Microsoft is publishing 55 vulnerabilities this February 2026 Patch Tuesday. Microsoft is aware of exploitation in the wild for six of today’s vulnerabilities, and notes public disclosure for three of ...

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose ...

Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from ...

The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report Dark web black market technologies and tools When it comes to dark web black markets, anonymity is key.

The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report Recently, Rapid7 observed the Fake Browser Update lure tricking users into executing malicious binaries.

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with ...

The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report Rapid7 is tracking a new, more sophisticated and staged campaign using the Blackmoon trojan, which ...

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be ...

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it ...

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, ...

CVE-2026-120364: Untapwp Vidplex: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Untapwp Vidplex…. View severity, references, and remediation ...