Risk Management
The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches.
Vulnerabilities
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files.
Vulnerabilities
The vulnerabilities could allow attackers to log in with random usernames and passwords or impersonate any FortiGate appliance.
Vulnerabilities
Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code.
Vulnerabilities
The security defect allows unauthenticated attackers to execute arbitrary code remotely via malicious HTTP requests.
Government
CISA updated 59 KEV entries in 2025 to specify that the vulnerabilities have been exploited in ransomware attacks.
Application Security
VS Code-integrated configuration files are automatically executed in Codespaces when the user opens a repository or pull request.
Vulnerabilities
The vulnerability could allow attackers to execute arbitrary commands and steal credentials and other secrets.
Vulnerabilities
The security defects can lead to DoS conditions, arbitrary command execution, and privilege escalation.
Cloud Security
The flaws dubbed LookOut can be exploited for remote code execution and data exfiltration.
Artificial Intelligence
The critical vulnerability exists in the contextual trust in MCP Gateway architecture, as instructions are passed without validation.
Vulnerabilities
Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week.
Vulnerabilities
The critical-severity SolarWinds Web Help Desk flaw could lead to unauthenticated remote code execution.
Artificial Intelligence
Wiz and Permiso have analyzed the AI agent social network and found serious security issues and threats.
Malware & Threats
Albeit mainly considered a theoretical risk, the flaw has been exploited to disable protections and deliver malware.
Malware & Threats
The attacks targeting Europe were analyzed by Ukraine’s CERT-UA and the cybersecurity company Zscaler.
Vulnerabilities
The critical-severity vulnerabilities could allow unauthenticated attackers to execute arbitrary code remotely.
Vulnerabilities
The two bugs impacted n8n’s sandbox mechanism and could be exploited via weaknesses in the AST sanitization logic.
Vulnerabilities
The four critical flaws could be exploited without authentication for remote code execution or authentication bypass.
Malware & Threats
Russian and Chinese state-sponsored threat actors have been exploiting CVE-2025-8088 since July 2025.
Vulnerabilities
Tracked as CVE-2026-24858, the bug allows attackers to log into devices registered to other FortiCloud accounts.
Data Protection
A total of 12 vulnerabilities have been fixed in OpenSSL, all discovered by a single cybersecurity firm.
Vulnerabilities
The flaws allow threat actors to obtain root privileges or bypass authentication via Telnet and gain shell access as root.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)