FortiGuard Labs

Taiwan Under Attack: Sophisticated Phishing Campaign Delivers Winos 4.0, HoldingHands RAT, & Gh0stCringe Taiwan Cyberattack, Phishing Campaign

Taiwan Under Attack: Sophisticated Phishing Campaign Delivers Winos 4.0, HoldingHands RAT, & Gh0stCringe

Do Son June 18, 2025

In a detailed investigation published by FortiGuard Labs, a persistent and highly coordinated malware campaign has been...

Malicious NPM Packages Target PayPal Users to Steal Sensitive Data Crypto Scam, Executive Fraud business email compromise scam

Malicious NPM Packages Target PayPal Users to Steal Sensitive Data

Do Son April 14, 2025

A recent report from FortiGuard Labs has uncovered a series of malicious NPM packages designed to steal...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 7 days →

CVE-2026-65660CVSS 8.8
Improper control of generation of code (\'code injection\') in Microsoft Office SharePoint allows an authorized attacker to execute...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 25, 2026
CVE-2026-5430CVSS 10.0
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-71362CVSS 9.1
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-87902
Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 23, 2026
CVE-2026-94127CVSS 9.8
When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-85102CVSS 9.8
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
CVE-2026-93616CVSS 9.8
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on...
Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026

CVE-2026-93647CVSS 9.3
An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra...
📅 Updated: Sep 26, 2026
CVE-2026-93643CVSS 9.8
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document...
📅 Updated: Sep 26, 2026
CVE-2026-69865CVSS 10.0
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a...
📅 Updated: Sep 26, 2026
CVE-2026-100551CVSS 9.0
OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the...
📅 Updated: Sep 26, 2026
CVE-2026-75745CVSS 10.0
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code...
📅 Updated: Sep 26, 2026
CVE-2026-75689CVSS 9.3
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker...
📅 Updated: Sep 26, 2026
CVE-2026-83660CVSS 9.9
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege...
📅 Updated: Sep 26, 2026
CVE-2026-88414CVSS 9.8
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
📅 Updated: Sep 26, 2026

Critical Alert 2 Active Exploits Detected Today

Taiwan Under Attack: Sophisticated Phishing Campaign Delivers Winos 4.0, HoldingHands RAT, & Gh0stCringe

Malicious NPM Packages Target PayPal Users to Steal Sensitive Data