HomeAlerts & Advisories

Stay up to date on the latest risks, threats, and product vulnerabilities.

Our analysts and researchers unpack emerging vulnerabilities as they happen, to guide clients on how best to react and respond.

Aware of an incident impacting your organization? Let us know:

Report an incident
Filter by year
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
January 8, 2026

Critical Vulnerability in n8n (CVE-2026-21858)

On January 6th, 2026, CVE-2026-21858 was published by n8n, followed shortly by articles by Dor Attias and Cyera documenting critical flaws in n8n's request parsing. The vulnerability allows an unauthenticated attacker to exfiltrate sensitive data, which can lead to full compromise of the n8n system.

2026-01-08
December 29, 2025

Critical Vulnerability in SmarterMail (CVE-2025-52691)

On December 28, 2025, NIST published a critical file upload vulnerability affecting SmarterTools SmarterMail server. The flaw, documented as CVE-2025-52691, carries a maximum CVSS score of 10 and allows remote unauthenticated attackers the ability to upload malicious files to the mail server, potentially leading to remote code execution.

2025-12-29
December 27, 2025

Critical Information Disclosure Vulnerability in MongoDB (CVE-2025-14847)

On December 19th, software company MongoDB published an advisory regarding a critical vulnerability (tracked as CVE-2025-14847) in their popular database engine of the same name. The vulnerability is an information disclosure issue that allows a successful unauthenticated attacker to leak portions of host memory on a victim machine, potentially disclosing sensitive data such as authentication material.

2025-12-27
December 16, 2025

Critical Auth Bypass Vulnerabilities in Fortinet Products Under Active Exploitation (CVE-2025-59718 & CVE-2025-59719)

On December 9th, Fortinet’s PSIRT team publicly released an advisory to address critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) in multiple Fortinet products (FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb) when FortiCloud single sign-on (SSO) is enabled.

2025-12-16
December 3, 2025

Critical Vulnerabilities in React and Next.js (React2Shell)

UPDATED - Original patches mitigating React2Shell properly address Remote Code Execution (RCE) but are still vulnerable to information leakage and DoS issues - To address recently disclosed vulnerabilities, React have released patches which should be applied ASAP. If your organization previously updated to React 19.0.2, 19.1.3, and 19.2.2, these are incomplete and organizations will need to update again. On December 3rd, open-source web software library React disclosed a critical vulnerability in the React Server Components (RSC) “Flight” protocol impacting the React 19 ecosystem and frameworks that implement it React and Next.js are widely used across the internet and therefore this vulnerability requires immediate action.

2025-12-03
November 25, 2025

Critical Vulnerability in Oracle OIM Under Active Exploitation

Successful exploitation allows attackers to remotely execute remote code on the Identity Manager server due to a lack of validation in how certain REST requests are processed. Once compromised, attackers can gain full control of the system.

2025-11-25
November 11, 2025

Critical Vulnerability Reported in Citrix NetScaler ADC and Gateway (CVE-2025-12101)

This bug is a cross-site scripting (XSS) vulnerability on NetScaler ADC or NetScaler Gateway devices when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

2025-11-11
October 25, 2025

Critical Microsoft WSUS Vulnerability Being Exploited In-The-Wild (CVE-2025-59287)

On October 23rd, Microsoft issued an out-of-band security update to address a previously reported vulnerability identified as CVE-2025-59287. This vulnerability affects the Windows Server Update Service (WSUS) component and may allow unauthorized attackers to execute remote code on WSUS servers.

2025-10-25
October 20, 2025

Critical Vulnerability in Squid Web Proxy (CVE-2025-62168)

On October 17th, open-source web proxy project Squid published an advisory concerning an information disclosure vulnerability in their popular Squid proxy software.

2025-10-20
October 16, 2025

Critical Vulnerabilities in F5 BIG-IP Products

On October 15th, vendor F5 publicly disclosed a security breach impacting their internal environment and resulting in a threat actor exfiltrating sensitive data about their BIG-IP product line.

2025-10-16
There are no available Alerts & Advisories matching the current filters.
Reset All

Suffering from an incident and need help?

Activate our IR Team