Trending Organizations

GitHub is a software development and source code hosting platform centered on Git repositories and related collaboration features. In the provided content it appears as GitHub.com, GitHub Security Advisories (GHSA), GitHub Enterprise Server, GitHub Actions, and GitHub Copilot, indicating a broad developer-platform and enterprise software role. The content directly references GitHub as a source for repositories, pull requests, commits, releases, and security advisories, and notes that public proof-of-concept exploit repositories are commonly hosted there. Security-relevant information directly mentioned in the content includes GitHub-published security advisories on June 30, 2026 for GitHub Enterprise Server, affecting versions 3.21.x prior to 3.21.2, 3.20.x prior to 3.20.4, 3.19.x prior to 3.19.8, 3.18.x prior to 3.18.11, and 3.17.x prior to 3.17.17. The content also states that GitHub announced future patches and releases will be signed with a new public key and that customers must rotate to the new key before installing future updates. No high-confidence information about organization size or headquarters location is directly stated in the content.

Google is a major multinational technology company. In the provided content it is referenced across a broad set of products, services, and business units including Google Cloud, Google Cloud Platform, Gmail, Chrome, Android, YouTube, Google Play, Google Workspace, DeepMind, Project Zero, Mandiant, and the Google Threat Intelligence Group. The aliases and mentions indicate that Mandiant operates within Google, including Google Cloud branding. Security-relevant activity directly mentioned in the content includes Google’s kernelCTF program, Google Threat Intelligence Group and Mandiant reporting on exploitation activity, Google Play Protect warning users and disabling infected Android applications, and Google participating with partners and law enforcement in disruption of the NetNut residential proxy botnet. The content also references Google products and infrastructure in multiple contexts, including retirement of the Tenor API used by Windows 11 GIF search, reCAPTCHA image challenges developed after Google acquired the service in 2009, and CVE count statistics listing Google with 1,752 vendor-associated entries and Chrome and Android with 1,584 and 153 product-associated entries respectively. The content does not provide high-confidence details about headquarters, employee count, or exact size.

Microsoft Corporation is a major technology vendor whose products and services referenced in the content include Windows, Windows 11, Windows Server, Microsoft Edge, Active Directory, Azure-related identity branding such as Entra ID, Microsoft 365, Defender, Outlook, OneDrive, SharePoint, Teams, Visual Studio Code, and Copilot. The content directly associates Microsoft with Windows and Edge development, Active Directory features such as Resource-Based Constrained Delegation introduced in Windows Server 2012, and security products including Microsoft Defender. Security-relevant activity in the content includes Microsoft confirming a Windows 11 emoji panel issue after Google retired the Tenor API, with Microsoft replacing Tenor with GIPHY in preview updates released on June 23, 2026, and stating the fix would be included in the July 2026 Patch Tuesday cumulative update. Microsoft also added Google account sign-in support to Microsoft Edge 150 on Windows and macOS and introduced the NonMicrosoftAccountSignInEnabled policy for administrators. The content further references multiple Microsoft Edge vulnerabilities published on July 3, 2026, including remote code execution, spoofing, and security feature bypass issues such as CVE-2026-56645, CVE-2026-57974, CVE-2026-57981, CVE-2026-57983, CVE-2026-58282, CVE-2026-58283, CVE-2026-58284, CVE-2026-58285, CVE-2026-58286, CVE-2026-58287, CVE-2026-58288, and CVE-2026-58289. The content also states Microsoft confirmed CVE-2026-20841, an 8.8-rated remote code execution vulnerability in Notepad involving malicious Markdown links. In one cited vulnerability-count ranking, Microsoft appears with 843 CVE-associated entries. No high-confidence information about Microsoft’s size or headquarters location is directly stated in the content.

cvefeed.io appears to be a cybersecurity website focused on vulnerability intelligence and public exploit/PoC tracking. The content references pages listing CVEs, affected products, severity details, exploitability information, mitigations, and a section for public PoC/exploit repositories. The site also displays standard website elements including Privacy Policy, Terms of Service, and Refund Policy. Based on the provided content, cvefeed.io publishes or aggregates vulnerability records and related exploit references, but no high-confidence information is available about its organization size, physical location, or ownership. No security incidents or breaches involving cvefeed.io itself are directly mentioned in the content.

