Breach language Incident / compromise CVEs, KEV, elevated notes Not flagged
| Jetbrains | Breach signal |
I found current vulnerability/advisory activity for JetBrains products in the requested window, but not a confirmed JetBrains corporate/customer-data breach or ransomware incident. JetBrains disclosed a May 2026 high-severity TeamCity On-Premises issue, CVE-2026-44413, saying authenticated users could expose parts of the TeamCity server API and that TeamCity Cloud was not affected. NVD’s entry for CVE-2026-44413 and the Canadian Cyber Centre’s May 2026 JetBrains advisory corroborate the fix guidance. JetBrains also published a YouTrack advisory, CVE-2026-33392, involving a sandbox bypass/code-execution path requiring administrator permissions; JetBrains said YouTrack Cloud was patched and it found no evidence of exploitation. Separately, CISA KEV reporting in April 2026 tied active exploitation to an older JetBrains TeamCity issue, CVE-2024-27199, which is a current-window development even though the CVE itself is older. |
|
|---|---|---|---|
| JetBrains AI | Breach signal |
I did not find credible public signals from roughly 2026-01-19 through 2026-05-19 of a JetBrains AI-specific breach, leak, ransomware incident, or CISA KEV-listed exploited vulnerability. The official JetBrains AI status page showed all systems operational when checked, listed AI Assistant, AI Platform, Grazie, Junie, and AI Platform China, and showed no recent incidents in the visible May 2026 history. JetBrains’ AI Assistant installation documentation says the plugin is not bundled with JetBrains IDEs by default and does not access code unless installed/activated and terms are accepted. I also checked JetBrains’ third-party services list, which identifies AI providers such as OpenAI, Google, Anthropic, and xAI for JetBrains AI services, but this is a data-processing disclosure rather than a security incident. |
|
| Metaplane Inc. | Breach signal |
I did not find credible public signals from roughly 2026-01-19 through 2026-05-19 of a Metaplane Inc. breach, ransomware incident, customer-data leak, security-related outage, or CISA KEV item. Metaplane’s own security page states it is SOC 2 Type II compliant, encrypts data in transit and at rest, and says it does not retrieve or store sensitive customer information. Its public product site likewise describes the service as using metadata/read-only access rather than storing customer PII in the monitored warehouse data, under Metaplane by Datadog. I also checked a recent third-party surface-risk listing, UpGuard’s Metaplane report, which was updated in April 2026 and did not surface a current breach signal. |
|
| ZoomInfo | No strong signal |
I did not find credible public signals from roughly 2026-01-19 through 2026-05-19 of a ZoomInfo data breach, ransomware event, security-related outage, or CISA KEV item affecting ZoomInfo products. The official ZoomInfo status page showed all systems operational when checked and recent entries were routine platform maintenance, not security incidents. ZoomInfo’s Trust Center lists security/compliance programs and certifications, but I did not find a current breach notice there. I also checked ZoomInfo’s February 2026 annual-report disclosures via Fintel’s SEC filing mirror, which discussed cybersecurity governance but did not disclose a recent material cyber incident. |
|
| Warp.dev | Breach signal |
I did not find credible public signals from roughly 2026-01-19 through 2026-05-19 of a Warp.dev breach, ransomware incident, customer-data leak, or CISA KEV-listed active exploitation affecting Warp.dev. Warp’s official status page showed recent days with no incidents reported when checked, and its incident history did not expose a current security incident in the accessible view. Warp’s security page describes SOC 2, encryption, enterprise controls for telemetry/AI/secret redaction, and security contacts, but I did not find a breach notice there. I found older Warp Terminal vulnerability references in public CVE sources, but no credible new active-exploitation or breach development in the requested window, so I am not treating those older items as current vendor risk. |
|
| Amplitude | Incident signal |
I did not find credible public reporting in the Jan. 18–May 18, 2026 window of an Amplitude data breach, ransomware event, customer-data leak, or security-related regulatory action. Amplitude’s public status page did show operational incidents in this period, such as ingestion lag on May 5 and slower realtime processing on May 14, but those were availability/processing events and the page stated “No data is lost” for the May 5 ingestion-lag incident rather than indicating a security compromise. I checked Amplitude’s status page, Trust, Security and Privacy page, and CISA KEV-oriented sources via the cisagov/kev-data mirror; no on-topic current security signal surfaced. |
|
| Bamboo Health, Inc | No strong signal |
I did not find credible public reporting in the Jan. 18–May 18, 2026 window of a Bamboo Health, Inc breach, ransomware event, hosted customer-data leak, or security-related enforcement action. The public materials I found were routine product/company pages and privacy/security FAQs, not incident notices; Bamboo’s FAQ states it has breach-notification procedures if a security incident becomes a successful breach, but I found no current public notice that this occurred. I checked Bamboo Health’s Privacy and Security FAQs, its main company site, and CISA KEV-oriented searches via the cisagov/kev-data mirror; no on-topic current signal surfaced. |
