Amazon Threat Intelligence

Amazon Links North Korean Hackers to NPM Supply Chain Attacks North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Amazon Links North Korean Hackers to NPM Supply Chain Attacks

Do Son August 4, 2026

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise...

Exploited in the Wild: Interlock Ransomware Weaponizes Critical 10.0 CVSS Cisco Zero-Day Interlock Ransomware Cisco Zero-Day

Interlock Ransomware Cisco Zero-Day

Exploited in the Wild: Interlock Ransomware Weaponizes Critical 10.0 CVSS Cisco Zero-Day

Do Son March 19, 2026

Amazon threat intelligence has uncovered an active Interlock ransomware campaign that exploited a critical vulnerability in Cisco...

Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices Sandworm Tactical Pivot, Edge Device Misconfiguration Russian cyber firms, Kremlin ties Sandworm MAX messenger

Sandworm Tactical Pivot, Edge Device Misconfiguration Russian cyber firms, Kremlin ties Sandworm MAX messenger

Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices

Do Son December 17, 2025

A new report from Amazon Threat Intelligence reveals a disturbing evolution in Russian state-sponsored cyber operations. The...

Amazon Exposes Advanced APT Exploiting Cisco ISE (RCE) and Citrix Bleed Two as Simultaneous Zero-Days Cisco ISE Zero-Day, Citrix Bleed Two

Cisco ISE Zero-Day, Citrix Bleed Two

Amazon Exposes Advanced APT Exploiting Cisco ISE (RCE) and Citrix Bleed Two as Simultaneous Zero-Days

Do Son November 14, 2025

The Amazon Threat Intelligence team has uncovered a highly sophisticated threat campaign exploiting multiple zero-day vulnerabilities in...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-14894CVSS 9.8
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload...
Admin intel📅 Updated: Sep 4, 2026
CVE-2026-85046CVSS 8.8
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code...
Admin intelCISA KEV📅 Added to KEV: Sep 4, 2026📅 Updated: Sep 3, 2026
CVE-2026-32475CVSS 9.0
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue...
Admin intel📅 Updated: Sep 2, 2026
CVE-2026-48710CVSS 6.5
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated...
CISA KEV📅 Added to KEV: Sep 2, 2026
CVE-2026-49869CVSS 10.0
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs")...
CISA KEV📅 Added to KEV: Sep 2, 2026
CVE-2026-59822
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to...
CISA KEV📅 Added to KEV: Sep 2, 2026
CVE-2026-83549CVSS 7.8
Post-authentication Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') vulnerability has been identified...
Admin intelCISA KEV📅 Added to KEV: Sep 2, 2026📅 Updated: Sep 1, 2026
CVE-2026-83548CVSS 10.0
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access...
Admin intelCISA KEV📅 Added to KEV: Sep 2, 2026📅 Updated: Sep 1, 2026