Anthropic, also referred to as Anthropic PBC, is an artificial intelligence company that develops the Claude family of models and related products and services, including Claude, Claude Code, Claude Cowork, and a Claude browser. The content also references advanced Anthropic models such as Opus, Mythos, Mythos Preview, and Fable 5. Security-relevant activity prominently associated with the organization includes publication of technical documentation on cybersecurity safeguards for Claude Fable 5, operation of a HackerOne program for reporting potential cyber jailbreaks, and collaboration with partners on frameworks for evaluating jailbreak severity. Anthropic is described as scanning more than 1,000 open-source projects with its Mythos model and logging 23,019 issues, while routing findings to human review. The content also references multiple security incidents and disclosures involving Anthropic products: LayerX reported an indirect prompt-injection technique affecting Anthropic’s Claude browser; Armadin disclosed a vulnerability chain in Claude Cowork on Windows that allowed an attacker with prior local code execution to escalate privileges and run commands as root inside the sandboxed Linux environment; and reporting discussed jailbreaks and temporary access restrictions affecting Claude Fable 5 and Mythos 5. The organization is also mentioned in broader industry reporting on AI-assisted vulnerability discovery, exploit generation, and model safety.

Apple is a technology company whose products and services referenced in the content include iOS, iPadOS, macOS, iCloud+, HomeKit, the App Store, Apple IDs, and Apple threat notifications. The content directly associates Apple with 284 CVE entries in one cited vendor-oriented count, and iOS and iPadOS with 124 entries in one cited product-oriented count. Security-relevant activity mentioned includes a reported unfixed vulnerability in Apple’s Hide My Email feature within iCloud+ that could reveal a user’s real email address behind an alias; Apple’s mitigation of the PWNYOURHOME/HomeKit-related issue through security improvements in iOS 16.3.1; and Apple’s sending of mercenary-spyware threat notifications to targeted users, including Stelios Kouloglou. The content also notes Apple’s planned iOS 27 Trust Insights framework for real-time scam and social-engineering detection, and references Apple’s role in app-store takedowns directed by the Indian government.

OpenAI is an artificial intelligence company and the maker of ChatGPT. The content references OpenAI models, products, and programs including ChatGPT, ChatGPT Atlas, Codex Security, and the Trusted Access for Cyber program, and describes OpenAI as a leading AI vendor and Anthropic’s chief rival. Security-relevant mentions in the content include: two OpenAI employees were reportedly affected in the Mini Shai-Hulud campaign; threat actors created fraudulent OpenAI organizations and sent invitations from noreply@tm.openai.com in the "Poisoned Tenant" social-engineering campaign to harvest credentials and API access; OpenAI patched or remediated multiple reported issues, including implementing the only effective vendor patch described for the BioShocking AI-browser prompt-injection attack, patching an issue reported by LayerX, and redesigning ChatGPT’s file download flow after a reported guardrail-bypass and path-traversal chain. The content also notes OpenAI collaborations and initiatives such as Patch the Planet with Trail of Bits, and mentions a policy proposal by OpenAI for an AI wealth fund. The organization’s size, headquarters location, and other corporate details are not provided in the content.

Amazon Web Services (AWS) is Amazon’s cloud computing platform and a major hyperscale cloud provider. In the provided content, AWS is referenced as infrastructure used for cloud services and storage, including Amazon S3 and Amazon ECR, and as a common target environment for credential theft, cloud reconnaissance, and security monitoring in enterprise and CI/CD contexts. The content also references AWS security contact information (aws-security@amazon.com), AWS regions including US-East-1 and eu-central-1, and AWS deployments for third-party products. Security-relevant mentions include a disclosed CVSS 8.5 vulnerability in Amazon Q Developer (CVE-2026-12957) that allowed automatic execution of malicious configuration files, multiple incidents involving theft and abuse of AWS credentials in supply-chain compromises, and significant AWS outages: an October 20, 2025 outage linked to a network health monitor issue and a May 2026 US-East-1 outage caused by a thermal event and power loss at a Virginia data center. The content does not provide high-confidence details on AWS’s size or headquarters location.

