archive of 23 vulnerability proof-of-concept repositories, some produced with an AI-automated fuzzing workflow. The archive in…
The National Institute of Standards and Technology (NIST) announced on April 15, 2026, that the National Vulnerability Database (NVD) will adopt a risk-based triage model, abandoning universal enrichm…
A security team used an AI agent to build a CVE scanner that queries NVD, GitHub Advisory DB, and CISA KEV, classifies vulnerabilities by type, and scores actionability. The agent was removed from the…
An autonomous AI system built for penetration testing that overcomes human limitations by combining tool selection, memory of past attacks, real-time vulnerability database queries, mathematical model…