|
| Okta Inc. | No strong signal |
I did not find a confirmed Okta Inc. corporate breach or Okta-platform data leak in the Jan. 18–May 18, 2026 window, but there is a current identity-risk signal involving attacks targeting Okta and other SSO users. On Jan. 22, 2026, Okta Threat Intelligence described custom phishing kits used in vishing campaigns targeting Google, Microsoft, Okta, and cryptocurrency providers, with capabilities to steal credentials and trick users into approving MFA challenges; Okta also noted a detailed customer-only January 2026 threat advisory. See Okta’s phishing kits / vishing analysis and Okta’s system status page for checked primary sources. I also checked CISA KEV data via the public cisagov/kev-data mirror and did not find a recent KEV entry tied to Okta products in this review window. |
|
| Riverside.fm | No strong signal |
I did not find credible public reporting in the Jan. 18–May 18, 2026 window of a Riverside.fm data breach, ransomware event, customer-data leak, or security-related regulatory action. The public items I found were mainly reliability/outage monitoring rather than security incidents, including third-party status trackers showing recent non-security outages and Riverside’s own security/privacy materials. I checked Riverside’s Security Measures, Privacy Policy, and recent RiversideFM status/outage tracking, plus CISA KEV-oriented searches; no on-topic current signal surfaced. |
|
| DocuSign | Breach signal |
I did not find a confirmed Docusign corporate data breach or customer-data exfiltration incident in the Jan. 18–May 18, 2026 window, but Docusign did publish current fraud/security alerts showing active abuse of its platform/brand for phishing. On Feb. 5, 2026, Docusign warned of advanced phishing scams leveraging Docusign Maestro workflow notifications and external communications; on Apr. 9, 2026, it said attackers had misused legitimate Docusign system features such as “Send Report” to bypass email filters, and that Docusign had mitigated that specific abuse. See Docusign’s Safety alerts and updates and its Security Attachment for Docusign Services. I also checked CISA KEV-oriented sources and did not find a current KEV item tied to Docusign products in this review window. |
|
| Cursor | Breach signal |
I found credible recent security signals for Cursor, though not a confirmed breach of Cursor’s own hosted customer database. On Apr. 28, 2026, LayerX published CursorJacking, alleging that Cursor stores API keys/session tokens in a local SQLite database accessible to installed extensions, with potential credential theft and third-party API abuse; the post says the issue was not fixed as of publication. Cursor’s own security page, updated Apr. 24, 2026, describes SOC 2 availability, annual pentesting, privacy mode, and vulnerability-reporting processes, but it does not present this as a disclosed platform breach. I also found public Cursor forum reports of destructive agent behavior, including an Apr. 26, 2026 thread where a Cursor forum responder described a known Windows command/path-sandboxing bug class after a user reported ~300GB local deletion: Cursor forum report. Treat these as endpoint/tooling risk and credential-exposure risk for Cursor users, not evidence of Cursor’s central systems being breached. |
|
| KnowBe4 | Incident signal |
I found no credible public reports in the Jan. 17–May 17, 2026 window of a KnowBe4 data breach, ransomware event, platform compromise, or security-related regulatory action. KnowBe4’s own security statement was updated in April 2026 and describes SOC 2, ISO/FedRAMP controls, encryption, vulnerability management, and bug-bounty reporting; this is a control posture source, not an incident notice. Its status page showed all systems operational when checked, with recent entries for access/upload/login issues and planned maintenance, but nothing indicating a security incident or customer-data exposure. I also checked CISA KEV-oriented searches and did not find KnowBe4 products listed as newly exploited in this period. |
|
| Renovate Bot | Incident signal |
I did not find evidence of a Renovate Bot-hosted customer data breach or platform compromise in the Jan. 17–May 17, 2026 window, but there were recent software-vulnerability signals relevant to users who run Renovate. Snyk lists April 2026 Wolfi-package findings affecting |
|
| Rocketreach | Breach signal |
I found no confirmed RocketReach data breach, ransomware incident, or security-related regulatory action in the Jan. 17–May 17, 2026 window. An UpGuard vendor-risk page updated May 2026 gives RocketReach an external security rating and flags infostealer malware detected on systems associated with the organization, which is a public risk signal but not a confirmed RocketReach breach or customer-data compromise. RocketReach previously announced SOC 2 Type II renewal and ISO 27001 certification in 2024 via PR Newswire, and that release points to its trust portal, but I did not find a newer public incident notice. A March 2026 Bloomberg Law item about privacy litigation dismissal was not treated as an on-topic cybersecurity incident because it concerned use of personal information in RocketReach’s database rather than a breach or compromise. |
|
