145 collected events across every source — vulnerabilities, rulemaking and (soon)
advisories, enforcement & news — newest first. This is the raw stream behind the compliance boards.
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect...
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution.
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access...
Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through...
Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the...
2023-09-05DOJ FCAhigh
Verizon Business Network Services
Settled $4.09M — failed to implement required cybersecurity controls in its Managed Trusted IP Service (MTIPS) for federal agencies.
2023-03-14DOJ FCAhigh
Jelly Bean Communications Design LLC
Settled $294K — failed to secure personally identifiable information on a Florida state healthcare-enrollment website.
2022-07-08DOJ FCAhigh
Aerojet Rocketdyne
Settled $9M — misrepresented compliance with cybersecurity requirements in federal government contracts and subcontracts (the first major CCFI settlement).
2022-03-08DOJ FCAhigh
Comprehensive Health Services LLC
Settled $930K — falsely represented compliance with contractual cybersecurity requirements for medical services at U.S. government facilities in Iraq and Afghanistan.