Known Exploited Vulnerabilities and counting....
A known exploited vulnerability (KEV) refers to a software vulnerability that is being actively exploited by cybercriminals or threat actors. When a vulnerability becomes known to be exploited in the wild, it signals that the vulnerability poses a significant and imminent risk to organizations.
Cybersecurity Brief – May 24, 2026
npm has introduced significant supply chain security enhancements, including mandatory 2FA-gated publishing and new package install controls designed to mitigate software supply chain attacks. GitHub is recommending that staged publishing be combined with trusted publishing using OpenID Connect (OIDC) for optimal protection. These measures address the growing threat to JavaScript developers, as npm remains one of the world's largest software registries and a high-value target for attackers seeking to inject malicious code into widely-used dependencies.
Active exploitation is underway targeting CVE-2026-48172, a vulnerability in the LiteSpeed cPanel plugin that allows attackers to execute malicious scripts with root-level privileges. Organizations running affected versions should prioritize patching immediately, as root access enables complete system compromise. Meanwhile, Dragos intelligence leadership is calling attention to the evolving operational technology (OT) threat landscape, emphasizing the need for contextualized risk assessment in critical infrastructure environments where the convergence of IT and OT systems continues to expand the attack surface.
Sources: The Hacker News · Hendry Adrian · Cyber Magazine
Common Vulnerability and Exposure
CVEs form a database of known security vulnerabilities that are actively tracked and managed by a group of organizations, such as the U.S. National Cyber Security Alliance. CVEs are an important tool for network security management because they not only provide an inventory of existing vulnerabilities, but also provide information about how the vulnerability can be exploited and instructions on how to protect against it.
Search Known Exploits
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 22-01
(BOD) 22-01 is a directive issued by the Cybersecurity and Infrastructure Security Agency (CISA) in the United States to federal agencies and federal contractors in order to improve their cybersecurity practices. It provides a set of guidelines and requirements that these agencies and contractors must follow to increase their defenses against cyber threats.
Loading...
Cyber Security News
You may have missed...
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
The SolarWinds Hack Was More Humiliating for the Government Than We Thought
But we now have a few more crumbs to work with, because new revelations from Bloomberg have revealed that the hackers were in Treasury Department ...
Wi-Fi controlled hacking USB cable stealthily packs in a microcontroller, microSD storage, and more
... cybersecurity learners'. News. By Mark Tyson published 12 hours ago. The $82 Hacknect 'looks like a normal USB cable' and its makers are enjoying ...
Dragos: Putting Operational Technology Risks in Perspective | Cybersecurity Magazine
In this Cyber Magazine Q&A, Magpie Graham, VP Strategic Intelligence at Dragos, examines the evolving OT threat landscape and key operational ...
France Accounts for 70% of Global Crypto Wrench Attacks, Says Joe Nakamoto | KuCoin
Why This Story Matters for Crypto Security. Wrench attacks occupy a different threat category than the digital exploits most crypto users prepare for.
The Biggest Crypto Hacks Since 2025, Ranked by Money Lost
Analysis of the largest crypto hacks including KelpDAO and Drift, showing how attackers compromised third-party systems and verification mechanisms.
Iranian Hackers Using Fake Job Sites to Breach Defense Firms - GovInfoSecurity
Hackers nudged victims into downloading malicious survey files or bundled job application documents embedded with malware, which in some cases were .....
Iranian Hackers Using Fake Job Sites to Breach Defense Firms - BankInfoSecurity
Researchers generally haven't seen evidence of cyberwar from Tehran nation-state hackers although Iranian cyber proxies quickly swung into action with...
Hacker breaks into Hartford HealthCare user accounts, accessing 22500 people's info
— Hartford HealthCare's payment accounts on the HUSKY provider portal website were hacked in March, as a criminal accessed the personal information of...
Updated daily