Updated continuously

The signal that matters.

Cutting through advisories, vendor PSIRTs, researcher write-ups, and the underground — correlated, deduped, and ranked so your team only sees what moves the needle.

38,375stories tracked

Story velocity

6,144 sources1.8M refsLive

Internet Facing Serv…Privilege Escalation…Proof Of Concept Rel…

HestiaCP Broken Access Control Flaw Enables Admin Takeover and RCE

A high-severity vulnerability in HestiaCP, tracked as CVE-2026-12196, allows a low-privileged user to take over administrator accounts by abusing the control panel's panel cron job feature. The flaw stems from broken authorization in cron job handling, where an undefined variable in an access-control check lets unauthorized users modify privileged jobs; the issue is compounded by missing CSRF token validation. Security reporting says the bug is remotely exploitable and carries a CVSS 4.0 score of 8.3.

Timeline

yesterdayCVE-2026-12196 entry published with high severity details
yesterdayProject Black discloses HestiaCP admin takeover vulnerability

Attack Tradecraft·2sources·Updated 2h ago

Latest

Underground Data LeakGovernment Diplomati…+3

U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A U.S. government entity reportedly paid about $1 million in Bitcoin to the Kairos group after attackers allegedly stole more than 2 TB of data and threatened to publish it. A Ransom-ISAC case study said the incident showed no confirmed signs of file encryption, a ransomware locker, or any decryption demand, indicating a pure data-theft extortion operation rather than a traditional ransomware attack. Negotiations reportedly lasted about a month, with Kairos reducing its demand from $3 million to a final payment of roughly 9.44 BTC.

Breach & Incident Intelligence

3·Updated 10h ago

Endpoint Software Vu…Proof Of Concept Rel…+1

KDE Plasma 'Open New Window' Flaw Enables Sandbox Escape and Arbitrary Code Execution

A publicly disclosed vulnerability in KDE Plasma allows a sandboxed application to trigger arbitrary code execution on the host through the "Open New Window" action. Researcher Kimiblock said Plasma determines what to launch by inspecting /proc/PID/cmdline and argv[0], which can be spoofed so the desktop starts the wrong program. The issue is particularly serious for sandboxed apps such as those distributed via Flatpak, because a malicious app can manipulate launch metadata and cause Plasma to spawn host binaries outside the sandbox boundary.

Patch & Detection Intelligence

3·Updated 21h ago

Internet Facing Serv…Proof Of Concept Rel…+1

Pathway fixed unauthenticated DoS in document-store glob matching

Pathway disclosed and fixed CVE-2026-59094, a high-severity denial-of-service flaw affecting versions through 0.31.1. The vulnerability lies in the document-store and RAG REST servers, where attacker-controlled filepath_globpattern input is processed by a hand-written recursive glob matcher. Patterns containing repeated ** tokens can trigger exponential-time evaluation without memoization, allowing a remote unauthenticated attacker to drive heavy CPU consumption and deny service through exposed HTTP endpoints including /v1/inputs, /v1/retrieve, and /v2/answer.

Patch & Detection Intelligence

5·Updated yesterday

11 sections hidden

Find out if you're exposed

Don't read about it. Know when it affects you.

Mallory correlates every story on this page with your attack surface (assets, vendors, identities, subsidiaries) and surfaces a small set of evidence-based cases instead of 10,000 alerts.

Start Free Trial Request a live demo

Subscribe to the digest

A daily email with top stories, new KEVs, and fresh exploits. No marketing.

Or grab the RSS feeds →