Security services · Products · Sourced intelligence

Complex threats.
Clear next moves.

Expert services, focused products and practical research. Connect your security priorities to the next action that matters.

Explore our services Talk to an expert

48 services across six disciplinesCVE intelligence sourced from CISA, NVD and FIRSTNo invented statistics

Live evidence · last 7 daysRefreshed Nov 5, 2026

3,078CVEs published (NVD)

40with a public PoC on GitHub

1,728in CISA's exploited catalog

CVE-2026-109518
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and…
CVSS 7.7
CVE-2026-54161
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM,…
CVSS 8.1
CVE-2026-44267
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts construc…
CVSS 9.8

Sources: NVD · CISA KEV · FIRST EPSS · PoC-in-GitHubOpen the feed

01 / Our services

Start with the challenge.
Find the right expertise.

Full service directory

01Offensive security 02AI security 03Cloud & identity 04Detection & response 05Advisory & governance 06Security engineering

A more focused starting point

Find the paths worth closing.

Examine your applications, APIs and infrastructure. Turn technical findings into focused remediation decisions.

Vulnerability assessment & testing API security testing Explore this discipline →

02 / Our products

Two products.
A place for each.

Explore the collection ↗

SECURELINE / GRCProduct introduction

Governance,
with a clearer view.

Explore Secureline GRC and its public product portal. Start a conversation about the workflow your organisation needs.

ControlsEvidenceRisksAudits

Explore Secureline GRC ↗

SECURELINE / PROMPTGATEProduct introduction

A distinct product.
Its own conversation.

A dedicated place for Promptgate, separate from the service directory. Contact Secureline for confirmed product details.

Meet Promptgate ↗

03 / The research journal

A closer look.
A clearer perspective.

Browse the journal ↗

READING NOTEFrom the Secureline blog

Why annual VAPT
is not enough in 2026.

A source-linked reading note on the gap between periodic testing and the way applications, identities and infrastructure actually change.

Read the note ↗

PROPOSED WHITEPAPERDraft outline

From a finding to
a business decision.

An editorial outline connecting vulnerability evidence, business context, remediation ownership and verification.

Explore the outline ↗

04 / Evidence, with context

Look past the headline.

Source-backed vulnerability records and clearly labelled research. No simulated alerts. No invented attack counters.

Explore CVE intelligence Latest CVEs and public PoCs

The last 7 days, in proportion

All

3,078

Listed

300

PoC

KEV

All: CVEs published to the NVD in the window. Listed: the ones shown on the latest-CVEs page (every CVE with a public PoC or in CISA KEV, then the highest CVSS scores). PoC: at least one public GitHub repository names the CVE. KEV: added to CISA's exploited catalog. The separate KEV snapshot holds 1,728 records (source updated Sep 27, 2026). None of this measures your exposure.

The next move starts
with the right conversation.

Discuss your requirements ↗

Complex threats.Clear next moves.

Start with the challenge.Find the right expertise.

Find the paths worth closing.

Two products.A place for each.

Governance,with a clearer view.

A distinct product.Its own conversation.

A closer look.A clearer perspective.

Why annual VAPTis not enough in 2026.

From a finding toa business decision.