Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1071

T1071Application Layer Protocol

T1071 — Application Layer Protocol is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 13 detection use cases covering it and 433 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
13Use cases
433Articles
5Sub-techniques
1Tactic

Sub-techniques (5)

T1071.004 · DNST1071.002 · File Transfer ProtocolsT1071.003 · Mail ProtocolsT1071.005 · Publish/Subscribe ProtocolsT1071.001 · Web Protocols

Use cases covering this technique (13)

Network connections to article IPs / domains Internal c2 · alerting DSΣP [WEEKLY] Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) Internal exploit · alerting DSPDD [WEEKLY] Gitea Service Account Post-Exploitation: git/gitea Spawning Interpreters or Egressing to Cloud Metadata Internal exploit · alerting DSΣPDDCS Windows App Layer Protocol Qakbot NamedPipe ESCU actions · hunting P Windows App Layer Protocol Wermgr Connect To NamedPipe ESCU actions · hunting P Windows Application Layer Protocol RMS Radmin Tool Namedpipe ESCU actions · alerting P Cisco Secure Firewall - High Priority Intrusion Classification ESCU actions · alerting P Cisco Secure Firewall - High Volume of Intrusion Events Per Host ESCU actions · hunting P [LLM] Hardcoded WebSocket backdoor to 154.92.19.71:39989 (no DNS) Bespoke c2 · hunting DSΣPDDCS [LLM] ZT-IP hunt: direct-to-IP egress with no preceding DNS resolution Bespoke c2 · hunting DSPDDCS [LLM] SprySOCKS (FishMonger/I-SOON) C2 beacon to hardcoded Vultr IPs 207.148.78.36 / 207.148.75.122 Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound C2 to sfrclak.com / 142.11.206.73:8000 (Axios npm RAT beacon) Bespoke c2 · alerting DSΣPDDCS [LLM] CircleCI breach C2 egress to potrax[.]com and 8 hardcoded attacker IPs Bespoke c2 · hunting DSΣPCSCW

Articles citing this technique (433)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
high Hacker claims 3.6 million Azure account records stolen from major companies art-06
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
high Philips and GE investigating Clop ransomware data theft claims art-22
med French tax authority data breach affects 678,000 individuals art-24
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
high SafePal data breach impacts 39,798 customers, stolen info for sale art-30
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35
crit New Evooo1Bot Linux botnet turns routers into traffic relay nodes art-36
high Top enterprise SCA tools in 2026 art-39
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
high Armored Likho expands its cyber-espionage toolkit art-62
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
med Control Which Package Registries Your CI Jobs and Developer Machines Use art-65
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part art-87
high Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection art-91
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure art-98
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Why metaphor may dictate your security strategy art-110
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm art-120
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit CISA KEV: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability art-141
crit CISA KEV: CVE-2026-18577 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability art-149
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit Anthropic's Fever Dream: Claude's package that stole real keys art-156
crit Network Anomaly Detection in KATA art-159
crit Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan art-163
crit You were onto something with “It’s the Climb,” Miley art-165
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-182
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
crit Don’t swing at everything art-213
crit Russian Global Webmail Espionage art-217
high Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel art-218
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-221
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-222
high The upgrade trap: when upgrading is the wrong answer to a CVE art-225
crit CISA KEV: CVE-2026-16232 — Check Point SmartConsole Improper Authentication Vulnerability art-226
crit [GHSA / CRITICAL] CVE-2026-20896: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user vi art-230
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-245
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-246
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-257
high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-258
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high AsyncAPI npm packages backdoored via GitHub Actions art-276
crit CISA KEV: CVE-2026-15409 — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability art-281
