Patch Calendar
A tracked vulnerabilities dataset for our cybersecurity coverage: what it measures, where the figures come from and when they were last checked.
Microsoft's October 2026 Patch Tuesday Sets Record with 1,411 CVEs
Microsoft released a record 1,411 CVEs in October 2026, including three actively exploited zero days, driven by AI-powered scanning.
Pwn2Own Ireland 2026 reveals six Samsung Galaxy S26 zero-day hacks
Security researchers earned $232,500 exploiting 45 zero-days on day two of Pwn2Own Ireland 2026, with Samsung's flagship phone hacked six times in 48...
Anthropic expands Cyber Verification Program with reduced AI safeguards
Anthropic has expanded its Cyber Verification Program, offering vetted cybersecurity professionals reduced safeguards on advanced AI models like...
ClingSTUN malware exploits 24 IoT flaws via STUN protocol
A new Linux backdoor named ClingSTUN hijacks internet-facing IoT devices by exploiting two dozen known, unpatched vulnerabilities.
Fortra patches critical BoKS vulnerabilities
Fortra has released patches for eight vulnerabilities in its BoKS Privileged Access Manager, three of which are critical.
AI-Discovered Vulnerabilities Exploitation Accelerates
Five threat clusters exploited a critical remote code execution flaw in BeyondTrust products within a week of its disclosure.
Xint DARPA AI Security Tool Exposes Critical Signal Flaws
A DARPA-backed AI security startup, Xint, identified three critical vulnerabilities in Signal's Android app during a one-hour scan.
NetScaler CVE-2026-88771 and CVE-2026-88772 Exploited
Two critical Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being actively exploited in zero-day attacks to deploy...
Citrix NetScaler zero-day remote code execution flaws exploited
Two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway appliances are under active exploitation.
Salesforce Agentforce Zero-Click Vulnerabilities Enable Data Exfiltration
Zenity Labs disclosed three critical zero-click vulnerabilities in Salesforce Agentforce, collectively named SalesBleed.
Siemba automates IDOR testing for production APIs
Siemba has launched automated testing for insecure direct object reference (IDOR) vulnerabilities in REST, GraphQL, and SOAP APIs.
CISA Adds Three Exploited Linux Kernel Flaws to KEV Catalog
The U.S. Cybersecurity agency CISA has mandated patching for three actively exploited Linux kernel vulnerabilities.
BlueMoon Exploit Kit Chains Chrome, Windows Zero-Days
A new exploit kit called BlueMoon, which chains three recent zero-day vulnerabilities in Chrome and Windows, has been rapidly adopted by multiple...
CISA Director Warns of Critical Vulnerabilities and Technical Debt
Acting CISA Director Nick Andersen warns that decades of bad decisions and overwhelming technical debt have left the U.S.
Microsoft Patches Record 974 Flaws, Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday addressed a record 974 vulnerabilities, including two Windows zero-days under active exploitation. The U.S.
MikroTik RouterOS SSH Flaws Enable Full Device Hijack
CERT Polska discovered six RouterOS vulnerabilities, two of which allow unauthenticated full device control via SSH.
Anthropic's Claude Mythos finds 23,000 bugs
Anthropic's Claude Mythos Preview AI identified over 23,000 potential vulnerabilities in open-source projects.
Microsoft and Adobe Patch Critical Vulnerabilities
September 2026's Patch Tuesday follows a record-breaking August with 398 CVEs patched. Experts highlight actively exploited SharePoint and Exchange...
Breeze Comet targets Brazilian payments
A threat actor known as Breeze Comet has been manipulating Brazilian payment systems since 2024, executing hundreds of fraudulent transactions after...
PaperCut Attacks Now Active Intrusions
Threat actors are now conducting hands-on-keyboard intrusions by chaining two critical PaperCut vulnerabilities, CVE-2026-82078 and CVE-2026-81578.
CISA Adds Six Exploited Flaws to KEV Catalog
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on August 26, including high-severity flaws in Citrix and Microsoft...
Critical WordPress Plugin, Theme Flaws
Five critical vulnerabilities in popular WordPress plugins and themes, including WPMU DEV Dashboard and Avada, allow unauthenticated attackers to...
PaperCut patches two critical flaws under active exploitation
PaperCut warns of active exploitation of two high-severity vulnerabilities (CVE-2026-82078 and CVE-2026-81578) in its print management software.
PaperCut Flaws Chained for Unauthenticated Attacks
Attackers are exploiting two critical PaperCut vulnerabilities, CVE-2026-82078 and CVE-2026-81578, to achieve unauthenticated remote code execution.