Known-exploited flaw in identity verification vendor SDK SCA Pipeline · exploited in the wild · internet exposed | Digital Onboarding Journey | kev | CRITICAL | 2026-06-02 | Active | +58 |
Object storage bucket publicly listable CSPM · internet exposed | Cloud Infrastructure Program | external exposure | CRITICAL | 2026-05-25 | Active | +43 |
Known-exploited vulnerability in IAM gateway appliance Vulnerability Scanner · exploited in the wild · internet exposed | Enterprise IAM Platform | kev | CRITICAL | 2026-05-12 | Active | +58 |
Unencrypted PII extract discovered on shared drive DLP | Customer Data Domain | data risk | CRITICAL | 2026-05-02 | Active | +35 |
HRIS test tenant reachable without SSO Attack Surface Monitor · internet exposed | HR Information System | external exposure | HIGH | 2026-05-21 | Active | +28 |
Developers with standing production access to core Identity Analytics | Core Banking Platform | iam weakness | HIGH | 2026-05-14 | Active | +20 |
CVE-2026-0788 in origination platform framework Vulnerability Scanner · internet exposed | Loan Origination System | cve | HIGH | 2026-05-06 | Active | +28 |
CVE-2026-0412 in mobile SDK dependency SCA Pipeline · internet exposed | Mobile Banking App | cve | HIGH | 2026-04-30 | Active | +28 |
PII columns unmasked in analytics sandbox Data Discovery | Enterprise Data Warehouse | data risk | HIGH | 2026-04-27 | Active | +20 |
MSSP disclosed security incident affecting client portal TPRM Monitoring | Managed Security Services Provider | vendor event | HIGH | 2026-04-18 | Active | +20 |
OWASP ASVS session management gaps in onboarding flow Security Review · internet exposed | Digital Onboarding Journey | framework gap | HIGH | 2026-04-14 | Active | +28 |
Overly broad cloud IAM roles in production accounts CSPM | Cloud Infrastructure Program | iam weakness | HIGH | 2026-04-12 | Active | +20 |
Stale privileged accounts without rotation Identity Analytics | Enterprise IAM Platform | iam weakness | HIGH | 2026-04-08 | Active | +20 |
Credit model missing fairness test evidence AI Governance Register | Credit Decisioning Model | ai governance gap | HIGH | 2026-04-02 | Active | +20 |
Customer data copied to non-production without masking Data Discovery | Customer Data Domain | data risk | HIGH | 2026-03-28 | Active | +20 |
Payment operators with conflicting duties in access model Identity Analytics | Payment Operations | iam weakness | HIGH | 2026-03-17 | Active | +20 |
CSA CCM logging domain controls unimplemented Compliance Mapper | Cloud Infrastructure Program | framework gap | HIGH | 2026-03-15 | Active | +20 |
ATM fleet running unsupported OS build Asset Inventory | ATM Fleet Operations | vuln | HIGH | 2026-03-03 | Active | +20 |
Unsupported middleware version on core batch servers Vulnerability Scanner | Core Banking Platform | vuln | HIGH | 2026-02-28 | Active | +20 |
No model inventory entry for GenAI assistant AI Governance Register | Generative AI Knowledge Assistant | ai governance gap | HIGH | 2026-02-14 | Active | +20 |
Deprecated API endpoint reachable externally Attack Surface Monitor · internet exposed | Mobile Banking App | external exposure | MODERATE | 2026-05-18 | Active | +18 |
External sharing links to sensitive folders DLP · internet exposed | Cloud Email & Collaboration Suite | data risk | MODERATE | 2026-05-09 | Active | +18 |
Prompt logs retained without classification Data Discovery | Generative AI Knowledge Assistant | data risk | MODERATE | 2026-04-22 | Active | +10 |
Fraud model drift monitoring alert thresholds unreviewed AI Governance Register | Fraud Detection Model | ai governance gap | MODERATE | 2026-03-30 | Active | +10 |
NIST Privacy Framework consent controls partially implemented Compliance Mapper | Customer Data Domain | framework gap | MODERATE | 2026-03-19 | Active | +10 |
Shared analyst accounts in warehouse environment Identity Analytics | Enterprise Data Warehouse | iam weakness | MODERATE | 2026-03-08 | Active | +10 |
Monitoring scenario library below peer coverage baseline Compliance Mapper | AML Transaction Monitoring | framework gap | MODERATE | 2026-02-25 | Active | +10 |
MSSP contract lacks NIST CSF detection coverage mapping Compliance Mapper | Managed Security Services Provider | framework gap | MODERATE | 2026-02-08 | Active | +10 |
End-of-life network switches in server hall Asset Inventory | Data Center Operations | vuln | MODERATE | 2026-01-30 | Active | +10 |
CVE-2026-1187 in SSO federation library Vulnerability Scanner · internet exposed | Enterprise IAM Platform | cve | HIGH | 2026-03-22 | Resolved · 2026-04-15 | 0 |
Loan servicer ransomware event at subcontractor TPRM Monitoring · exploited in the wild | Third-Party Loan Servicer | vendor event | HIGH | 2026-01-25 | Resolved · 2026-03-10 | 0 |
CVE-2026-0233 in collaboration suite plugin Vulnerability Scanner · internet exposed | Cloud Email & Collaboration Suite | cve | MODERATE | 2026-02-19 | Resolved · 2026-03-12 | 0 |
Model training extracts stored beyond retention window Data Discovery | Fraud Detection Model | data risk | MODERATE | 2026-02-11 | Resolved · 2026-05-01 | 0 |
CVE-2025-9981 in core scheduler component Vulnerability Scanner | Core Banking Platform | cve | MODERATE | 2026-01-20 | Resolved · 2026-03-05 | 0 |
Wire process fraud controls below FFIEC baseline mapping Compliance Mapper | Wire Transfer Processing | framework gap | MODERATE | 2026-01-12 | Resolved · 2026-04-20 | 0 |