crit CISA KEV: CVE-2026-15410 — SonicWall SMA1000 Appliances Code Injection Vulnerability art-282
high How Aikido Intel detects malware and vulnerabilities first art-284
crit What is a dependency firewall? art-287
crit jscrambler npm package publishes malicious preinstall binary art-290
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-292
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-308
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-309
crit ESET Threat Report H1 2026 art-312
crit CISA KEV: CVE-2026-48908 — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability art-315
crit CISA KEV: CVE-2026-55255 — Langflow Authorization Bypass Through User-Controlled Key Vulnerability art-316
crit CISA KEV: CVE-2026-48282 — Adobe ColdFusion Path Traversal Vulnerability art-318
high Cyber readiness for SMBs: Getting the basics right art-322
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-324
crit Secure Registry now tells you which machine pulled a compromised package art-326
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-327
high Maven Support Comes to GitHub Checks and OSS Package Search art-328
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-332
high npm now freezes high-impact accounts after risky account changes art-340
med Packagist is now protected by Aikido Intel and other updates to the PHP registry art-343
high Everybody's shipping code they can't read art-345
crit CISA KEV: CVE-2026-12569 — PTC Windchill and FlexPLM Improper Input Validation Vulnerability art-347
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
high When a vendor's breach becomes yours: lessons from the Klue incident art-356
crit CISA KEV: CVE-2025-67038 — Lantronix EDS5000 Code Injection Vulnerability art-357
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-362
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-364
high The full Snyk AI Security Platform, free for open source maintainers art-367
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Multiple JetBrains IDE plugins caught stealing AI keys art-374
med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-375
crit CISA KEV: CVE-2026-48907 — Widget Factory Joomla Content Editor Improper Access Control Vulnerability art-376
high EvilTokens: A phishing attack that doesn’t steal your password art-377
crit CISA KEV: CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability art-384
high npm v12 delivers one of the biggest security improvements in years art-385
crit OceanLotus: From external espionage to domestic targeting art-388
high Code is being written everywhere, and the device is the only constant art-390
crit Compromised Rust crate onering performs code exfiltration art-392
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-397
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-404
high Why EDR and proxy won’t save you from supply chain malware art-415
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-417
crit CISA KEV: CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability art-431
high What MDM can't protect on developer machines (and what to do about it) art-432
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
crit CISA KEV: CVE-2026-45321 — TanStack Unspecified Vulnerability art-440
crit CISA KEV: CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code Vulnerability art-441
high Why developer machines are now the number one target for supply chain attacks art-442
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-443
crit Laravel Lang Supply Chain Advisory art-445
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-447
med Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise art-448
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-458
crit Webworm: New burrowing techniques art-459
crit CISA KEV: CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability art-464
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-472
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-477
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-486
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-504
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining art-521
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
crit GopherWhisper: A burrow full of malware art-529
crit CISA KEV: CVE-2026-39987 — Marimo Remote Code Execution Vulnerability art-532
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-562
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-566
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-572
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-578
high You Patched LiteLLM, But Do You Know Your AI Blast Radius? art-579
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-591
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-592
