Every published advisory, newest first. Use search to filter by vendor, industry, country or severity.
According to Yonhap News TV, Day One Company, operator of Fastcampus and other online education brands, said a GitHub master account key was stolen and used for a first intrusion into its services on May 9, 2026 .
On 2026-06-11, CISA added CVE-2026-10520 (Ivanti Sentry) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-06-09, CISA added CVE-2026-20245 (Cisco Catalyst SD-WAN Manager) to its Known Exploited Vulnerabilities (KEV) Catalog .
According to Argaam, citing a filing by Budget Saudi to the Saudi Exchange, unauthorized access occurred affecting a subset of customer data on its mobile application .
ST Unitas, operator of the Gongdangi exam-prep brands, announced on June 8, 2026 that some members' personal data leaked through unauthorized access to its operating system .
On 2026-06-08, CISA added CVE-2026-50751 (Check Point Security Gateway) to its Known Exploited Vulnerabilities (KEV) catalog .
According to The HIPAA Journal, US dental benefits administrator DentaQuest's network was accessed without authorization between May 17 and 20, 2026; the company says at least 15 million people are affected, with names, addresses, SSNs, Medicaid and Medicare numbers and dental or vision health information involved .
A joint government-civilian team under Korea's science ministry confirmed data from 39.
According to German public broadcaster SWR, SLK-Kliniken Heilbronn issued a public statement regarding stolen patient data .
China’s National Computer Network Emergency Response Technical Team (CNCERT) warned on 1 June that some home users, after joining their router’s Wi-Fi, were being redirected to illegal pages such as pornography or gambling when they visited ordinary sites or ran a connectivity check, and that the cause was tampered DNS settings on home routers and similar devices .
According to Argaam, citing an announcement from BinDawood Holding, the company contained a limited breach involving a subset of customer order data on its mobile application .
On 2026-05-29, CISA added CVE-2026-0257 (Palo Alto Networks PAN-OS) to its Known Exploited Vulnerabilities (KEV) catalog .
According to BleepingComputer, Carnival began notifying 5,995,277 people that attackers used social engineering in April to deceive an employee, accessed part of its IT systems and stole personal data, which the company confirmed was copied on April 22 .
On 2026-05-27, CISA added CVE-2026-48027 (Nx Nx Console) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-05-27, CISA added CVE-2026-45321 (TanStack TanStack) to its Known Exploited Vulnerabilities (KEV) catalog .
Listed company ADDCN (5287) said on 26 May 2026 that during internal campaign-page development and testing on 25 May, misconfigured source-code handling briefly pushed some non-de-identified test source to an external platform, including names, national ID numbers and email addresses of members in a specific project .
According to franceinfo, French health third-party payment operator Almerys confirmed on May 25 a cyberattack giving unauthorized access to the care-authorization (PEC) site used by health professionals, which was shut down; VIASANTÉ Mutuelle says the intrusion followed the hijacking of a health professional's account .
China's National Computer Virus Emergency Response Center (CVERC) warned it captured malware named after "internal investigation results", "disciplinary lists" and "layoff compensation", which are new variants of the Silver Fox Windows remote-control trojan .
On 2026-05-15, CISA added CVE-2026-42897 (Microsoft Microsoft) to its Known Exploited Vulnerabilities (KEV) catalog .
SYLA Holdings Co.