OAuth 2.0

Resurgent Tycoon 2FA Adopts OAuth Device Code Phishing to Hijack Microsoft 365 Tycoon 2FA Phishing Kit OAuth Device Code Phishing

Tycoon 2FA Phishing Kit OAuth Device Code Phishing

Resurgent Tycoon 2FA Adopts OAuth Device Code Phishing to Hijack Microsoft 365

Do Son May 19, 2026

Just weeks after a massive international law enforcement operation dismantled its primary server infrastructure, the notorious Tycoon...

Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure

Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure

Do Son April 23, 2026

Esri has issued an urgent security bulletin regarding two critical vulnerabilities affecting developer credentials within ArcGIS Online,...

Hackers Abuse “Device Codes” to Bypass Security and Seize Microsoft 365 Accounts Device Code Phishing, Microsoft 365 OAuth

Device Code Phishing, Microsoft 365 OAuth

Hackers Abuse “Device Codes” to Bypass Security and Seize Microsoft 365 Accounts

Do Son December 22, 2025

Cybercriminals have found a new way to turn corporate security protocols against themselves, weaponizing a legitimate Microsoft...

New NANOREMOTE Backdoor Uses Google Drive API for Covert C2 and Links to FINALDRAFT Espionage Group NANOREMOTE Google Drive C2, FINALDRAFT Link

NANOREMOTE Google Drive C2, FINALDRAFT Link

New NANOREMOTE Backdoor Uses Google Drive API for Covert C2 and Links to FINALDRAFT Espionage Group

Do Son December 15, 2025

Elastic Security Labs has uncovered a sophisticated new Windows backdoor that leverages the trusted infrastructure of Google...

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-63077CVSS 9.8
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CISA KEV📅 Added to KEV: Aug 5, 2026
CVE-2026-34486CVSS 7.5
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of...
CISA KEV📅 Added to KEV: Aug 4, 2026
CVE-2026-9198CVSS 9.8
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network...
CISA KEV📅 Added to KEV: Aug 4, 2026
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects...
CISA KEV📅 Added to KEV: Aug 4, 2026
CVE-2026-18577
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
Admin intelCISA KEV📅 Added to KEV: Aug 3, 2026📅 Updated: Aug 3, 2026
CVE-2026-18072CVSS 9.8
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to...
Admin intel📅 Updated: Jul 29, 2026
CVE-2026-20316CVSS 5.3
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated,...
CISA KEV📅 Added to KEV: Jul 29, 2026
CVE-2026-16812CVSS 10.0
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
Admin intelCISA KEV📅 Added to KEV: Jul 27, 2026📅 Updated: Jul 27, 2026