Meta, formally referenced in the content as Meta and Meta-owned WhatsApp, is a large global technology company operating major social and communications platforms including Facebook, Instagram, and WhatsApp. The content associates the organization with social media, messaging, advertising, and privacy-related product development, including WhatsApp’s planned username feature and Meta’s Private Processing system for WhatsApp. It also notes that WhatsApp has more than three billion users worldwide and that India is WhatsApp’s largest market with more than 850 million users. Security-relevant references in the content include academic analysis of Meta’s Private Processing for WhatsApp as one of the real-world implementations affected by attested TLS relay/diversion weaknesses associated with CVE-2026-33697, and reporting that attackers abused a Meta support bot called High Touch Support to trigger password reset links and take over Instagram accounts. The content also repeatedly cites Meta platforms such as Facebook, Instagram, and WhatsApp as common channels abused in scams, phishing, impersonation, and fraud campaigns, though these references describe abuse of the platforms rather than confirmed compromise of Meta itself. The content further states that Meta has said it could pull out of Europe if transfers of data to the United States were no longer allowed under transatlantic data-transfer rules.

VulnCheck is a cybersecurity organization and vulnerability intelligence source referenced repeatedly as the source for CVE entries and related security reporting. In the provided content, VulnCheck is cited as the source for numerous vulnerability records published or modified in July 2026, covering issues such as remote code execution, SQL injection, command injection, path traversal, denial of service, hard-coded credentials, and arbitrary file upload vulnerabilities across a range of products. The content also attributes to VulnCheck tracking of exploitation activity for every 2025 CVE, reporting that about 1% were ever used in an attack. No high-confidence information about the organization’s size, headquarters location, or corporate structure is directly stated in the content.

Cloudflare is a web infrastructure and security company that provides services including content delivery, DNS, web application firewall (WAF), bot management, Cloudflare Workers serverless hosting, Cloudflare Pages, tunneling, and related traffic protection and performance services. The content directly references Cloudflare infrastructure and products such as Cloudflare Workers, Cloudflare Pages, Cloudflare WAF, Cloudflare tunnels, Cloudflare R2, bot controls, and AI crawler management features. Cloudflare is also described as introducing new controls for managing AI-related bot traffic across Search, Agent, and Training categories, with BotBase and robots.txt Content Signals enhancements. Security-relevant context in the content shows Cloudflare services being frequently abused or leveraged by threat actors as trusted or masking infrastructure, including phishing pages hosted on Workers, malware exfiltration endpoints fronted by Cloudflare, TryCloudflare tunnels used in malware delivery, and domains using Cloudflare name servers or sitting behind Cloudflare to hide origin infrastructure. The content also notes Cloudflare was among organizations reportedly affected by the CI/CD workflow weakness dubbed Cordyceps, and that MeetingTV said Cloudflare classified its domains as malicious after a disputed third-party report.

IBM, also known as International Business Machines and commonly referred to as IBM, is a major multinational technology company. The content associates IBM with enterprise software, infrastructure, AI, cybersecurity research, open-source security, quantum-readiness research, and storage/security technologies. Referenced IBM products and business areas include WebSphere Application Server, Db2, Langflow OSS, IBM storage software, IBM Security X-Force, and quantum-safe readiness research. IBM is also identified as the parent company of Red Hat. The content highlights several notable IBM activities. IBM and Red Hat reportedly committed $5 billion to Project Lightwell, a subscription-based service focused on identifying vulnerabilities in the specific open-source versions enterprises run, producing backported fixes, and delivering signed validated patches under SLAs; IBM said 20,000 engineers were dedicated to the effort. IBM was also cited as participating in Anthropic’s Project Glasswing and as being actively involved in more than 61,700 open-source packages, with lifecycle management expertise across more than 10,600 packages. IBM research and reporting cited in the content include the 2025 Cost of a Data Breach Report, which the content says estimated average breach costs at $4.44 million globally and $10.22 million in the United States, and a 2025 Quantum-Safe Readiness survey that found an approximately 36% shortfall in quantum-safe cryptography expertise. IBM’s Adversarial Robustness Toolbox (ART) is also referenced as a tool used for generating adversarial examples in machine learning security contexts. Security-relevant information in the content is substantial. IBM is the source for multiple vulnerability disclosures affecting its products. These include WebSphere Application Server cross-site scripting issues, including CVE-2026-11594 affecting versions 9.0 and 8.5 and CVE-2026-11708 affecting the administrative console integrated help system. IBM Db2 is described as affected by CVE-2026-10109, a critical remote code execution vulnerability in pre-authentication DRDA handshake handling affecting Db2 Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4, with no workaround available according to the content. The content also lists numerous critical and high-severity vulnerabilities in IBM Langflow OSS, including arbitrary code execution, insecure deserialization, improper authorization, missing authentication, credential disclosure, and cross-tenant abuse issues across versions in the 1.0.0 through 1.10.0 range. IBM is additionally referenced through IBM X-Force reporting that generative AI made phishing email generation 11.4 times faster at comparable quality. The content does not provide a headquarters location or employee count for IBM, so that information is currently not available from the provided material.

