Security services · Products · Sourced intelligence Complex threats.Clear next moves. Expert services, focused products and practical research. Connect your security priorities to the next action that matters.
48 services across six disciplines CVE intelligence sourced from CISA, NVD and FIRST No invented statistics
Live evidence · 7 days · 6-hour sync Last sync Nov 7, 2026, 12:22 PM UTC
3,038 CVEs published (NVD)
37 with a public PoC on GitHub
1,769 in CISA's exploited catalog
CVE-2026-84473 Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.
Not scored CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
CVSS 9.3 CVE-2026-114630 The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a…
CVSS 9.1 From the research desk The patch is available. Is the exposure closed?Why zero-day response and everyday remediation belong together.
Read the source record ↗ 02 / Our products SECURELINE / GRC Product introduction
Governance, Explore Secureline GRC and its public product portal. Start a conversation about the workflow your organisation needs.
Controls Evidence Risks Audits
Explore Secureline GRC ↗ SECURELINE / PROMPTGATE Product introduction
A distinct product. A dedicated place for Promptgate, separate from the service directory. Contact Secureline for confirmed product details.
Meet Promptgate ↗ 03 / The research journal READING NOTE From the Secureline blog
Why annual VAPT A source-linked reading note on the gap between periodic testing and the way applications, identities and infrastructure actually change.
Read the note ↗ PROPOSED WHITEPAPER Draft outline
From a finding to An editorial outline connecting vulnerability evidence, business context, remediation ownership and verification.
Explore the outline ↗ 04 / Evidence, with context Look past the headline. Source-backed vulnerability records and clearly labelled research. No simulated alerts. No invented attack counters.
The last 7 days, in proportion
All: CVEs published to the NVD in the window. Listed: the ones shown on the latest-CVEs page (every CVE with a public PoC or in CISA KEV, then the highest CVSS scores). PoC: at least one public GitHub repository names the CVE. KEV: added to CISA's exploited catalog. The separate KEV snapshot holds 1,769 records (source updated Nov 6, 2026). None of this measures your exposure.