Security services · Products · Sourced intelligence

Complex threats.
Clear next moves.

Expert services, focused products and practical research. Connect your security priorities to the next action that matters.

Explore our services Talk to an expert

48 services across six disciplinesCVE intelligence sourced from CISA, NVD and FIRSTNo invented statistics

Live evidence · 7 days · 6-hour syncLast sync Nov 14, 2026, 12:23 AM UTC

5,191CVEs published (NVD)

67with a public PoC on GitHub

1,781in CISA's exploited catalog

CVE-2026-119077
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.
CVSS 9.8
CVE-2026-107360
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
CVSS 9.6
CVE-2026-0101
Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsanitized input, potentially resulting in a system crash or denial of service.
CVSS 6.8

Sources: NVD · CISA KEV · FIRST EPSS · PoC-in-GitHubOpen the feed

01 / Our services

Start with the challenge.
Find the right expertise.

Full service directory

01Offensive security 02AI security 03Cloud & identity 04Detection & response 05Advisory & governance 06Security engineering

A more focused starting point

Find the paths worth closing.

Examine your applications, APIs and infrastructure. Turn technical findings into focused remediation decisions.

Vulnerability assessment & testing API security testing Explore this discipline →

02 / Our products

Two products.
A place for each.

Explore the collection ↗

SECURELINE / GRCProduct introduction

Governance,
with a clearer view.

Explore Secureline GRC and its public product portal. Start a conversation about the workflow your organisation needs.

ControlsEvidenceRisksAudits

Explore Secureline GRC ↗

SECURELINE / PROMPTGATEProduct introduction

A distinct product.
Its own conversation.

A dedicated place for Promptgate, separate from the service directory. Contact Secureline for confirmed product details.

Meet Promptgate ↗

03 / The research journal

A closer look.
A clearer perspective.

Browse the journal ↗

READING NOTEFrom the Secureline blog

Why annual VAPT
is not enough in 2026.

A source-linked reading note on the gap between periodic testing and the way applications, identities and infrastructure actually change.

Read the note ↗

PROPOSED WHITEPAPERDraft outline

From a finding to
a business decision.

An editorial outline connecting vulnerability evidence, business context, remediation ownership and verification.

Explore the outline ↗

04 / Evidence, with context

Look past the headline.

Source-backed vulnerability records and clearly labelled research. No simulated alerts. No invented attack counters.

Explore CVE intelligence Latest CVEs and public PoCs

The last 7 days, in proportion

All

5,191

Listed

300

PoC

KEV

All: CVEs published to the NVD in the window. Listed: the ones shown on the latest-CVEs page (every CVE with a public PoC or in CISA KEV, then the highest CVSS scores). PoC: at least one public GitHub repository names the CVE. KEV: added to CISA's exploited catalog. The separate KEV snapshot holds 1,781 records (source updated Nov 13, 2026). None of this measures your exposure.

The next move starts
with the right conversation.

Discuss your requirements ↗

Complex threats.Clear next moves.

Start with the challenge.Find the right expertise.

Find the paths worth closing.

Two products.A place for each.

Governance,with a clearer view.

A distinct product.Its own conversation.

A closer look.A clearer perspective.

Why annual VAPTis not enough in 2026.

From a finding toa business decision.