Alerts & Advisories

Missing Encryption Vulnerability in Apache Tomcat

Attackers can exploit a missing encryption vulnerability in Apache Tomcat to bypass the EncryptInterceptor, potentially exposing sensitive data transmitted between cluster nodes. Patch immediately.

Multiple Vulnerabilities in Cisco IOS XE Software

Multiple vulnerabilities have been identified in Cisco IOS XE Software that could allow attackers to execute arbitrary commands, bypass security controls, gain unauthorised access, disclose sensitive information, or affect the operation of vulnerable systems. Patch immediately.

Multiple Vulnerabilities in Cisco Catalyst SD-WAN Software

Attackers can exploit multiple vulnerabilities in Cisco Catalyst SD-WAN Software to bypass security controls, gain unauthorised access, access or manipulate files, and disclose sensitive information. Patch immediately.

CatchPulse – Multiple Vulnerabilities including Improper Access Control, Unprivileged SYSTEM-Level Operations and Denial of Service

Multiple vulnerabilities have been discovered in CatchPulse. SecureAge, the product owner, has rolled out fixes for all reported vulnerabilities. Special thanks to the informer and SecureAge for coordinating through CSA's Responsible Vulnerability Disclosure Policy.

Active exploitation of Critical Vulnerability in IBM Langflow OSS

Attackers are actively exploiting a critical vulnerability in IBM Langflow OSS to achieve unauthenticated remote code execution (RCE). Users and administrators of affected products are advised to apply the latest security updates immediately.

Ongoing npm Supply Chain Attack Affecting Keyv and Related Packages ("Shai-Hulud" Worm)

Security researchers have identified an active software supply chain attack involving malicious versions of Keyv and related npm packages. The Shai-Hulud malware steals developer credentials and spreads by compromising additional packages. Organisations using Node.js should immediately review their dependencies and treat credentials on affected systems as potentially compromised.

Critical Vulnerability in cPanel & WHM

Authenticated attackers can exploit a critical vulnerability in cPanel & WHM to gain database root privileges and potentially compromise other customers hosted on the same server. Patch immediately.

Multiple Critical Vulnerabilities in VMware Products

Attackers can exploit multiple vulnerabilities in VMware products to bypass authentication, execute arbitrary code, access sensitive information or cause denial-of-service. Patch immediately.

Security Bulletin 5 Aug 2026 [PDF, 2MB]

Active Exploitation of Vulnerability in Cisco Secure Firewall Management Center

Attackers are exploiting a medium-severity vulnerability in Cisco Secure Firewall Management Center to log in and access sensitive data. Patch immediately.