Source intelligence
425 collected source records. Original advisories and security research.
300 matching sources · Newest published first
Open CVE tracker →Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.
Scroll across the table to see all columns.
| Published | Finding / research | Publisher | Identifiers |
|---|---|---|---|
| Fake security tools on GitHub push backdoors and infostealers Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. The campaign started about two years ago and initially targeted crypto wall… |
BleepingComputer | None reported |
|
| GhostBat Android Malware Targets 60 Banking and Payment Apps in India A recent investigation uncovered an updated version of GhostBat, an Android malware family targeting 60 banking and payment applications in India. Spread through fraudulent government-service messages and malicious app d… |
Zimperium | None reported |
|
| SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability CVE-2026-19868 — SonicWall / SonicOS SSLVPN. SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to by… |
CISA KEV | ||
| filecoin-pin: Unbounded DAG pinning can exhaust server resources GHSA: GHSA-m5ph-mmg5-6w5h CVE: CVE-2026-62300 Reported severity: medium Advisory package entry 1: Affected package: filecoin-pin (npm) Affected versions: <= 1.1.0 Patched version: 1.1.1 Advisory description: Summary The … |
GitHub Advisory Database | CVE-2026-62300GHSA-M5PH-MMG5-6W5H |
|
| Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE GHSA: GHSA-64vx-6h2c-rjh7 CVE: CVE-2026-61536 Reported severity: high Advisory package entry 1: Affected package: banks (pip) Affected versions: <= 2.4.2 Patched version: 2.4.3 Advisory description: Summary banks parses … |
GitHub Advisory Database | ||
| kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts GHSA: GHSA-5q7h-w9jf-cx97 CVE: CVE-2026-105769 Reported severity: critical Advisory package entry 1: Affected package: github.com/chainguard-dev/kaniko (go) Affected versions: < 1.25.20 Patched version: 1.25.20 Advisory … |
GitHub Advisory Database | CVE-2026-105769GHSA-5Q7H-W9JF-CX97 |
|
| lxd allows Cross-guest volume hijack via DevLXD device patch GHSA: GHSA-hhf9-qw4v-72xp CVE: CVE-2026-12411 Reported severity: high Advisory package entry 1: Affected package: github.com/canonical/lxd (go) Affected versions: >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085… |
GitHub Advisory Database | CVE-2026-12411GHSA-HHF9-QW4V-72XP |
|
| CrowdStrike Uncovers New Agentic AI Campaigns A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doin… |
CrowdStrike | None reported |
|
| Email threat landscape: Q3 2026 trends and insights | Microsoft Security Blog Microsoft Threat Intelligence detected approximately 7.3 billion email-based phishing threats from July through September, including a sharp increase to nearly 3 billion in September alone, up 41% from August. Yet the in… |
Microsoft | None reported |
|
| Fake event invites combine Kali365 and VoidProxy payloads Push researchers found fake registration pages for OpenAI, SpaceX, and Anthropic events. The pages use Kali365 to phish Microsoft accounts and VoidProxy to phish Google accounts. In late October 2026, Push detected and b… |
Push Security | None reported |
|
| TraderTraitor vs Contagious Interview - A Look at Binance's Initial Incident Report On October 29th, 2026, Binance was hacked for approximately $6.4 billion dollars. The attack was quickly attributed to DPRK's TraderTraitor threat actor group by TRM, Pangolin Intelligence, Elliptic, Chainalysis, the FBI… |
Security Alliance | ||
| How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests.… |
Securelist | ||
| Threat actors use agentic AI tooling to find and abuse exposed secrets | Microsoft Security Blog Microsoft Threat Intelligence has observed threat actors using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including credentials, application credentials, and AI inference-… |
Microsoft | None reported |
|
| New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org Key findings - Attackers using the Anubis ransomware targeted a U.S. organization in October 2026 using a new custom backdoor that Symantec has called Backdoor.Lindnor. - The backdoor masqueraded as a Chrome component an… |
Symantec Threat Intelligence | None reported |
|
| From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META Introduction Between March and September 2026, thousands of Android phones belonging to retail banking customers in the META region were confirmed to be infected with the malware Group-IB tracks as Mirax, with two big ac… |
Group-IB | None reported |
|
| From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META Introduction Between March and September 2026, thousands of Android phones belonging to retail banking customers in the META region were confirmed to be infected with the malware Group-IB tracks as Mirax, with two big ac… |
Group-IB | None reported |
|
| Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 GHSA: GHSA-93cm-2v4m-c56c CVE: CVE-2026-55098 Reported severity: medium Advisory package entry 1: Affected package: github.com/basekick-labs/arc (go) Affected versions: < 0.0.0-20260610131716-5dc8f53b70a3 Patched version… |
GitHub Advisory Database | ||
| @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter GHSA: GHSA-mc8m-rr6c-r5qr CVE: CVE-2026-93363 Reported severity: medium Advisory package entry 1: Affected package: @payloadcms/storage-vercel-blob (npm) Affected versions: >= 3.25.0, < 3.90.0 Patched version: 3.90.0 Adv… |
GitHub Advisory Database | CVE-2026-93363GHSA-MC8M-RR6C-R5QR |
|
| odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values GHSA: GHSA-3cgg-c5pp-57h6 CVE: CVE-2026-113787 Reported severity: medium Advisory package entry 1: Affected package: odf-kit (npm) Affected versions: >= 0.6.0, < 0.14.2 Patched version: 0.14.2 Advisory description: Summa… |
GitHub Advisory Database | CVE-2026-113787GHSA-3CGG-C5PP-57H6 |
|
| Apple Multiple Products Improper Authentication Vulnerability CVE-2024-27834 — Apple / Multiple Products. Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability … |
CISA KEV | ||
| French Bank Crédit Mutuel Arkéa Confirms Cyberattack Amid Reports of $133 Million Theft French banking group Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transactions, following reports linking the institution to cryptocurrency theft exceeding $133 million. The bank says the incid… |
Cyber Security News | None reported |
|
| SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analyzed, one behavior has remained consistent: Dark… |
ESET Research | ||
| Stanza: RCE via pickle deserialization in the lemmatizer GHSA: GHSA-gh9r-c94j-cmp5 CVE: CVE-2026-115878 Reported severity: high Advisory package entry 1: Affected package: stanza (pip) Affected versions: = 1.14.0 Patched version: 1.15.0 Advisory description: TL;DR Loading an a… |
GitHub Advisory Database | ||
| Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access GHSA: GHSA-33r5-xmm8-v6x5 CVE: CVE-2026-44267 Reported severity: critical Advisory package entry 1: Affected package: @enspirit/elo (npm) Affected versions: <= 1.0.0 Patched version: 1.0.1 Advisory description: Summary A… |
GitHub Advisory Database | CVE-2026-44267GHSA-33R5-XMM8-V6X5 |