Every published advisory, newest first. Use search to filter by vendor, industry, country or severity.
On 2026-02-18, CISA added CVE-2021-22175 (GitLab GitLab) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-02-13, CISA added CVE-2026-1731 (BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)) to its Known Exploited Vulnerabilities (KEV) catalog .
In a third report on 31 March, Mynavi said it detected an anomaly on 5 December 2025 in a cloud service it uses and immediately blocked external access, and that on 16 January 2026 it confirmed unauthorized third-party access may have caused some personal data of general users, corporate contacts, and company and group employees to leak .
Dutch telecom Odido said a cyberattack involved personal data from a customer contact system it uses, not passwords, call records or billing data, and that it notified the Dutch data protection authority AP .
According to News1, health supplement and cosmetics maker Kim Jeong Mun Aloe told customers it detected an external intrusion on its server on January 27, 2026, with data of customers of a shopping site closed in 2012 suspected leaked .
DBsense said many marketers reported impersonation calls citing their platform nicknames, and it judged that member nicknames and mobile numbers had very likely leaked through an abnormal route .
On 2026-02-05, CISA added CVE-2026-24423 (SmarterTools SmarterMail) to its Known Exploited Vulnerabilities (KEV) catalog .
Anabuki Housing Group said in its 6th official update that ransomware hit some of its servers on 3 February 2026, and that the number of personal records that may have leaked is now confirmed at 207,773 .
On 2026-02-03, CISA added CVE-2021-39935 (GitLab Community and Enterprise Editions) to its Known Exploited Vulnerabilities (KEV) catalog .
According to CyberInsider, Panera Bread suffered a breach in January 2026 exposing 14 million customer records containing 5.
According to The Korea Times, Seoul Facilities Corporation, which runs the Ttareungyi bike service, said on January 30 it was told by police that data of about 4.
On 2026-01-29, CISA added CVE-2026-1281 (Ivanti Endpoint Manager Mobile (EPMM)) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-01-27, CISA added CVE-2026-24858 (Fortinet Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-01-26, CISA added CVE-2026-23760 (SmarterTools SmarterMail) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-01-26, CISA added CVE-2025-52691 (SmarterTools SmarterMail) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-01-23, CISA added CVE-2024-37079 (Broadcom VMware vCenter Server) to its Known Exploited Vulnerabilities (KEV) catalog .
According to CyberInsider and The Register, Have I Been Pwned added data allegedly from Under Armour affecting about 72 million email addresses and personal details, after the Everest ransomware group claimed the company in late 2025 .
On 2026-01-21, CISA added CVE-2026-20045 (Cisco Unified Communications Manager) to its Known Exploited Vulnerabilities (KEV) Catalog .
According to BleepingComputer, Endesa and its Energía XXI operator notified customers that hackers accessed the company's systems and obtained contract-related personal data .
According to BleepingComputer, South Korean education group Kyowon confirmed a ransomware attack in which data was exfiltrated and is investigating with authorities whether customer information was included .