CVE-2026-71384: Incorrect Authorization in Adobe ColdFusion Leading to DoS
A CVSS 9.6 incorrect authorization vulnerability in Adobe ColdFusion that could cause application denial-of-service. Fixed in versions 2025.0.12 and 2023.0.23.
Live cyber intelligence board
Track CVEs, attack groups, malware, vendors and training in one place.
CybersecurityBoard.com brings together vulnerability intelligence, security news, MITRE ATT&CK group profiles, cyber events, certifications, training, products, companies and service providers.
Latest Critical CVEs
All CVEs →CVE-2026-71362: Privilege Escalation in Adobe Commerce
A CVSS 9.1 incorrect authorization vulnerability in Adobe Commerce that could lead to privilege escalation.
CVE-2026-71398: Critical Authorization Flaw in Adobe Campaign Classic
A CVSS 10.0 incorrect authorization vulnerability in Adobe Campaign Classic that could allow arbitrary code execution. Fixed in ACC v7 7.4.4 build…
CVE-2026-27302: Critical Authorization Flaw in Adobe Campaign Classic
A CVSS 10.0 incorrect authorization vulnerability in Adobe Campaign Classic that could allow arbitrary code execution. Fixed in ACC v7 7.4.4 build…
CVE-2026-48381: SQL Injection in Adobe Campaign Classic
A CVSS 9.0 SQL injection vulnerability in Adobe Campaign Classic that could lead to arbitrary code execution. Fixed in ACC v7 7.4.4…
Adobe Patches Critical ColdFusion and Campaign Classic Flaws with Multiple CVSS 10.0 Ratings
Adobe has released security updates addressing multiple critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic. The most severe include three CVSS 10.0…
Latest Cyber News
All news →737 Chrome VPN Extensions Caught Routing Traffic Through Proxies: What You Need to Know
A massive operation involving 737 free VPN and proxy extensions on the Chrome Web Store has been uncovered, primarily targeting Russian-speaking users…
Enterprise Defenses Recover at the Edge but Collapse Inside: Picus Blue Report 2026
The Picus Blue Report 2026, based on over 338 million attack simulations in production environments, reveals a split in enterprise defense effectiveness.…
OpenAI, Anthropic, Google API Flaw Lets Weaker AI Models Decode Stronger Models’ Reasoning
A newly disclosed flaw in the way OpenAI, Anthropic, and Google handle hidden AI reasoning between API calls allowed researchers to recover…
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Two malicious LiteLLM releases on PyPI, versions 1.82.7 and 1.82.8, were live for about 40 minutes on March 24, 2026, carrying credential-stealing…
OpenAI Unveils GPT-5.6-Cyber: Reduced Safeguards for Exploit Development and Vulnerability Research
OpenAI has launched GPT-5.6-Cyber, a specialized cybersecurity model designed for vulnerability research, penetration testing, and incident response. Built on the GPT-5.6 Sol…
Researchers Pose as Fake Crypto Startup to Hire Suspected North Korean IT Workers
Security researchers created a fictitious cryptocurrency startup and hired three individuals they believe were North Korean IT operatives, as part of an…
Latest Attack Groups
MITRE groups →PurpleHaze: Threat Cluster Using GoReShell Backdoor
PurpleHaze is a threat cluster disclosed by SentinelOne in April 2025. It targeted a South Asian government supporting entity with a Windows…
UNC6780 — Attack group profile
UNC6780 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Chaotic Eclipse: Security Researcher Behind ShieldBreak and LegacyHive
Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse, is a security researcher who disclosed multiple Windows vulnerabilities, including CVE-2026-50656 (RoguePlanet),…
Kimwolf — Attack group profile
Kimwolf was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Latest Malware
Malware →Play Ransomware: Prevention Rates Collapse in 2026
Play ransomware is a notorious ransomware family. According to the Blue Report 2026, prevention effectiveness against Play dropped from 50% to 13%,…
GoReShell: Windows Backdoor Using Reverse SSH
GoReShell is a Windows backdoor used by the PurpleHaze threat cluster. It leverages functionalities from the reverse_ssh tool to establish reverse SSH…
reverse_ssh: Open-Source Tool for Reverse SSH Tunnels
reverse_ssh is an open-source tool used to establish SSH connections to threat actor-controlled infrastructure. It enables outbound connections, bypassing inbound security controls.…
Kimwolf v7 Android Botnet Uses HTTP/2 to Evade DDoS Detection
Cybersecurity researchers have uncovered a new version of the Kimwolf/AISURU Android and IoT botnet, tracked as Kimwolf v7, which introduces significant enhancements…
Events, Certifications & Training
Explore →Microsoft August 2026 Patch Tuesday Addresses 421 Flaws
Microsoft's August 2026 Patch Tuesday included patches for 421 security flaws, including 236 in Windows, and addressed critical vulnerabilities such as CVE-2026-50656,…
USENIX WOOT Conference
USENIX WOOT is a security conference where the research on SIM card attacks was presented. The paper highlights the attack surface of…
GIAC Certified Incident Handler (GCIH)
The GCIH certification demonstrates proficiency in incident handling and response, often pursued after SANS SEC504 training.
EAL6+: High Security Certification for Secure Element Chips
EAL6+ is a high assurance level under the Common Criteria certification, indicating strong resistance to tampering. The Samsung S3D232A chip in Tangem…
SEC660 Course Update Integrates AI Automation with Manual Exploit Skills
The SEC660 course at SANS Network Security 2026 teaches how to leverage AI for automating tasks while maintaining deep manual understanding of…
SANS SEC504: Hacker Tools, Techniques, and Incident Handling
SANS SEC504 is a training course covering hacker tools, techniques, and incident handling, leading to GCIH certification.
Products, Services & Companies
Browse market →Chrome Web Store — Cybersecurity product profile
Chrome Web Store was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news,…
1.1.1.1 — Cybersecurity product profile
1.1.1.1 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Outline — Cybersecurity product profile
Outline was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
AI Sidebar Chrome Extension: Clean-then-Poisoned Update
This Chrome extension was removed for prompt poaching but returned with a monetization scheme. It opens affiliate links in foreground tabs on…
AdGuard VPN — Cybersecurity company profile
AdGuard VPN was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Browsec — Cybersecurity company profile
Browsec was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
CyberGhost — Cybersecurity company profile
CyberGhost was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Windscribe — Cybersecurity company profile
Windscribe was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Vultr: Cloud Infrastructure Provider
Vultr is a cloud infrastructure provider that was used to host the fake crypto startup's infrastructure in the undercover operation. The researchers…
Gorilla Servers: Hosting Provider Used in Undercover Operation
Gorilla Servers is a hosting provider that was used in the undercover operation to host infrastructure. The researchers noted that the operatives'…
Bugcrowd: Crowdsourced Security Platform
Bugcrowd is a crowdsourced security platform that facilitated the disclosure of the RovoBlast vulnerability in Atlassian Rovo. The platform rated the issue…
Poison Claude: Discounted AI Access with Privacy Risks
Poison Claude is an underground service selling discounted access to Anthropic's Claude models. It operates as a proxy, giving the operator full…