Known Exploited Vulnerabilities and counting....
A known exploited vulnerability (KEV) refers to a software vulnerability that is being actively exploited by cybercriminals or threat actors. When a vulnerability becomes known to be exploited in the wild, it signals that the vulnerability poses a significant and imminent risk to organizations.
Cybersecurity Brief: May 21, 2026
AI-driven threats are forcing a fundamental shift in vulnerability timelines, according to F5 CEO Francois Locoh-Donou, who warns that attackers are now exploiting security flaws before they're publicly disclosed. This accelerated threat tempo represents a significant operational challenge for defenders who traditionally relied on disclosure windows to patch systems. The observation aligns with growing concerns that AI capabilities are tilting the advantage toward adversaries in the vulnerability discovery race.
In software supply chain security, researchers have identified over 600 malicious packages published to the Node Package Manager (npm) registry in a campaign dubbed "Shai-Hulud." The attack represents another large-scale attempt to poison the open-source ecosystem that millions of developers depend on daily. Meanwhile, Microsoft has open-sourced two security tools—RAMPART and Clarity—designed to help developers build more secure AI agents during the development phase, addressing emerging risks in AI system architecture.
President Trump is expected to sign an executive order as soon as Thursday focused on AI cybersecurity, according to multiple sources. While details remain limited, the directive appears aimed at strengthening cybersecurity practices around artificial intelligence systems amid increasing political attention to AI risks.
Sources: CNBC · The Hacker News · Bloomberg · BleepingComputer
Common Vulnerability and Exposure
CVEs form a database of known security vulnerabilities that are actively tracked and managed by a group of organizations, such as the U.S. National Cyber Security Alliance. CVEs are an important tool for network security management because they not only provide an inventory of existing vulnerabilities, but also provide information about how the vulnerability can be exploited and instructions on how to protect against it.
Search Known Exploits
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 22-01
(BOD) 22-01 is a directive issued by the Cybersecurity and Infrastructure Security Agency (CISA) in the United States to federal agencies and federal contractors in order to improve their cybersecurity practices. It provides a set of guidelines and requirements that these agencies and contractors must follow to increase their defenses against cyber threats.
Loading...
Cyber Security News
You may have missed...
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
A Ransomware Negotiator Was Working for a Ransomware Gang
A ransomware negotiator pleaded guilty to secretly working for a ransomware gang while negotiating payments for clients, exploiting insider knowledge ...
Law enforcement shuts down VPN service used by two dozen ransomware gangs
“Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other ...
GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos
GitHub confirmed that attackers breached its private code repositories after an employee installed a malicious VS Code extension compromised in the Ta...
GitHub Hacked, Internal Repositories Offered for Sale - BankInfoSecurity
GitHub warned late Tuesday that hackers stole roughly 3800 internal repositories from the Microsoft-owned platform after a developer used a ...
Ukraine probes teen suspect in cyber theft scheme targeting California online shoppers
The investigation began after U.S. authorities informed their Ukrainian counterparts that hackers operating from Ukraine could be involved in ...
Microsoft warns hackers are exploiting password resets to gain access to user accounts
A hacking group known as Storm-2949 is abusing the password reset feature in Microsoft's services to steal people's login credentials, access ...
Student hackers take on 'ethical battle' beyond cyber attacks and exploits - ABC News
Student hackers compete in the International Cybersecurity Challenge 2026, an ethical hacking contest simulating real cyber attacks and defences ...
Securing the American Experience - CISA
Over the last year, CISA completed physical and cybersecurity vulnerability assessments at World Cup host stadiums, FIFA basecamps, team hotels, and ....
Updated daily