Critical Alert 1 Active Exploit Detected Today

CVE-2026-7273 — Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability →

Powered by CVE Watchtower

×

Exchange Online

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails

Do Son September 9, 2026

At a glance Field Details Actor or Group Unidentified phishing actors and cybercrime groups Activity Type Email...

Exchange Online to Throttle and Block Outdated Exchange 2016 and 2019 Servers Exchange Online blocking outdated Exchange Server 2016 and 2019 in hybrid mail flow

Exchange Online blocking outdated Exchange Server 2016 and 2019 in hybrid mail flow

Exchange Online to Throttle and Block Outdated Exchange 2016 and 2019 Servers

Do Son September 7, 2026

Microsoft is beginning to sever outdated on-premises Exchange servers from cloud mail more sternly. From the second...

CVE-2025-53786: Microsoft Exchange Hybrid Deployments Expose Cloud Privilege Escalation Risk CVE-2025-53786) Exchange Hybrid Vulnerability, Privilege Escalation

CVE-2025-53786) Exchange Hybrid Vulnerability, Privilege Escalation

CVE-2025-53786: Microsoft Exchange Hybrid Deployments Expose Cloud Privilege Escalation Risk

Do Son August 7, 2025

Yesterday, Microsoft issued a critical security advisory addressing a newly identified vulnerability—CVE-2025-53786—in hybrid Microsoft Exchange environments. The...

Hijacking the Cloud: How a Misconfigured App Can Become a Global Admin in Entra ID Entra ID Impersonation, Privilege Escalation

Entra ID Impersonation, Privilege Escalation

Hijacking the Cloud: How a Misconfigured App Can Become a Global Admin in Entra ID

Do Son July 18, 2025

In a comprehensive and technically expose, Datadog Security Labs has unveiled a privilege escalation method that allows...

Microsoft 365 “Direct Send” Abused: Phishing Campaign Spoofs Internal Users, Bypasses Security phish

phish

Microsoft 365 “Direct Send” Abused: Phishing Campaign Spoofs Internal Users, Bypasses Security

Do Son June 28, 2025

Varonis’ Managed Data Detection and Response (MDDR) Forensics team has uncovered a stealthy and widespread phishing campaign...

Microsoft Boosts Email Security with General Availability of Inbound SMTP DANE with DNSSEC Gmail Scam

Gmail Scam

Microsoft Boosts Email Security with General Availability of Inbound SMTP DANE with DNSSEC

Do Son October 30, 2024

Microsoft announced the general availability of Inbound SMTP DANE with DNSSEC for Exchange Online, marking a significant...

📧

Email Delivery
Get threat intel straight to your inbox.

♾️

Unlimited Vendors
Track every technology in your stack.

🚨

All New CVE Alerts
Be the first to know about new flaws.

⚙️

Custom EPSS Threshold
Filter noise, focus on real risks.

💬

Slack & Teams Webhook
Integrate directly into your SecOps.

🚫

100% Ad-Free
Enjoy an uninterrupted reading experience.

$7/mo

CVE-2026-93952CVSS 10.0
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-32996CVSS 7.3
A vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-7273CVSS 8.8
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a...
CISA KEV📅 Added to KEV: Sep 21, 2026
CVE-2026-58138CVSS 9.8
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute...
Admin intel📅 Updated: Sep 20, 2026
CVE-2026-86124CVSS 9.8
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and...
Admin intel📅 Updated: Sep 19, 2026
CVE-2025-39682CVSS 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the...
CISA KEV📅 Added to KEV: Sep 18, 2026
CVE-2025-39964CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg...
CISA KEV📅 Added to KEV: Sep 18, 2026
CVE-2026-53266CVSS 8.8
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The...
CISA KEV📅 Added to KEV: Sep 18, 2026

CVE-2026-93952CVSS 10.0
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intel📅 Updated: Sep 22, 2026
CVE-2026-19658CVSS 9.8
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and...
📅 Updated: Sep 22, 2026
CVE-2026-13355CVSS 9.8
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to,...
📅 Updated: Sep 22, 2026
CVE-2026-94301CVSS 9.8
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced...
📅 Updated: Sep 22, 2026
CVE-2026-83283CVSS 9.8
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version...
📅 Updated: Sep 22, 2026
CVE-2026-83269CVSS 9.8
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are...
📅 Updated: Sep 22, 2026
CVE-2026-94493CVSS 10.0
A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html...
📅 Updated: Sep 22, 2026
CVE-2026-12249CVSS 9.0
An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS)...
📅 Updated: Sep 21, 2026