Oracle, formally referenced in the content as Oracle Corporation, is a major enterprise software and cloud technology company. The content associates Oracle with products and services including Oracle PeopleSoft, Oracle E-Business Suite, Oracle MySQL and MySQL Connectors, Oracle Solaris Engineering, and Oracle Cloud. Oracle is also listed as a capability provider on the U.S. Department of Defense’s GenAI.mil platform. Security-relevant activity in the content centers on Oracle enterprise software being targeted in multiple campaigns. Oracle PeopleSoft was linked to a broad exploitation campaign involving CVE-2026-35273, a critical unauthenticated remote code execution flaw affecting PeopleTools 8.61 and 8.62. Oracle warned Nissan about attacks affecting HR records at hundreds of companies, and Nissan said it coordinated with Oracle during its incident response to a breach affecting employee data. Oracle E-Business Suite is also prominently discussed: researchers reported more than 900, and roughly 950, internet-exposed Oracle E-Business Suite instances, and active exploitation of CVE-2026-46817 in the Oracle E-Business Suite Payments module shortly after Oracle patched it. The content states this flaw affects Oracle E-Business Suite versions 12.2.3 through 12.2.15 and enables unauthenticated access to sensitive files or system takeover depending on the report cited. The content also mentions a vulnerability in Oracle MySQL Connector/J and references Oracle in broader reporting on CVE counts, where Oracle Corporation is listed with 445 entries in one cited dataset.

Cisco is a major enterprise networking and cybersecurity technology company. In the provided content it appears in connection with network infrastructure, security products, vulnerability disclosures, and threat intelligence operations. Referenced Cisco brands and business units include Cisco Talos, Cisco PSIRT, Cisco Technical Assistance Center, Cisco AnyConnect, Cisco Meraki, Cisco ISE, Duo Security, Unified Communications Manager (Unified CM), Catalyst Center, and Secure Endpoint Connector. The content shows Cisco as both a vendor of widely deployed enterprise infrastructure and a producer of security research and advisories. Cisco Talos is cited as discovering and analyzing the ARToken phishing-as-a-service platform targeting Microsoft 365 and as maintaining ClamAV releases. Cisco PSIRT and Cisco published multiple July 2026 advisories, including fixes for vulnerabilities affecting Catalyst Center and Secure Endpoint Connector, and Cisco confirmed in-the-wild exploitation of CVE-2026-20230 affecting Unified CM and Unified CM SME. The content also describes a high-severity Catalyst Center arbitrary file read vulnerability, CVE-2026-20191, and multiple ClamAV-related denial-of-service vulnerabilities affecting Secure Endpoint Connector. Cisco products are also referenced as attack targets or lures in broader threat activity. Threat actors were described as exploiting Cisco IOS XE and targeting exposed Cisco appliances for initial access, while fake installers masqueraded as Cisco AnyConnect. One incident referenced valid credentials that worked for both a Cisco VPN and an Active Directory account. The content further notes that vulnerabilities related to Cisco were included in CISA’s Known Exploited Vulnerabilities catalog and that Cisco domains or intelligence were used by others for malicious-domain classification. No headquarters location, employee count, or organization size is directly stated in the provided content.