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-596
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-598
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-623
high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package art-627
crit CISA KEV: CVE-2025-26399 — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability art-631
crit PlugX Meeting Invitation via MSBuild and GDATA art-648
high How “Clinejection” Turned an AI Bot into a Supply Chain Attack art-661
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-697
crit DynoWiper update: Technical analysis and attribution art-717
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-782
high SHA1-Hulud, npm supply chain incident art-796
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803
crit CISA KEV: CVE-2025-21042 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-817
crit CISA KEV: CVE-2025-11371 — Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability art-822
crit CISA KEV: CVE-2025-24893 — XWiki Platform Eval Injection Vulnerability art-824
crit CISA KEV: CVE-2025-54236 — Adobe Commerce and Magento Improper Input Validation Vulnerability art-827
crit CISA KEV: CVE-2025-59287 — Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability art-828
crit CISA KEV: CVE-2025-61932 — Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability art-831
crit CISA KEV: CVE-2025-61884 — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability art-836
crit Phishing Campaign Leveraging the NPM Ecosystem art-846
crit CISA KEV: CVE-2025-27915 — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability art-848
crit CISA KEV: CVE-2010-3962 — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability art-850
crit CISA KEV: CVE-2010-3765 — Mozilla Multiple Products Remote Code Execution Vulnerability art-854
crit CISA KEV: CVE-2025-61882 — Oracle E-Business Suite Unspecified Vulnerability art-855
crit CISA KEV: CVE-2025-21043 — Samsung Mobile Devices Out-of-Bounds Write Vulnerability art-859
crit CISA KEV: CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability art-864
high Malicious MCP Server on npm postmark-mcp Harvests Emails art-867
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
crit CISA KEV: CVE-2025-5086 — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability art-876
high npm Supply Chain Attack via Open Source maintainer compromise art-878
crit CISA KEV: CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability art-882
crit CISA KEV: CVE-2013-3893 — Microsoft Internet Explorer Resource Management Errors Vulnerability art-902
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917
crit CISA KEV: CVE-2025-49704 — Microsoft SharePoint Code Injection Vulnerability art-922
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-924
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-925
crit CISA KEV: CVE-2025-47812 — Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability art-927
crit CISA KEV: CVE-2023-33538 — TP-Link Multiple Routers Command Injection Vulnerability art-948
crit CISA KEV: CVE-2025-33053 — Microsoft Windows External Control of File Name or Path Vulnerability art-954
crit CISA KEV: CVE-2025-24016 — Wazuh Server Deserialization of Untrusted Data Vulnerability art-955
crit CISA KEV: CVE-2024-42009 — RoundCube Webmail Cross-Site Scripting Vulnerability art-956
crit CISA KEV: CVE-2025-32433 — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability art-957
crit CISA KEV: CVE-2021-32030 — ASUS Routers Improper Authentication Vulnerability art-967
crit CISA KEV: CVE-2025-35939 — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability art-969
crit CISA KEV: CVE-2023-39780 — ASUS RT-AX55 Routers OS Command Injection Vulnerability art-971
crit CISA KEV: CVE-2024-27443 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-981
crit CISA KEV: CVE-2025-27920 — Srimax Output Messenger Directory Traversal Vulnerability art-982
crit CISA KEV: CVE-2024-11182 — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability art-983
crit CISA KEV: CVE-2025-4428 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-984
crit CISA KEV: CVE-2025-4427 — Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability art-985
crit CISA KEV: CVE-2024-12987 — DrayTek Vigor Routers OS Command Injection Vulnerability art-987
crit CISA KEV: CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability art-988
crit CISA KEV: CVE-2024-11120 — GeoVision Devices OS Command Injection Vulnerability art-997
crit CISA KEV: CVE-2024-6047 — GeoVision Devices OS Command Injection Vulnerability art-998
crit CISA KEV: CVE-2025-3248 — Langflow Missing Authentication Vulnerability art-1001
crit CISA KEV: CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability art-1007
crit CISA KEV: CVE-2025-3928 — Commvault Web Server Unspecified Vulnerability art-1011
