Security services · Products · Sourced intelligence Complex threats.Clear next moves. Expert services, focused products and practical research. Connect your security priorities to the next action that matters.
48 services across six disciplines CVE intelligence sourced from CISA, NVD and FIRST No invented statistics
Live evidence · 7 days · 6-hour sync Last sync Nov 9, 2026, 12:22 PM UTC
3,329 CVEs published (NVD)
41 with a public PoC on GitHub
1,769 in CISA's exploited catalog
CVE-2026-123753 Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Not scored CVE-2026-99273 In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation. Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
Not scored CVE-2026-121265 SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value. An application that passes request data as column values to insert or update with the default options allows SQL injection. Releases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to.
Not scored From the research desk The patch is available. Is the exposure closed?Why zero-day response and everyday remediation belong together.
Read the source record ↗ 02 / Our products SECURELINE / GRC Product introduction
Governance, Explore Secureline GRC and its public product portal. Start a conversation about the workflow your organisation needs.
Controls Evidence Risks Audits
Explore Secureline GRC ↗ SECURELINE / PROMPTGATE Product introduction
A distinct product. A dedicated place for Promptgate, separate from the service directory. Contact Secureline for confirmed product details.
Meet Promptgate ↗ 03 / The research journal READING NOTE From the Secureline blog
Why annual VAPT A source-linked reading note on the gap between periodic testing and the way applications, identities and infrastructure actually change.
Read the note ↗ PROPOSED WHITEPAPER Draft outline
From a finding to An editorial outline connecting vulnerability evidence, business context, remediation ownership and verification.
Explore the outline ↗ 04 / Evidence, with context Look past the headline. Source-backed vulnerability records and clearly labelled research. No simulated alerts. No invented attack counters.
The last 7 days, in proportion
All: CVEs published to the NVD in the window. Listed: the ones shown on the latest-CVEs page (every CVE with a public PoC or in CISA KEV, then the highest CVSS scores). PoC: at least one public GitHub repository names the CVE. KEV: added to CISA's exploited catalog. The separate KEV snapshot holds 1,769 records (source updated Nov 6, 2026). None of this measures your exposure.