Australian Cyber Security Centre Issues
ACSC warns over a campaign targeting organizations which uses ClickFix to deliver Vidar infostealer malware
2026 Data Breaches Year-to-Date (747 indexed)
BerriAI LiteLLM
BerriAI LiteLLM SQL Injection Vulnerability — BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized acces
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability — Ivanti
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability — Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with adm
Woflow
447,593 records exposed — Email addresses, Names, Phone numbers, Physical addresses
View incident → Indexed 2 months ago
LegionProxy
10,144 records exposed — Email addresses, Names, Passwords, Purchases
Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability — Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an un
Rapid7
Rapid7 reveals an Iranian false flag operation masquerading as a Chaos ransomware attack
Vimeo
119,167 records exposed — Email addresses, Names
ISACA report
ISACA report warns that while AI has become the norm, many organizations are yet to formally apply safety or security policies around its use
Marcus & Millichap
1,837,078 records exposed — Email addresses, Employers, Job titles, Names and 2 more
ZenBusiness
5,118,184 records exposed — Email addresses, Names, Phone numbers
View incident → Indexed 2 months, 1 week ago
Linux Kernel
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability — Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Aman
215,563 records exposed — Dates of birth, Email addresses, Genders, Language preferences and 6 more
View incident → Indexed 2 months, 1 week ago
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability — WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerabil
Microsoft Windows
Microsoft Windows Protection Mechanism Failure Vulnerability — Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
ConnectWise ScreenConnect
ConnectWise ScreenConnect Path Traversal Vulnerability — ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and cri
Pitney Bowes
8,243,989 records exposed — Email addresses, Job titles, Names, Phone numbers and 1 more
View incident → Indexed 2 months, 2 weeks ago
ADT
5,488,888 records exposed — Dates of birth, Email addresses, Names, Partial government issued IDs and 2 more
View incident → Indexed 2 months, 2 weeks ago
Udemy
1,401,259 records exposed — Email addresses, Employers, Job titles, Names and 3 more
View incident → Indexed 2 months, 2 weeks ago
SimpleHelp SimpleHelp
SimpleHelp Path Traversal Vulnerability — SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip).
Carnival
7,531,359 records exposed — Dates of birth, Email addresses, Genders, Geographic locations and 3 more
SimpleHelp SimpleHelp
SimpleHelp Missing Authorization Vulnerability — SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be
Samsung MagicINFO 9 Server
Samsung MagicINFO 9 Server Path Traversal Vulnerability — Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
D-Link DIR-823X
D-Link DIR-823X Command Injection Vulnerability — D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to