Source intelligence
425 collected source records. Original advisories and security research.
300 matching sources · Newest published first
Open CVE tracker →Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.
Scroll across the table to see all columns.
| Published | Finding / research | Publisher | Identifiers |
|---|---|---|---|
| Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability GHSA: GHSA-f7vh-h5g3-7jrh CVE: CVE-2026-120006 Reported severity: high Advisory package entry 1: Affected package: Aspire.Hosting.AppHost (nuget) Affected versions: < 13.6.5 Patched version: 13.6.5 Advisory package entry… |
GitHub Advisory Database | CVE-2026-120006GHSA-F7VH-H5G3-7JRH |
|
| Microsoft Security Advisory CVE-2026-118746 - .NET Security Feature Bypass Vulnerability GHSA: GHSA-ff4h-7rhj-jrjf CVE: CVE-2026-118746 Reported severity: medium Advisory package entry 1: Affected package: Microsoft.NETCore.App.Runtime.linux-arm (nuget) Affected versions: >= 11.0.0-preview.1, < 11.0.0-previe… |
GitHub Advisory Database | CVE-2026-118746GHSA-FF4H-7RHJ-JRJF |
|
| Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability GHSA: GHSA-3g4v-f5gv-c7xf CVE: CVE-2026-109475 Reported severity: medium Advisory package entry 1: Affected package: Microsoft.NETCore.App.Runtime.linux-arm (nuget) Affected versions: >= 8.0.0-0, <= 8.0.33 Patched versio… |
GitHub Advisory Database | CVE-2026-109475GHSA-3G4V-F5GV-C7XF |
|
| Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability GHSA: GHSA-cpw3-h88j-9f6x CVE: CVE-2026-120796 Reported severity: medium Advisory package entry 1: Affected package: Microsoft.NETCore.App.Runtime.linux-arm (nuget) Affected versions: >= 11.0.0-preview.1.26104.118, <= 11… |
GitHub Advisory Database | CVE-2026-120796GHSA-CPW3-H88J-9F6X |
|
| Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability GHSA: GHSA-vmv3-wvjp-wqpj CVE: CVE-2026-118747 Reported severity: medium Advisory package entry 1: Affected package: System.Formats.Cbor (nuget) Affected versions: >= 8.0.0-0, < 8.0.2 Patched version: 8.0.2 Advisory pack… |
GitHub Advisory Database | CVE-2026-118747GHSA-VMV3-WVJP-WQPJ |
|
| Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability GHSA: GHSA-m28h-pj36-4364 CVE: CVE-2026-118749 Reported severity: medium Advisory package entry 1: Affected package: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) Affected versions: >= 11.0.0-rc.1.26425.128, <= 11.0… |
GitHub Advisory Database | CVE-2026-118749GHSA-M28H-PJ36-4364 |
|
| Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability GHSA: GHSA-x33c-w48q-qrgc CVE: CVE-2026-114149 Reported severity: high Advisory package entry 1: Affected package: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) Affected versions: >= 8.0.0-preview.1.23112.2, <= 8.0.… |
GitHub Advisory Database | CVE-2026-114149GHSA-X33C-W48Q-QRGC |
|
| Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability GHSA: GHSA-xhj5-c3g8-pfj8 CVE: CVE-2026-109476 Reported severity: medium Advisory package entry 1: Affected package: Microsoft.AspNetCore.App.Runtime.linux-arm (nuget) Affected versions: >= 8.0.0-rc.1.23421.29, <= 8.0.33… |
GitHub Advisory Database | CVE-2026-109476GHSA-XHJ5-C3G8-PFJ8 |
|
| React: Unauthenticated Remote Code Execution in React Server Components GHSA: GHSA-xqc2-xf4c-x3h3 CVE: CVE-2026-126187 Reported severity: critical Advisory package entry 1: Affected package: react-server-dom-parcel (npm) Affected versions: >= 19.0.0, < 19.0.9 Patched version: 19.0.9 Advisory… |
GitHub Advisory Database | CVE-2026-126187GHSA-XQC2-XF4C-X3H3 |
|
| compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages GHSA: GHSA-8v59-qmwv-4p6q CVE: CVE-2026-125123 Reported severity: low Advisory package entry 1: Affected package: compose-lint (pip) Affected versions: = 0.31.0 Patched version: 0.32.0 Advisory description: Impact 0.31.0… |
GitHub Advisory Database | ||
| compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks GHSA: GHSA-xcf7-88g6-7xr8 CVE: CVE-2026-125125 Reported severity: low Advisory package entry 1: Affected package: tmatens/compose-lint (actions) Affected versions: >= 0.30.0, <= 0.31.0 Patched version: 0.32.0 Advisory de… |
GitHub Advisory Database | ||
| Google patches eighth Chrome zero-day exploited in attacks this year Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. "Google is aware that an exploit for CVE-2026-125350 exi… |
BleepingComputer | ||
| iOS Sandbox Escape Is Public, and Apple Hasn't Confirmed a Fix On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps. Seed phrases, private keys and login credentials could be exposed to a malicious app, the exchange sa… |
Security Affairs | None reported |
|
| Desktop and IoT threat statistics for Q3 2026 IT threat evolution in Q3 2026. Non-mobile statistics IT threat evolution in Q3 2026. Mobile statistics The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated… |
Securelist | ||
| Google Chromium Use-After-Free Vulnerability CVE-2026-125350 — Google / Chromium. Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted we… |
CISA KEV | ||
| Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft Microsoft’s November 2026 Patch Tuesday updates fix 1,094 vulnerabilities across its products, including an Outlook bug that the company says has been exploited. The zero-day, tracked as CVE-2026-124194, has been classif… |
SecurityWeek | ||
| Turla hackers use new Cereal malware to spy on govt Exchange servers The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET … |
BleepingComputer | None reported |
|
| Hackers now exploit critical Barracuda ESG flaws to gain root access Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. Barracuda released s… |
BleepingComputer | ||
| Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-b… |
BleepingComputer | None reported |
|
| Mobile threat report for Q3 2026 IT threat evolution in Q3 2026. Non-mobile statistics IT threat evolution in Q3 2026. Mobile statistics The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwan… |
Securelist | None reported |
|
| Hackers exploit trusted AWS access to breach multiple cloud environments A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. The campaign ran betw… |
BleepingComputer | None reported |
|
| Exchange for breakfast: Turla’s Cereal tricks are not for kids On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox. Somewhere in a national government office, an official sends an email to a colleague at a transnat… |
ESET Research | None reported |
|
| Railway breach leads to $740,000 in fraudulent AI charges Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing creden… |
BleepingComputer | None reported |
|
| Представители Binance опровергли информацию о новом взломе На хакерском форуме заметили сообщение о продаже данных 335 млн пользователей, якобы похищенных у криптобиржи Binance. Хотя автор объявления использовал ник ShinyHunters, похоже, он лишь выдает себя за участника вымогате… |
Xakep | None reported |