Alerts, exploited vulns, and breach reporting with the original link attached. Weighted to Australia. Nothing here is invented; if a live feed dies, you get a labelled placeholder and the layout still holds.
ASD's ACSC issued a high-severity alert that CVE-2026-63077 is being exploited against TeamCity On-Premises in Australia. Official desk: cyber.gov.au alerts. Apply vendor patches; do not leave CI servers on the internet without a need.
australia vulnerabilitiesACSC via Australian Cyber Security Magazine
Quest said it identified unauthorised access on 17 August 2026 involving a third-party provider. Customer contact details (some DOB/addresses) from records before June 2025. OAIC and ACSC notified. Payment cards not indicated as exposed.
breaches australiaAustralian Cyber Security Magazine
ACSC warned MSPs and enterprise IT that authentication-bypass issues in N-able N-central are being exploited in Australia. Vendor hotfixes were issued in early August 2026. Check whether the console is internet-exposed.
australia vulnerabilitiesACSC via Australian Cyber Security Magazine
OAIC's 29 June 2026 guide walks APP entities through assessment, notification to individuals, and the OAIC form. Eligible breach = likely serious harm that remedial action has not prevented.
breaches australia au-complianceOAIC
ACSC advised that threat actors are targeting Australian networks with ClickFix, distributing malware through compromised WordPress sites. Treat unexpected 'paste this command' prompts as hostile. Source: cyber.gov.au alerts list.
australia ai-techASD's ACSC
ACSC assessed CVE-2026-4194 in cPanel/WebHost Manager as critical (CVSS 4.0 9.3). Hosting and MSP operators should treat internet-facing WHM as urgent. Listed on cyber.gov.au alerts.
australia vulnerabilitiesASD's ACSC
ASD's ACSC, with Five Eyes partners, published mitigations for ongoing exploitation of Cisco SD-WAN, including CVE-2026-20127, CVE-2026-20128 and CVE-2026-20122. Patch, hunt, and follow Cisco's hardening guide.
australia vulnerabilitiesASD's ACSC
OAIC received 1,205 NDB notifications in 2025, up 8% on 2024. Malicious activity remained the main cause. Health service providers were the most commonly affected sector. Date on the media release was not stamped in the fetch; treat as OAIC 2026 publication covering 2025 stats.
breaches australia au-complianceOAIC
CISA KEV last pulled: 2026-08-26T11:12:20Z catalog 2026.08.25
Added 25 August 2026. Gitea code injection via the diffpatch API for users with repository write access. Apply vendor mitigations; KEV due date 28 August 2026 for US FCEB.
vulnerabilities ai-techCISA KEV
CISA catalog version 2026.08.25, 1676 known-exploited CVE records at last successful fetch. This POC stores recent KEV additions locally when the feed is reachable.
vulnerabilitiesCISA
Gitea Code Injection Vulnerability. Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-25.
vulnerabilities ai-techCISA KEV
ASD's ACSC issued a high-severity alert that CVE-2026-63077 is being exploited against TeamCity On-Premises in Australia. Official desk: cyber.gov.au alerts. Apply vendor patches; do not leave CI servers on the internet without a need.
australia vulnerabilitiesACSC via Australian Cyber Security Magazine
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability. Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-24.
vulnerabilitiesCISA KEV
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability. Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-21.
vulnerabilitiesCISA KEV
TrueConf Server Code Injection Vulnerability. TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-20.
vulnerabilitiesCISA KEV
TrueConf Server Missing Authentication for Critical Function Vulnerability. TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-20.
vulnerabilitiesCISA KEV
Quest said it identified unauthorised access on 17 August 2026 involving a third-party provider. Customer contact details (some DOB/addresses) from records before June 2025. OAIC and ACSC notified. Payment cards not indicated as exposed.
breaches australiaAustralian Cyber Security Magazine
OAIC's 29 June 2026 guide walks APP entities through assessment, notification to individuals, and the OAIC form. Eligible breach = likely serious harm that remedial action has not prevented.
breaches australia au-complianceOAIC
OAIC received 1,205 NDB notifications in 2025, up 8% on 2024. Malicious activity remained the main cause. Health service providers were the most commonly affected sector. Date on the media release was not stamped in the fetch; treat as OAIC 2026 publication covering 2025 stats.
breaches australia au-complianceOAIC
Added 25 August 2026. Gitea code injection via the diffpatch API for users with repository write access. Apply vendor mitigations; KEV due date 28 August 2026 for US FCEB.
vulnerabilities ai-techCISA KEV
Gitea Code Injection Vulnerability. Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-25.
vulnerabilities ai-techCISA KEV
MLflow SSRF added to KEV 19 August 2026. AI/ML ops stacks should not expose MLflow tracking servers to untrusted networks. Patch per vendor; isolate metadata endpoints.
vulnerabilities ai-techCISA KEV
MLflow Server-Side Request Forgery Vulnerability. MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Required action: apply vendor mitigations. Source: CISA KEV 2026-08-19.
vulnerabilities ai-techCISA KEV
Langflow default deployments: unauthenticated code injection leading to RCE, added to KEV 4 August 2026. Do not internet-expose unauthenticated AI workflow UIs.
vulnerabilities ai-techCISA KEV
ACSC advised that threat actors are targeting Australian networks with ClickFix, distributing malware through compromised WordPress sites. Treat unexpected 'paste this command' prompts as hostile. Source: cyber.gov.au alerts list.
australia ai-techASD's ACSC