NVIDIA, formally NVIDIA Corporation, is a U.S. technology company best known for GPUs and AI computing hardware and software. In the provided content, it appears in contexts spanning AI chips and servers, Linux/OpenBMC platform development, government AI deployments, and multiple product security advisories. The content specifically references NVIDIA’s Vera Rubin VR-NVL server platform and upstream Linux kernel and U-Boot/OpenBMC work for its baseboard management controller, as well as NVIDIA capabilities being hosted on the U.S. Department of Defense’s GenAI.mil platform. Security-relevant activity directly mentioned in the content includes several NVIDIA product vulnerabilities and advisories. These include CVE-2026-24260 in NVIDIA Container Toolkit for Linux, described as a high-severity TOCTOU race condition that could enable code execution, privilege escalation, and data tampering; CVE-2026-24270 in the NVIDIA AIStore framework, described as a critical authentication bypass vulnerability that is remotely exploitable; and CVE-2025-23350 and CVE-2025-23351 affecting NVIDIA ConnectX and BlueField, both described as critical command-interface flaws that can lead to out-of-bounds writes and arbitrary code execution on the device. The content also places NVIDIA at the center of export-control and supply-chain investigations involving advanced AI chips. Singaporean and Taiwanese authorities are described as investigating alleged smuggling or diversion of servers that may have contained advanced NVIDIA AI chips subject to U.S. export controls, with allegations that intermediaries misrepresented end users and routed systems through Singapore, Malaysia, Thailand, or Taiwan before possible delivery into China. Additional references note scrutiny of whether Chinese entities, including DeepSeek, obtained restricted NVIDIA GPUs through third parties. The content further mentions NVIDIA as a participant in Anthropic’s Project Glasswing and as a signatory in broader AI and cybersecurity policy discussions.

ANY.RUN is a cybersecurity company and platform referenced in the context through messaging promoting SOC integration and accelerated threat detection and rapid investigations. The content indicates it is positioned as a security operations and threat investigation solution intended to integrate with a SOC. No high-confidence details about the organization’s size, headquarters location, ownership, or specific security incidents are provided in the supplied content.

Huntress is a cybersecurity company and security research firm. The content refers to it as a managed cybersecurity company and a cybersecurity firm, and identifies personnel including CEO Kyle Hanslovan and Justin Allen, senior manager of security operations. Huntress publishes threat research and incident reporting through Huntress and Huntress Labs branding, including a 2026 Cyber Threat Report. In the cited reporting, Huntress investigated and disclosed multiple security incidents and trends, including a February 2026 BYOVD intrusion that used a signed vulnerable driver, a large-scale June 2026 password-spraying campaign against Microsoft 365 and Azure CLI that generated more than 81 million authentication attempts and compromised 78 accounts across 64 organizations, exploitation of Windows privilege-escalation flaws in the wild, and an IIS web-server intrusion involving a steganographic webshell and extensive defense evasion. The content also references Huntress research on ClickFix attacks, stating they accounted for more than 53% of malware loader activity in 2025. Security-relevant organizational issues mentioned in the content include allegations of an insider-threat matter involving communications between a Huntress employee and the ransomware operator DevMan; Huntress stated its investigation found no illegal conduct or insider activity, said the investigation was ongoing, and reported that it had implemented stricter policies and administrative actions.

Adobe is a software company known for products and services including Adobe ColdFusion, Adobe Campaign Classic, Adobe Creative Cloud, Adobe Document Cloud, Adobe Reader, and Magento/Adobe Commerce. The content directly associates the organization with security advisories and product security updates published in late June and early July 2026. Adobe released Priority 1 security bulletins APSB26-68 and APSB26-69 covering Adobe ColdFusion and Adobe Campaign Classic, addressing 12 vulnerabilities in total, including multiple maximum-severity CVSS 10.0 issues. Affected products mentioned include ColdFusion 2025 Update 9 and earlier, ColdFusion 2023 Update 20 and earlier, and Adobe Campaign Classic v7 version 7.4.3 build 9396 and earlier for on-premises deployments. Fixed versions mentioned are ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and Campaign Classic build 9397. The vulnerabilities could enable arbitrary code execution, privilege escalation, arbitrary file read, SSRF, XSS, and security bypass. Adobe stated it was not aware of in-the-wild exploitation for the issues at disclosure time. The content also notes Adobe announced a move from monthly to twice-monthly security bulletins starting July 14, 2026. Separately, Adobe is mentioned as a commonly spoofed brand in phishing campaigns and as one of the companies whose executives signed an open letter regarding AI export controls.

HackerOne is a security company and bug bounty / vulnerability disclosure platform used by organizations to receive reports from external security researchers. In the provided content, it is referenced as the platform Anthropic launched for researchers to submit potential cyber jailbreak findings affecting Claude Fable 5, and as the vulnerability disclosure program used by phpBB to receive a report for CVE-2026-48611, which phpBB staff triaged within nine minutes. HackerOne is also repeatedly listed as the source associated with multiple published CVE entries affecting UniFi products and UniFi OS. The content does not provide high-confidence details about HackerOne’s size, headquarters location, or any security incidents affecting HackerOne itself.