crit CISA KEV: CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability art-1013
crit CISA KEV: CVE-2021-20035 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-1017
crit CISA KEV: CVE-2025-29824 — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability art-1021
crit CISA KEV: CVE-2025-30406 — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability art-1022
crit CISA KEV: CVE-2025-31161 — CrushFTP Authentication Bypass Vulnerability art-1023
crit CISA KEV: CVE-2025-2783 — Google Chromium Mojo Sandbox Escape Vulnerability art-1030
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1042
crit CISA KEV: CVE-2025-21590 — Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability art-1046
crit CISA KEV: CVE-2025-26633 — Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability art-1057
crit CISA KEV: CVE-2024-57968 — Advantive VeraCore Unrestricted File Upload Vulnerability art-1061
crit CISA KEV: CVE-2025-25181 — Advantive VeraCore SQL Injection Vulnerability art-1062
crit CISA KEV: CVE-2023-20118 — Cisco Small Business RV Series Routers Command Injection Vulnerability art-1074
crit Do not pass GO - Malicious Package Alert art-1090
crit CISA KEV: CVE-2024-41710 — Mitel SIP Phones Argument Injection Vulnerability art-1092
crit CISA KEV: CVE-2025-0994 — Trimble Cityworks Deserialization Vulnerability art-1097
crit CISA KEV: CVE-2024-50603 — Aviatrix Controllers OS Command Injection Vulnerability art-1118
crit CISA KEV: CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1125
crit CISA KEV: CVE-2023-48365 — Qlik Sense HTTP Tunneling Vulnerability art-1126
crit CISA KEV: CVE-2021-44207 — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability art-1137
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1144
crit CISA KEV: CVE-2024-20767 — Adobe ColdFusion Improper Access Control Vulnerability art-1146
crit CISA KEV: CVE-2024-50623 — Cleo Multiple Products Unrestricted File Upload Vulnerability art-1147
high Ultralytics AI Pwn Request Supply Chain Attack art-1149
crit CISA KEV: CVE-2024-9474 — Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability art-1171
crit CISA KEV: CVE-2024-0012 — Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability art-1172
crit CISA KEV: CVE-2024-43451 — Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability art-1183
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1184
crit CISA KEV: CVE-2024-8956 — PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability art-1189
crit CISA KEV: CVE-2024-37383 — RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability art-1195
crit CISA KEV: CVE-2024-47575 — Fortinet FortiManager Missing Authentication Vulnerability art-1198
crit CISA KEV: CVE-2024-38094 — Microsoft SharePoint Deserialization Vulnerability art-1201
crit CISA KEV: CVE-2024-9680 — Mozilla Firefox Use-After-Free Vulnerability art-1209
crit CISA KEV: CVE-2024-9380 — Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability art-1214
crit CISA KEV: CVE-2024-23113 — Fortinet Multiple Products Format String Vulnerability art-1216
crit CISA KEV: CVE-2024-45519 — Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability art-1222
crit CISA KEV: CVE-2023-25280 — D-Link DIR-820 Router OS Command Injection Vulnerability art-1229
crit CISA KEV: CVE-2024-8963 — Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability art-1236
crit CISA KEV: CVE-2014-0497 — Adobe Flash Player Integer Underflow Vulnerablity art-1246
crit CISA KEV: CVE-2024-8190 — Ivanti Cloud Services Appliance OS Command Injection Vulnerability art-1250
crit CISA KEV: CVE-2024-40766 — SonicWall SonicOS Improper Access Control Vulnerability art-1255
crit CISA KEV: CVE-2024-7262 — Kingsoft WPS Office Path Traversal Vulnerability art-1261
crit CISA KEV: CVE-2024-7971 — Google Chromium V8 Type Confusion Vulnerability art-1270
crit CISA KEV: CVE-2018-0824 — Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability art-1294
crit CISA KEV: CVE-2024-28995 — SolarWinds Serv-U Path Traversal Vulnerability art-1308
crit CISA KEV: CVE-2024-34102 — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability art-1309
crit CISA KEV: CVE-2024-36401 — OSGeo GeoServer GeoTools Eval Injection Vulnerability art-1310
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1319
crit CISA KEV: CVE-2024-4577 — PHP-CGI OS Command Injection Vulnerability art-1335
crit CISA KEV: CVE-2017-3506 — Oracle WebLogic Server OS Command Injection Vulnerability art-1342
crit CISA KEV: CVE-2024-24919 — Check Point Quantum Security Gateways Information Disclosure Vulnerability art-1345
crit CISA KEV: CVE-2024-4978 — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability art-1347
crit CISA KEV: CVE-2024-4947 — Google Chromium V8 Type Confusion Vulnerability art-1354
