NewIntroducing ISO360 — our all-in-one ISO compliance platform
Cybersecurity · Compliance · Cyber Risk Advisory
NewIntroducing ISO360 — ISO compliance platform

Cybersecurity, Compliance & Risk Advisory for the Digital Age

R4IM helps organizations strengthen security, achieve ISO compliance, manage cyber risk, and respond faster to emerging vulnerabilities — through practical, business-focused advisory services.

Trusted across
ISO 27001ISO 22301ITSM / ISO 20000VA / PTCloud SecurityGRC AdvisoryUAE Experience
Free Cyber Advisory Intelligence

Know what's exploited today. Act before it hits you.

Stay informed about critical vulnerabilities, actively exploited CVEs, vendor advisories, and emerging cyber risks. R4IM continuously monitors trusted public sources and simplifies the actions organizations should take.

MediumCVE-2026-7366
Vulnerability advisory

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gatewa…

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

Updated Aug 12Remediation
CriticalCVE-2026-73519
Vulnerability advisory

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a cons…

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

Updated Aug 12Remediation
CriticalCVE-2026-73501
Vulnerability advisory

kin-openapi is a Go project for handling OpenAPI files.

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

Updated Aug 12Remediation
TrackedCVE-2026-73500
Vulnerability advisory

etcd is a distributed key-value store for the data of a distributed system.

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Updated Aug 12Remediation
TrackedCVE-2026-73499
Vulnerability advisory

etcd is a distributed key-value store for the data of a distributed system.

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive watch events for every key lexicographically greater than or equal to the permitted key. In server/etcdserver/api/v3rpc/watch.go, the open-ended RangeEnd sentinel is rewritten before the RBAC permission check in server/auth/range_perm_cache.go function isRangeOpPermitted, causing the request to be treated as an exact-key watch. Range/Get and DeleteRange requests are not affected, and the issue affects only clusters with authentication enabled. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Updated Aug 12Remediation
HighCVE-2026-73498
Vulnerability advisory

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent can be induced to call the tool through untrusted content, the same flaw can disclose server environment variables such as CONFLUENCE_API_TOKEN and other credentials. This issue is fixed in version 0.22.0.

Updated Aug 12Remediation
New Product

Meet ISO360

The all-in-one platform to plan, implement, and sustain ISO compliance.

Built by R4IM consultants for security, quality, and business continuity teams. ISO360 streamlines controls, evidence, risk, audits, and continual improvement across ISO 27001, ISO 22301, ISO 20000, and more — in one workspace.

  • Multi-standard control library
  • Evidence & document management
  • Risk register & treatment plans
  • Internal audits & CAPAs
  • Real-time compliance dashboards
  • Team collaboration & workflows
ISO360 · Live workspace
Online
Controls
128 / 156
Open risks
7
ISO 27001 readiness82%
ISO 22301 readiness68%
ISO 20000 readiness54%
Powered by R4IM · iso360.r4im.com
Why R4IM

Practical advisory.
Audit-ready outcomes.

We work shoulder-to-shoulder with your teams to close compliance gaps, reduce cyber risk, and build security programs your auditors and your board can both trust. Two decades of UAE and global experience across ISO, cybersecurity, cloud, and GRC.

20+
Years of advisory experience
150+
Engagements delivered
ISO
27001 · 22301 · 20000 practice
UAE
Local presence, global reach
Talk to a Consultant

Get a clear next step on your cyber & compliance roadmap.

A senior R4IM advisor will reply within one business day. UAE-based teams available for on-site engagements across the region.