CVEs that matter, exploitation status and patch guidance without the hype.
The fitness tracker company built an AI-assisted workflow to handle hundreds of thousands of daily alerts without sacrificing security oversight or developer velocity.
Arista Networks has issued security updates addressing a critical zero-day vulnerability in VeloCloud Orchestrator on-premises deployments that attackers are already exploiting in the wild.
F5 has released patches for a critical remote code execution vulnerability in BIG-IP APM that is already being exploited in the wild. The flaw affects OAuth Authorization Server configurations and has prompted CISA to add it to its Known Exploited Vulnerabilities catalog.
Researchers at Varonis Threat Labs have uncovered an attack that exploits Microsoft Entra's external MFA provider model to capture user credentials during login. The technique, which requires prior compromise of a privileged account, inserts a fake password prompt into the authentication flow.
D-Link has disclosed a maximum-severity stack-based buffer overflow in its legacy DIR-822A Wi-Fi routers that can be exploited remotely without authentication, with proof-of-concept code already public and no patch available.
Security researcher Abdelhamid Naceri has disclosed a new zero-day vulnerability in Microsoft Defender that prevents the antivirus engine from receiving updates, continuing a pattern of disclosures tied to a dispute with Microsoft.
Federal agencies must secure Zyxel GS1900 series switches against a critical buffer overflow vulnerability that threat actors are actively exploiting to steal data from hundreds of devices globally.
The U.S. Cybersecurity and Infrastructure Security Agency has warned of ongoing exploitation of three Linux kernel vulnerabilities ranging from medium to critical severity, including one that persisted undetected for 14 years.
