Early warnings
Breaches, ransomware, malicious packages and vulnerabilities that newsrooms, vendors or regulators reported before a CVE existed, or without one. When a CVE came later, its row says which and how much earlier cve.now reported it.
- SZB-da10af64ceRailway says hackers stole customer auth secrets and ran $740,000 in fraudulent AI usageRailway cloud platform
- SZB-65bc1bddc8NEAR AI reports SGLang RCE let attacker run code on an inference serverNEAR AI · Cloud inference services
- SZB-a9c61ebfa0Microsoft patches record 1,235 flaws, including exploited Outlook zero-dayMicrosoft · Outlook
- SZB-8a90d04873Adobe patches 110 vulnerabilities across 9 productsAdobe · AEM, Premiere, Photoshop, After Effects, Connect, Audition, Dimension, Content C
- SZB-f71a910c08BleepingComputer reports critical Xen Orchestra auth bypass exploited in attacksXen Orchestra
- SZB-db01d072adAttackers exploit AhsayCBS flaws to deploy sandbox-evading Python backdoorAhsay · AhsayCBS
- SZB-fdab5e09d5Apple patches iMessage flaws that expose group chat messagesApple · iMessage
- SZB-40f3a46406Barracuda warns attackers are exploiting two patched ESG root-access flawsBarracuda · Email Security Gateway
- SZB-ea98c8be72SAP patches four CVSS 10.0 flaws in NetWeaver and Web DispatcherSAP Web Dispatcher and Internet Communication Manager
- SZB-c3df970f8eFireworks AI discloses breach of development machines after cloud provider hackFireworks AI
- SZB-4703b2a7b4CISA adds four flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex to KEVMultiple vendors (GPUStack, SignalWire, OpenBSD, IBM) · Aspera Faspex
- SZB-476799c76cGoogle patches Chrome XML zero-day reported as exploited in attacksGoogle · Chrome
- SZB-197290786fN-able takes N-central offline after researcher discloses 30+ alleged zero-daysN-able · N-central
- SZB-e0d31900bdWiz says attacker breached multiple Qubole customers' AWS accountsQubole · AWS IAM
- SZB-5ab74d9eedEthersphere's bee-js and Swarm Desktop releases reported to carry wallet-stealing malwarenpm · @ethersphere/bee-js
- SZB-ea46f00bd9Web3Auth flaw exploited to drain Keplr wallets, companies sayWeb3Auth · Keplr wallet Google and Apple sign-in
- SZB-db26c70b7fResearchers find hundreds of public Artex AI pentest tool instances exposed onlineArtex
- SZB-659381b7e7CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalogSonicWall · GMS 9.5.2
- SZB-b323ce2f22OpenAI says its GPT-6 Cyber model found 81 unknown Firefox flawsMozilla · Firefox
- SZB-25aea6b559QNAP says hackers are exploiting Plex2Shell vulnerability chain on NAS devicesQNAP · Plex Media Server
- SZB-0f0221e743Microsoft Paint RCE flaw CVE-2026-83844 fixed via Store update, not Windows UpdateMicrosoft · Windows Paint
- SZB-fe91205eadPhishing campaign reportedly steals Microsoft and Google account credentialsMicrosoft · SharePoint
- SZB-238e596fa7mSeven Software warns mSecure users after cyberattack reportedly exposed customer databasemSeven Software · mSecure Cloud
- SZB-f2f032fedbOpenSSH flaw reportedly allows login to password-disabled musl-based Linux accountsOpenSSH · sshd
- SZB-97fd8de188Trojanized CWP web server reportedly spreads CWPdoor Linux backdoorControl Web Panel · cwpsrv
- SZB-58fbd93471DigiCert warns of breach exposing customer data and identity documentsDigiCert
- SZB-e57f3ab75fCISA warns attackers are exploiting a patched high-severity WordPress flawWordPress Core
- SZB-fefdc7390eAnthropic declines to fix Claude Dispatch flaw enabling remote command executionAnthropic · Claude Desktop and Claude Dispatch
- SZB-9fb3d806b5CERT-In flags backdoored ARTEX exposing 62 consoles to root accessARTEX Docker images
- SZB-646da66be3CISA adds Apple authentication flaw CVE-2024-27834 to KEV catalogApple · iOS, iPadOS, macOS, Safari, tvOS and watchOS