Top 5

Vulnerabilities & Breaches

Weekly Briefing

Top 5 Hacker-Relevant Vulnerabilities

Ranked from a decision-tree-based prioritization model trained on over 100,000 vulnerabilities, extending CVSS and EPSS with real-time attacker context.

Calendar Week 43 2026 · What you actually need to patch
0 Scanned
0 Critical or high (CVSS)
0 Hacker-relevant
01

PHP

Unauthenticated Remote Attack · Use After Free

CVE-2026-109618, CVE-2026-109619

Details PoC
02

GitLab CE/EE

Unauthenticated Remote Attack · Integer Overflow

CVE-2026-110264

Details PoC
03

Google Brotli

Unauthenticated Remote Attack · Buffer Overflow

CVE-2026-111497

Details PoC
04

Cisco Unified Communications Manager

Unauthenticated Remote Attack · Improper Authentication

CVE-2026-76474

Details
05

Drupal Webform

Unauthenticated Remote Attack · Code Injection

CVE-2026-96355

Details
CVSS distribution
387 critical 1513 high 1613 medium 256 low
View vulnerabilities from previous weeks

Monthly Briefing

Top 5 Recent Breaches

The five most recent breaches from our monthly recap of security incidents caused by unpatched, hacker-relevant vulnerabilities.

  • September 2026

    Dutch Institute for Vulnerability Disclosure (DIVD)

    An AI agent broke into the Dutch security nonprofit DIVD through two vulnerabilities in its Zammad support ticketing system, reached other internal services and copied data within minutes, before network separation and a fast response stopped it

    Exploited by Likely an autonomous AI agent Zammad · Session Hijacking and Remote Code Execution CVE-2026-102489, CVE-2026-102490 Report
  • August 2026

    Philips

    Cl0p exploited an unauthenticated input-validation flaw in PTC Windchill and FlexPLM to compromise an internal Philips server and exfiltrate data, naming Philips alongside Shell, GE, and Fiserv on its leak site as part of a wider campaign against exposed PLM instances

    Exploited by Cl0p Ransomware PTC Windchill and FlexPLM · Improper Input Validation CVE-2026-12569 Report
  • July 2026

    University of Nottingham

    ShinyHunters exploited an Oracle PeopleSoft PeopleTools vulnerability to access the University of Nottingham's student records system, exposing data on 454,600 current and former students as part of a wider campaign spanning over 300 PeopleSoft instances

    Exploited by ShinyHunters Oracle PeopleSoft · Remote Code Execution CVE-2026-35273 Report
  • June 2026

    Nissan

    ShinyHunters exploited a missing-authentication flaw in Oracle PeopleSoft to access personal data of current and former Nissan employees across the US, Canada, Mexico, and Brazil, as part of a wider campaign claiming over 300 compromised PeopleSoft instances

    Exploited by ShinyHunters Oracle PeopleSoft · Missing Authentication CVE-2026-35273 Report
  • May 2026

    Grafana Labs

    Attackers exfiltrated Grafana Labs' entire private GitHub codebase after a supply-chain compromise of 42 @tanstack/* npm packages leaked a GitHub workflow token that was missed during rotation

    Exploited by TeamPCP (UNC6780) GitHub Actions · Malicious npm packages CVE-2026-45321 Report
View breaches from previous months

Don't be the next name on this list

Book a Demo