Fortinet is a cybersecurity vendor focused on network and security products and services. The content references multiple Fortinet product and research brands, including FortiGate firewalls, FortiClient EMS, FortiOS, and FortiGuard Labs. Fortinet appears in the material both as a manufacturer of widely deployed edge security appliances and as a source of threat intelligence and defensive guidance through FortiGuard Labs. The content specifically cites FortiGuard Labs reporting on exploitation attempts against Ivanti Sentry CVE-2026-10520 and on Ousaban banking malware activity targeting Spain and Portugal. Security-relevant references in the content also note that Fortinet products were targeted in several campaigns: FortiGate firewalls were the focus of the large-scale FortiBleed credential-harvesting campaign, which reportedly targeted more than 430,000 FortiGate firewalls worldwide and was later linked by SOCRadar to downstream INC Ransom and Lynx ransomware activity; Fortinet FortiClient EMS was also referenced in connection with exploitation of CVE-2026-35616. The content does not provide high-confidence details on Fortinet’s headquarters, employee count, or organization size.

Security Affairs is a cybersecurity news and analysis publication frequently cited in reporting on hacking, malware, vulnerabilities, data breaches, law-enforcement actions, and privacy issues. The content links the outlet to journalist Pierluigi Paganini and shows it reporting on topics including Pegasus spyware, supply-chain compromises, CISA advisories, Adobe and Apple security updates, Oracle E-Business Suite exploitation, AI-agent security flaws, password-spray campaigns, and major incidents such as the Aflac Japan breach affecting approximately 4.38 million customers and agents. Based on the provided content, Security Affairs appears to operate in the cybersecurity media sector; no high-confidence information about its size or location is directly stated.

The Apache Software Foundation is the organization referenced by the aliases and product mentions in the content. It is the steward of numerous widely used open-source software projects, including Apache HTTP Server, Tomcat, ActiveMQ, Lucene.Net, HttpComponents Core, and CouchDB. The content directly associates the organization with publishing security advisories and vulnerability disclosures across these projects, including multiple 2026 issues affecting ActiveMQ, Tomcat, Lucene.Net, HttpComponents Core, and Apache HTTP Server, with recommended fixed versions and upgrade guidance. The content also references Apache products in broader security reporting, including exploitation of CVE-2018-8007 in Apache CouchDB by the RustDuck botnet and discussion of Apache HTTP Server URL normalization behavior in a separate path traversal analysis. No high-confidence information about the foundation’s size or headquarters location is provided in the content.

F5 is a technology company associated with the f5.com domain and products including F5 BIG-IP load balancers. The content references F5 Product Development issuing multiple security-impact statements that certain disclosed vulnerabilities did not affect supported F5 products, and also notes F5 evaluating hardware-platform exposure in the context of speculative-execution issues with component vendors. F5 BIG-IP is specifically mentioned as an internet-facing technology that has been exploited or targeted in intrusion activity and exploitation attempts in third-party reporting. In a Comparitech study of 5,849 domains across 13 sectors, f5.com was one of only two domains to achieve a perfect 8/8 score for email security controls. The content does not provide high-confidence details on the organization’s size or headquarters location.

WatchGuard, also referred to as WatchGuard Technologies and WatchGuard Technologies Inc., is a cybersecurity vendor whose products mentioned in the content include Firebox firewall appliances, Fireware OS, and the Mobile VPN with SSL client for Windows. The content directly associates the company with publishing multiple security advisories on July 2, 2026, covering vulnerabilities across Fireware OS release lines 11.x, 12.x, 12.5.x, and 2025/2026 branches, as well as its Windows VPN client. Notable issues disclosed include multiple high-severity and critical vulnerabilities such as out-of-bounds writes in CLI, networkd, ikestubd, wgagent, and admd components; a path traversal flaw in the Management Web UI; a firmware validation bypass in backup/restore processing; a null pointer dereference in IKEv2 handling causing denial of service; a race condition/use-after-free in LDAP authentication for Mobile User VPN with IKEv2; stored XSS issues in spamBlocker and third-party integration configurations; a hardcoded fallback encryption key in the Access Portal credential database; and a local privilege escalation vulnerability in the Mobile VPN with SSL Windows client. The content states that WatchGuard released patched firmware versions including Fireware OS 2026.2.1 and 12.12.1 for some issues, while legacy 11.x releases are end-of-life and require migration because no workaround is available.