crit CISA KEV: CVE-2024-20359 — Cisco ASA and FTD Privilege Escalation Vulnerability art-1375
crit CISA KEV: CVE-2024-20353 — Cisco ASA and FTD Denial of Service Vulnerability art-1376
crit CISA KEV: CVE-2024-3400 — Palo Alto Networks PAN-OS Command Injection Vulnerability art-1385
crit CISA KEV: CVE-2024-3273 — D-Link Multiple NAS Devices Command Injection Vulnerability art-1387
crit CISA KEV: CVE-2023-48788 — Fortinet FortiClient EMS SQL Injection Vulnerability art-1398
crit CISA KEV: CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass Vulnerability art-1419
crit CISA KEV: CVE-2024-21351 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1429
crit CISA KEV: CVE-2023-22527 — Atlassian Confluence Data Center and Server Template Injection Vulnerability art-1439
crit CISA KEV: CVE-2018-15133 — Laravel Deserialization of Untrusted Data Vulnerability art-1451
crit CISA KEV: CVE-2023-46805 — Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability art-1454
crit CISA KEV: CVE-2023-29300 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1460
crit CISA KEV: CVE-2023-38203 — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability art-1461
crit CISA KEV: CVE-2023-7101 — Spreadsheet::ParseExcel Remote Code Execution Vulnerability art-1465
crit CISA KEV: CVE-2023-49897 — FXC AE1021, AE1021PE OS Command Injection Vulnerability art-1470
crit CISA KEV: CVE-2023-47565 — QNAP VioStor NVR OS Command Injection Vulnerability art-1471
crit CISA KEV: CVE-2023-41266 — Qlik Sense Path Traversal Vulnerability art-1482
crit CISA KEV: CVE-2023-41265 — Qlik Sense HTTP Tunneling Vulnerability art-1483
crit CISA KEV: CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability art-1510
crit CISA KEV: CVE-2023-47246 — SysAid Server Path Traversal Vulnerability art-1522
med Real-time threat protection with Snyk and SentinelOne art-1528
crit CISA KEV: CVE-2023-22518 — Atlassian Confluence Data Center and Server Improper Authorization Vulnerability art-1534
crit CISA KEV: CVE-2023-46604 — Apache ActiveMQ Deserialization of Untrusted Data Vulnerability art-1539
crit CISA KEV: CVE-2023-5631 — Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability art-1544
crit CISA KEV: CVE-2023-20273 — Cisco IOS XE Web UI Command Injection Vulnerability art-1552
crit CISA KEV: CVE-2023-20198 — Cisco IOS XE Web UI Privilege Escalation Vulnerability art-1556
crit CISA KEV: CVE-2023-22515 — Atlassian Confluence Data Center and Server Broken Access Control Vulnerability art-1569
crit CISA KEV: CVE-2023-40044 — Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability art-1570
crit CISA KEV: CVE-2023-42793 — JetBrains TeamCity Authentication Bypass Vulnerability art-1575
crit CISA KEV: CVE-2023-41991 — Apple Multiple Products Improper Certificate Validation Vulnerability art-1585
crit CISA KEV: CVE-2023-41992 — Apple Multiple Products Kernel Privilege Escalation Vulnerability art-1586
crit CISA KEV: CVE-2023-33246 — Apache RocketMQ Command Execution Vulnerability art-1612
crit CISA KEV: CVE-2023-27532 — Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability art-1626
high .NET developers alert: Moq NuGET package exfiltrates user emails from git art-1633
crit CISA KEV: CVE-2023-37580 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1650
crit CISA KEV: CVE-2023-3519 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability art-1660
crit CISA KEV: CVE-2023-36884 — Microsoft Windows Search Remote Code Execution Vulnerability art-1664
crit CISA KEV: CVE-2022-29303 — SolarView Compact Command Injection Vulnerability art-1666
crit CISA KEV: CVE-2023-32049 — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability art-1671
crit CISA KEV: CVE-2019-17621 — D-Link DIR-859 Router Command Execution Vulnerability art-1678
crit CISA KEV: CVE-2019-20500 — D-Link DWL-2600AP Access Point Command Injection Vulnerability art-1679
crit CISA KEV: CVE-2023-32434 — Apple Multiple Products Integer Overflow Vulnerability art-1690
crit CISA KEV: CVE-2023-2868 — Barracuda Networks ESG Appliance Improper Input Validation Vulnerability art-1730
crit CISA KEV: CVE-2023-25717 — Multiple Ruckus Wireless Products CSRF and RCE Vulnerability art-1750
crit CISA KEV: CVE-2023-27350 — PaperCut MF/NG Improper Access Control Vulnerability art-1778
crit CISA KEV: CVE-2023-28252 — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability art-1793
crit CISA KEV: CVE-2021-27876 — Veritas Backup Exec Agent File Access Vulnerability art-1798
crit CISA KEV: CVE-2021-27877 — Veritas Backup Exec Agent Improper Authentication Vulnerability art-1799
crit CISA KEV: CVE-2021-27878 — Veritas Backup Exec Agent Command Execution Vulnerability art-1800
crit CISA KEV: CVE-2022-27926 — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability art-1812
