Vulnerabilities coverage from Threat Times holds 431 articles, 7 of them reference guides. The newest was published on October 13, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include OWASP Top Ten and FIRST: Common Vulnerability Scoring System.
A newly published critical vulnerability in Siemens Industrial Edge Device Kit - arm64 V1.10 carries a CVSS score of 9.1. Here is what is affected and how to respond.
A newly published critical vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF carries a CVSS score of 9.6. Here is what is affected and how to respond.
A newly published critical vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF carries a CVSS score of 9.6. Here is what is affected and how to respond.
A newly published critical vulnerability in Siemens SIMATIC Drive Controller CPU 1504D TF carries a CVSS score of 9.6. Here is what is affected and how to respond.
A new survey reveals cybersecurity leaders are calling in sick or taking leave to evade the stress of monthly security update deployments.
Researchers found that npm’s Trusted Publishing feature allowed attackers to publish malicious updates without stealing credentials by claiming abandoned repository names.
The National Vulnerability Database lists a critical OS command injection flaw in Wavlink router firmware, noting that the exploit has been published and the vendor was notified early.
The National Vulnerability Database lists a CVSS 10 critical flaw in Wavlink WL-WN530BE1-A firmware version 251117, allowing remote attackers to exploit a buffer overflow via HTTP headers.
A newly published critical vulnerability in Wavlink WL-WN530BE1-A carries a CVSS score of 9.4. Here is what is affected and how to respond.
Broadcom’s VMware introduces a new security add-on to help customers cope with the surge of monthly patches driven by AI vulnerability discovery.
A security researcher found that Google’s developer documentation sites exposed an OAuth secret that allowed unauthenticated remote code execution via pickle deserialization.
A critical vulnerability in D-Link’s DCS-930L allows remote attackers to bypass cryptographic signature verification via the emergency recovery server.
Experts argue that decades of security experience can help prevent irreversible consequences in the emerging AI landscape.
IBM released patches for 22 vulnerabilities in Verify Access, addressing two critical remote code execution bugs that require no authentication.
Booz Allen demonstrated that frontier AI models can autonomously breach industrial control systems and manipulate physical equipment within minutes.
Unauthenticated attackers are actively exploiting a critical server-side request forgery flaw in SonicWall appliances, shortly after public disclosure.
A critical vulnerability in Perforce Helix Authentication Service allows attackers to exploit default credentials and chain flaws for remote code execution.
Security experts revealed four vulnerabilities in LG smart TVs that allow remote attackers to bypass authentication and execute commands as root.
Threat actors are currently targeting a maximum-severity server-side request forgery vulnerability in SonicWall SMA 1000 network security appliances.
A critical vulnerability in SAP Manufacturing Integration and Intelligence lets administrators gain full control of the underlying Java application server.
A critical vulnerability in SAP S/4HANA allows authenticated attackers with specific privileges to execute arbitrary ABAP code via crafted input.
A critical authorization bypass in SAP NetWeaver Visual Composer 7.50 lets attackers invoke internal operations on remote systems, risking full compromise.
A vulnerability in the SAP Cloud SDK for Python allows attackers to redirect token requests, leading to credential theft in multi-tenant BTP applications.
A critical vulnerability in the Metasploit Framework Web Service allows unauthenticated users to read, modify, or delete stored credentials without any authentication checks.