Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In May 2026, security researchers at Astra identified a Stored Cross-Site Scripting (XSS) Vulnerability in the SVG attachment preview function of nfty, affecting versions up to 2.22.0. Stored Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject and permanently execute malicious scripts within a web application. If exploited, the threat actor could perform actions on behalf of the victim.

In May 2026, security researchers at Astra identified a stored Cross-Site Scripting (XSS) Vulnerability in HTML ReportGenerator, affecting versions up to 5.5.8. Cross-Site Scripting(XSS) is a general web security vulnerability that allows threat actors to inject malicious scripts into a web application. This type of vulnerability is mostly exploited to perform actions on behalf of the victim or to mine cryptocurrency.

CVE-2026-0300 is a critical buffer overflow vulnerability in the User-ID Authentication Portal service, also known as Captive Portal, within PAN-OS. It allows unauthenticated remote attackers to send specially crafted packets and achieve arbitrary code execution with root privileges on affected PA-Series and VM-Series firewalls. The flaw stems from improper handling of input data in the authentication portal component, enabling out-of-bounds writes that corrupt memory and grant full system control.

On May 22 and May 23, 2026, an attacker republished hundreds of malicious versions under historical release tags for four community-maintained Laravel localization libraries that are published on Packagist under the laravel-lang namespace.

In late April 2025, SAP released an emergency patch for a critical vulnerability in SAP NetWeaver, sending security teams across Europe scrambling to assess their exposure. The flaw, CVE-2025-31324, was rated critically severe, and the details that followed made clear why. Media reports quickly revealed the full scope. SAP NetWeaver Visual Composer allowed unauthenticated malicious file uploads through a specific HTTP API endpoint (/developmentserver/metadatauploader).

In May 2026, the Drupal Security Team disclosed a critical SQL injection vulnerability affecting Drupal core. The issue, tracked as CVE-2026-9082, affects Drupal installations using PostgreSQL and has been assigned a Drupal security risk rating of 23/25. The vulnerability can be exploited by anonymous users, and Drupal has confirmed that exploit attempts are being detected in the wild.

Snyk started as a classic product-led growth company. For our first two years, we didn't need a sales team — the product sold itself to developers. That's a rare thing, and we're proud of it. It meant we had genuine product-market fit before we had a go-to-market motion. But markets evolve, and so did we. Today, AI coding agents are generating code at a velocity that significantly outpaces the ability of security teams to review it.