Every published advisory, newest first. Use search to filter by vendor, industry, country or severity.
Japan's Digital Agency said on September 11 that its Government Solution Service (GSS) was accessed without authorization: on June 25 it detected mass file access using a maintenance account, and on July 9 confirmed a third party had entered through a VPN device vulnerability .
According to iThome, DR.
On 2026-09-11, CISA added CVE-2026-85706 (GitLab Community Edition and Enterprise Edition) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-11, CISA added CVE-2026-84869 (ConnectWise ScreenConnect) to its Known Exploited Vulnerabilities (KEV) catalog .
According to iThome, on the evening of September 9, TPEx-listed taxi dispatch service provider Taiwan Taxi (2640) issued a material announcement on the Market Observation Post System (MOPS), stating that the information systems of its subsidiary Global Business Technology suffered a cyberattack and that the company immediately activated its cybersecurity incident response mechanism upon discovering the attack on certain information systems .
On 2026-09-09, CISA added CVE-2026-19490 (Citrix NetScaler) to its Known Exploited Vulnerabilities (KEV) Catalog .
On 2026-09-09, CISA added CVE-2026-20079 (Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management) to its Known Exploited Vulnerabilities (KEV) Catalog .
On 2026-09-09, CISA added CVE-2025-25249 (Fortinet Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
According to fuitededonnées.
Veradigm told the SEC that one of its third-party vendors suffered a cybersecurity incident in which an unauthorized party obtained credentials to a Veradigm API from the vendor's environment, affecting data of a small number of customers .
According to BleepingComputer, an Advance Passenger Information System (APIS) database linked to a Vietnamese organization was accessible online through chained misconfigurations, holding about 220 million passenger and crew records from January 2017 to April 2026, including passport numbers and flight details .
According to iThome, some servers at Fullerton Technology subsidiary GDC Holdings were hit by a ransomware attack on September 7 .
Meteor GmbH said unknown attackers breached its IT systems on the night of August 11, 2026, encrypted data with malware, copied data and are threatening to publish it online .
Weverse, the fan platform of South Korea's HYBE, said that on September 3 the Korea Internet & Security Agency told it an outside party had reported a vulnerability, and an inspection confirmed data of 422,584 accounts leaked .
Mathspace said attackers exploited a vulnerability in its self-hosted Metabase internal reporting system to gain admin access, with access dating back to August 10 and data downloaded from its Australian reporting database on August 27; Metabase had released patches on August 6, but Mathspace only updated on August 29 .
IDScan.
According to iThome, on the evening of September 2, TPEx-listed semiconductor equipment manufacturer Innovation Service (7828) issued a cybersecurity material announcement on the Market Observation Post System (MOPS), stating that it detected a ransomware attack on some of its servers and immediately activated defense mechanisms, network disconnection, and isolation measures upon detecting the anomaly, while launching cybersecurity incident response procedures to comprehensively review security systems and strengthen protections .
According to iThome, on the evening of September 1, emerging stock semiconductor IP company InPsytech (7898) issued a cybersecurity material announcement on the Market Observation Post System (MOPS), stating that its ERP system suffered a hacker encryption attack; after its information security unit detected anomalies in the ERP system and confirmed an encryption attack, it immediately launched comprehensive inspections, incident investigations, and protective operations, and is continuing to verify the scope of impact and conduct root cause analysis .
On 2026-09-02, CISA added CVE-2026-83549 (SonicWall SMA1000 Appliances) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-02, CISA added CVE-2026-83548 (SonicWall SMA1000 Appliances) to its Known Exploited Vulnerabilities (KEV) catalog .