UNC6395

FBI Alert: Two Cybercriminal Groups Are Actively Compromising Salesforce TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

FBI Alert: Two Cybercriminal Groups Are Actively Compromising Salesforce

Do Son September 15, 2025

The Federal Bureau of Investigation (FBI), in coordination with DHS/CISA, has released a new FLASH Alert (FLASH-20250912-001)...

Salesforce Breach Through Salesloft Drift Hits Google, Cloudflare, and 750 Firms Knowledge Deliver RCE vulnerability FortiClient EMS Vulnerability CVE-2026-35616 Cisco SD-WAN Vulnerability CVE-2026-20122 PCPcat, Next.js RCE Salesloft breach, Salesforce CRM WIREFIRE web shell

Knowledge Deliver RCE vulnerability FortiClient EMS Vulnerability CVE-2026-35616 Cisco SD-WAN Vulnerability CVE-2026-20122 PCPcat, Next.js RCE Salesloft breach, Salesforce CRM WIREFIRE web shell

Salesforce Breach Through Salesloft Drift Hits Google, Cloudflare, and 750 Firms

Do Son September 9, 2025

Beginning in July 2025, several high-profile companies reported breaches of their Salesforce CRM (Customer Relationship Management) systems,...

Data Theft Alert: Salesforce Instances Breached via Third-Party App OAuth Tokens Salesforce data theft

Salesforce data theft

Data Theft Alert: Salesforce Instances Breached via Third-Party App OAuth Tokens

Do Son August 28, 2025

The Google Threat Intelligence Group (GTIG) has issued an urgent advisory on a widespread data theft campaign...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-111357CVSS 7.0
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to...
Watchtower Verified📅 Updated: Oct 16, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 16, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 16, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 16, 2026
CVE-2026-106931CVSS 8.5
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS...
Admin intel📅 Updated: Oct 15, 2026
CVE-2025-61624CVSS 6.0
An Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0...
Admin intel📅 Updated: Oct 15, 2026
CVE-2026-110447CVSS 9.2
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in...
Watchtower Verified📅 Updated: Oct 15, 2026
CVE-2026-21589CVSS 9.3
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software...
CISA KEV📅 Added to KEV: Oct 15, 2026

CVE-2026-16438CVSS 9.4
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior,...
📅 Updated: Oct 16, 2026
CVE-2026-16436CVSS 9.2
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions...
📅 Updated: Oct 16, 2026
CVE-2026-103768CVSS 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in...
📅 Updated: Oct 16, 2026
CVE-2026-89079CVSS 9.8
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up...
📅 Updated: Oct 16, 2026
CVE-2026-109219CVSS 9.8
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and...
📅 Updated: Oct 16, 2026
CVE-2026-109515CVSS 9.8
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is...
📅 Updated: Oct 16, 2026
CVE-2026-104798CVSS 9.8
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions...
📅 Updated: Oct 16, 2026
CVE-2026-111444CVSS 9.8
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies...
📅 Updated: Oct 16, 2026