Security services · Products · Sourced intelligence Complex threats.Clear next moves. Expert services, focused products and practical research. Connect your security priorities to the next action that matters.
48 services across six disciplines CVE intelligence sourced from CISA, NVD and FIRST No invented statistics
Live evidence · 7 days · 6-hour sync Last sync Nov 10, 2026, 12:22 AM UTC
3,352 CVEs published (NVD)
44 with a public PoC on GitHub
1,773 in CISA's exploited catalog
CVE-2026-56712 Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers can supply malicious URLs or exploit HTTP redirects in cog.File and cog.Path predictor inputs to force requests to internal addresses, potentially exposing sensitive internal services or credentials.
CVSS 6.3 CVE-2026-94434 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.
CVSS 8.8 CVE-2026-123753 Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Not scored From the research desk The patch is available. Is the exposure closed?Why zero-day response and everyday remediation belong together.
Read the source record ↗ 02 / Our products SECURELINE / GRC Product introduction
Governance, Explore Secureline GRC and its public product portal. Start a conversation about the workflow your organisation needs.
Controls Evidence Risks Audits
Explore Secureline GRC ↗ SECURELINE / PROMPTGATE Product introduction
A distinct product. A dedicated place for Promptgate, separate from the service directory. Contact Secureline for confirmed product details.
Meet Promptgate ↗ 03 / The research journal READING NOTE From the Secureline blog
Why annual VAPT A source-linked reading note on the gap between periodic testing and the way applications, identities and infrastructure actually change.
Read the note ↗ PROPOSED WHITEPAPER Draft outline
From a finding to An editorial outline connecting vulnerability evidence, business context, remediation ownership and verification.
Explore the outline ↗ 04 / Evidence, with context Look past the headline. Source-backed vulnerability records and clearly labelled research. No simulated alerts. No invented attack counters.
The last 7 days, in proportion
All: CVEs published to the NVD in the window. Listed: the ones shown on the latest-CVEs page (every CVE with a public PoC or in CISA KEV, then the highest CVSS scores). PoC: at least one public GitHub repository names the CVE. KEV: added to CISA's exploited catalog. The separate KEV snapshot holds 1,773 records (source updated Nov 9, 2026). None of this measures your exposure.