crit CISA KEV: CVE-2022-22706 — Arm Mali GPU Kernel Driver Unspecified Vulnerability art-1823
crit The rising trend of malicious packages in open source ecosystems art-1827
crit CISA KEV: CVE-2023-23397 — Microsoft Office Outlook Privilege Escalation Vulnerability art-1834
crit CISA KEV: CVE-2022-41328 — Fortinet FortiOS Path Traversal Vulnerability art-1836
crit CISA KEV: CVE-2022-36537 — ZK Framework AuUploader Unspecified Vulnerability art-1852
crit CISA KEV: CVE-2022-47966 — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability art-1884
crit CISA KEV: CVE-2022-41080 — Microsoft Exchange Server Privilege Escalation Vulnerability art-1892
high Supply chain security incident at CircleCI: Rotate your secrets art-1895
crit CISA KEV: CVE-2022-42475 — Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability art-1912
med Fetch the Flag CTF 2022 writeup: Disposable Message art-1944
high Fetch the Flag CTF 2022 writeup: Treasure Trove art-1947
high Fetch the Flag CTF 2022 writeup: Moongoose art-1948
high Fetch the Flag CTF 2022 writeup: File Explorer art-1950
crit CISA KEV: CVE-2022-41128 — Microsoft Windows Scripting Languages Remote Code Execution Vulnerability art-1956
high Avoiding SMTP Injection: A Whitebox primer art-2029
crit CISA KEV: CVE-2022-24706 — Apache CouchDB Insecure Default Initialization of Resource Vulnerability art-2068
crit CISA KEV: CVE-2022-2294 — WebRTC Heap Buffer Overflow Vulnerability art-2071
crit How open source C++ code can introduce security risks art-2082
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
crit CISA KEV: CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability art-2123
crit CISA KEV: CVE-2022-29499 — Mitel MiVoice Connect Data Validation Vulnerability art-2132
crit CISA KEV: CVE-2012-0754 — Adobe Flash Player Memory Corruption Vulnerability art-2171
crit CISA KEV: CVE-2011-2462 — Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability art-2173
crit CISA KEV: CVE-2022-26134 — Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability art-2188
crit CISA KEV: CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability art-2199
crit CISA KEV: CVE-2013-0074 — Microsoft Silverlight Double Dereference Vulnerability art-2221
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2226
crit CISA KEV: CVE-2016-4657 — Apple iOS Webkit Memory Corruption Vulnerability art-2243
crit CISA KEV: CVE-2016-3298 — Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability art-2246
crit CISA KEV: CVE-2019-13720 — Google Chrome WebAudio Use-After-Free Vulnerability art-2259
crit CISA KEV: CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability art-2260
crit Targeted npm dependency confusion attack caught red-handed art-2296
crit CISA KEV: CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability art-2321
crit CISA KEV: CVE-2022-22954 — VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability art-2330
crit CISA KEV: CVE-2018-7602 — Drupal Core Remote Code Execution Vulnerability art-2333
crit CISA KEV: CVE-2017-11317 — Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability art-2350
crit CISA KEV: CVE-2022-22965 — Spring Framework JDK 9+ Remote Code Execution Vulnerability art-2360
crit Spring4Shell: What we know about the Java RCE vulnerability art-2368
crit CISA KEV: CVE-2018-10562 — Dasan GPON Routers Command Injection Vulnerability art-2374
crit CISA KEV: CVE-2022-0543 — Debian-specific Redis Server Lua Sandbox Escape Vulnerability art-2379
crit CISA KEV: CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability art-2391
crit CISA KEV: CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability art-2392
crit CISA KEV: CVE-2021-22941 — Citrix ShareFile Improper Access Control Vulnerability art-2414
crit CISA KEV: CVE-2020-9054 — Zyxel Multiple NAS Devices OS Command Injection Vulnerability art-2416
crit CISA KEV: CVE-2018-8373 — Microsoft Scripting Engine Memory Corruption Vulnerability art-2435
high Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine art-2482
crit CISA KEV: CVE-2019-1132 — Microsoft Win32k Privilege Escalation Vulnerability art-2490
crit CISA KEV: CVE-2019-11581 — Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability art-2512
med Adding Container and IaC security to the Snyk plugin for Jetbrains art-2519
crit CISA KEV: CVE-2015-3043 — Adobe Flash Player Memory Corruption Vulnerability art-2583
crit CISA KEV: CVE-2013-3897 — Microsoft Internet Explorer Use-After-Free Vulnerability art-2593
crit CISA KEV: CVE-2013-1347 — Microsoft Internet Explorer Remote Code Execution Vulnerability art-2596
crit CISA KEV: CVE-2011-0611 — Adobe Flash Player Remote Code Execution Vulnerability art-2607
crit CISA KEV: CVE-2022-24682 — Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability art-2622
