Every published advisory, newest first. Use search to filter by vendor, industry, country or severity.
On 2026-07-16, CISA added CVE-2026-58644 (Microsoft SharePoint) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-07-16, CISA added CVE-2026-39808 (Fortinet FortiSandbox) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-07-16, CISA added CVE-2026-25089 (Fortinet FortiSandbox) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-07-14, CISA added CVE-2026-56164 (Microsoft SharePoint Server) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-07-14, CISA added CVE-2026-15410 (SonicWall SMA1000 Appliances) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-07-14, CISA added CVE-2026-15409 (SonicWall SMA1000 Appliances) to its Known Exploited Vulnerabilities (KEV) catalog .
According to BleepingComputer, German supermarket chain Lidl notified customers in Germany, Belgium and the Netherlands that attackers stole their personal information in a breach at a service provider; according to 01net, some French customers were also affected .
On 2026-07-13, CISA added CVE-2008-4128 (Cisco IOS) to its Known Exploited Vulnerabilities (KEV) catalog .
CVERC warned it captured Android trojans in China posing as education and training apps, which after installation trick users into granting background-run and accessibility permissions .
On 2026-07-01, CISA added CVE-2026-45659 (Microsoft SharePoint Server) to its Known Exploited Vulnerabilities (KEV) catalog .
According to Cybernews, Nissan North America was targeted in an attack campaign against Oracle PeopleSoft, with its US division systems breached between May 27 and June 9, 2026, and it has begun notifying employees .
On 2026-06-25, CISA added CVE-2026-20230 (Cisco Unified Communications Manager) to its Known Exploited Vulnerabilities (KEV) Catalog .
On 2026-06-25, CISA added CVE-2026-12569 (PTC Windchill and FlexPLM) to its Known Exploited Vulnerabilities (KEV) catalog .
Texas Parks and Wildlife Department said Texas Cyber Command detected an incident on May 13 at its hunting and fishing license system vendor, and an unauthorized actor may have obtained driver license information, passport numbers, emails, phone numbers and addresses of more than 3 million license customers .
According to DSIH, Pulsy, the Grand Est regional e-health operator, was attacked on June 18, 2026, leading to exfiltration of about 5 million rows of patient administrative data including names, sex, birth dates and the national health identifier INS .
According to TechCrunch, market intelligence platform Klue confirmed hackers broke into its systems on June 12 and stole data from some customers, with affected customers including Gong, Jamf, HackerOne, LastPass, Recorded Future, Snyk and Tanium .
According to Pakistan Today, citing Capital Development Authority (CDA) officials and its spokesperson, the agency's property, conservancy, and water billing system suffered a cyberattack that disrupted online payment services .
According to CyberInsider, data was downloaded without authorization from cardiac monitoring firm iRhythm's third-party-hosted business applications between June 3 and 8, 2026; its June 15 SEC filing says access came through social engineering and an attacker demanded payment on June 9 .
According to a client notice from AXIA Asset Management, an external IT service provider of V-Bank was hit by a cyberattack on June 10, 2026, leading to unauthorized access to V-Bank data .
On 2026-06-15, CISA added CVE-2026-20262 (Cisco Catalyst SD-WAN Manager) to its Known Exploited Vulnerabilities (KEV) catalog .