crit CISA KEV: CVE-2017-8570 — Microsoft Office Remote Code Execution Vulnerability art-2623
crit Magento security requires additional patch to fix sanitization vulnerability art-2627
crit CVE-2022-24086 Vulnerability alert for websites using Magento Ecommerce art-2633
crit CISA KEV: CVE-2022-24086 — Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability art-2639
crit CISA KEV: CVE-2022-0609 — Google Chromium Animation Use-After-Free Vulnerability art-2640
crit CISA KEV: CVE-2017-9841 — PHPUnit Command Injection Vulnerability art-2645
crit CISA KEV: CVE-2017-10271 — Oracle Corporation WebLogic Server Remote Code Execution Vulnerability art-2658
crit CISA KEV: CVE-2017-0263 — Microsoft Win32k Privilege Escalation Vulnerability art-2659
crit CISA KEV: CVE-2015-2051 — D-Link DIR-645 Router Remote Code Execution Vulnerability art-2664
crit Stranger Danger: Live hack of how a Log4Shell exploit works art-2688
crit CISA KEV: CVE-2018-8453 — Microsoft Win32k Privilege Escalation Vulnerability art-2692
crit CISA KEV: CVE-2021-35247 — SolarWinds Serv-U Improper Input Validation Vulnerability art-2693
med New years resolution: Don’t show my security tokens when hacking my demo application on stage art-2713
crit CISA KEV: CVE-2021-36260 — Hikvision Improper Input Validation art-2718
crit CISA KEV: CVE-2019-2725 — Oracle WebLogic Server, Injection art-2722
crit CISA KEV: CVE-2019-9670 — Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference art-2723
crit CISA KEV: CVE-2019-10149 — Exim Mail Transfer Agent (MTA) Improper Input Validation art-2727
crit CISA KEV: CVE-2021-35394 — Realtek Jungle SDK Remote Code Execution Vulnerability art-2762
high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2773
crit CISA KEV: CVE-2021-27104 — Accellion FTA OS Command Injection Vulnerability art-2803
crit CISA KEV: CVE-2021-27102 — Accellion FTA OS Command Injection Vulnerability art-2804
crit CISA KEV: CVE-2021-27101 — Accellion FTA SQL Injection Vulnerability art-2805
crit CISA KEV: CVE-2021-27103 — Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability art-2806
crit CISA KEV: CVE-2018-4878 — Adobe Flash Player Use-After-Free Vulnerability art-2811
crit CISA KEV: CVE-2021-30713 — Apple macOS Unspecified Vulnerability art-2838
crit CISA KEV: CVE-2021-30657 — Apple macOS Unspecified Vulnerability art-2839
crit CISA KEV: CVE-2021-30869 — Apple iOS, iPadOS, and macOS Type Confusion Vulnerability art-2843
crit CISA KEV: CVE-2021-26084 — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability art-2850
crit CISA KEV: CVE-2020-3452 — Cisco ASA and FTD Read-Only Path Traversal Vulnerability art-2854
crit CISA KEV: CVE-2018-0171 — Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability art-2858
crit CISA KEV: CVE-2019-19781 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability art-2869
crit CISA KEV: CVE-2020-25506 — D-Link DNS-320 Device Command Injection Vulnerability art-2872
crit CISA KEV: CVE-2020-8515 — Multiple DrayTek Vigor Routers Web Management Page Vulnerability art-2876
crit CISA KEV: CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability art-2917
crit CISA KEV: CVE-2021-31955 — Microsoft Windows Kernel Information Disclosure Vulnerability art-2925
crit CISA KEV: CVE-2021-31199 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2932
crit CISA KEV: CVE-2021-31956 — Microsoft Windows NTFS Privilege Escalation Vulnerability art-2934
crit CISA KEV: CVE-2021-31201 — Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability art-2935
crit CISA KEV: CVE-2017-7269 — Microsoft Windows Server Buffer Overflow Vulnerability art-2943
crit CISA KEV: CVE-2021-34473 — Microsoft Exchange Server Remote Code Execution Vulnerability art-2950
crit CISA KEV: CVE-2021-1732 — Microsoft Win32k Privilege Escalation Vulnerability art-2952
crit CISA KEV: CVE-2019-18935 — Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability art-3012
crit CISA KEV: CVE-2020-10148 — SolarWinds Orion Authentication Bypass Vulnerability art-3036
crit CISA KEV: CVE-2021-35211 — SolarWinds Serv-U Remote Code Execution Vulnerability art-3037
crit CISA KEV: CVE-2020-12271 — Sophos SFOS SQL Injection Vulnerability art-3043
crit CISA KEV: CVE-2017-9248 — Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability art-3047
crit CISA KEV: CVE-2019-16759 — vBulletin PHP Module Remote Code Execution Vulnerability art-3062
crit CISA KEV: CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability art-3071
crit CISA KEV: CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability art-3072
crit CISA KEV: CVE-2019-9978 — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability art-3073
crit CISA KEV: CVE-2020-10189 — Zoho ManageEngine Desktop Central File Upload Vulnerability art-3076
med SnykCon 2021 excitement is starting, but the CFP is ending (soon) art-3148