| ZipCodeApi.com | Incident signal |
I found no credible public reports in the Jan. 17–May 17, 2026 window of a ZipCodeApi.com breach, leak, ransomware/security compromise, or security-related regulatory action. The site’s terms/contract page says ZipCodeAPI maintains commercially reasonable administrative, physical, and technical safeguards for customer data, while its privacy policy says it collects account/contact data and log data and describes encryption/firewall/access-control safeguards. I did not find a dedicated public trust center, incident page, or status page with security incidents, and CISA KEV searches did not surface ZipCodeApi.com-specific exploited product entries. |
|
| CodeRabbit | No strong signal |
I did not find credible public reporting in the Jan. 16–May 16, 2026 window of a CodeRabbit breach, data leak, ransomware event, or CISA/KEV-listed vulnerability affecting the CodeRabbit platform. CodeRabbit’s trust center is publicly available for security/compliance materials, but it does not present a recent incident notice in the sources I could access (CodeRabbit Trust Center). Public status trackers show recent availability incidents affecting login/reviews/app components, including April 2026 outages, but I did not find credible evidence that those were security-related or involved customer-data exposure (StatusGator CodeRabbit status, IsDown CodeRabbit status). I also checked CISA/KEV-style angles and found no CodeRabbit-specific recent KEV signal (CISA KEV catalog). |
|
| Fillout | Incident signal |
I did not find credible public reporting in the Jan. 16–May 16, 2026 window of a Fillout data breach, ransomware event, widespread compromise, or security-related regulatory action. The vendor’s public security/legal materials describe SOC 2 Type 2 compliance and security features such as encryption, SAML SSO, data-region controls, and options around external storage (Fillout security/legal, Fillout GDPR/security notes). Public status aggregators that monitor Fillout show ordinary availability tracking and some outages, but I did not see a credible indication that those were security incidents or data exposure events (IsDown Fillout status, StatusGator Fillout status). I also did not find a Fillout-specific CISA KEV signal in the relevant window (CISA KEV catalog). |
|
| Google Suite | Issues / advisories |
Treating “Google Suite” as Google Workspace/G Suite, I did not find a credible, recent Google Workspace data breach or platform-wide security incident in the Jan. 16–May 16, 2026 window. The most relevant public signal was Vercel’s April 2026 incident, where Vercel said a compromised third-party AI tool’s Google Workspace OAuth app was used to take over a Vercel employee’s Workspace account; that is an OAuth/vendor-governance exposure pattern, not evidence that Google Workspace itself was breached (Vercel bulletin, TechCrunch). Google’s own Workspace status resources remained the main primary check for service incidents (Google Workspace Status Dashboard), and Google documents admin controls for governing third-party OAuth access to Workspace data (Google Admin Help). I also checked CISA/KEV angles; recent Google KEV activity in this window appears tied to Chrome/Chromium vulnerabilities rather than Google Workspace-hosted customer data (CISA KEV catalog, NVD CVE-2026-3909). |
|
| Snowflake | Incident signal |
There was a credible recent third-party/supply-chain security signal involving Snowflake customer environments, though public reporting distinguished it from a direct Snowflake platform breach. In early April 2026, BleepingComputer reported that attackers used stolen authentication tokens from a breached SaaS integration provider, later identified as Anodot, to access a small number of Snowflake customer accounts; Snowflake reportedly detected unusual activity, locked impacted accounts, and notified affected customers (BleepingComputer). TechCrunch separately reported that the Anodot hack left more than a dozen companies facing extortion and noted Anodot’s status-page connector disruption starting April 4, 2026 (TechCrunch). This is relevant vendor-risk signal for customers using Snowflake with third-party integrations because customer data hosted in Snowflake may have been accessed via delegated tokens, but it should not be characterized as a confirmed compromise of Snowflake’s own infrastructure. Snowflake’s public status page also showed non-security service disruptions in March/April 2026, including cloud-provider and regional availability issues, but those are separate from the Anodot-token theft reports (Snowflake Status). |
|
| Rotation.App | Breach signal |
I did not find credible public reporting in the Jan. 16–May 16, 2026 window of a Rotation.App breach, leak, ransomware event, or other major security incident. The public footprint is comparatively small; I checked the vendor’s own site, legal/security-related terms, DPA, privacy policy, and Slack Marketplace listing, which identify it as a Slack rotation/on-call scheduling app and provide security/contact information but no incident notice (Rotation.App site, terms, DPA, privacy policy, Slack Marketplace listing). I also did not find a Rotation.App-specific CISA KEV or advisory signal in the relevant window (CISA KEV catalog). Based on public sources, the current signal is “no credible recent on-topic incident found,” rather than evidence of a known compromise. |
|
| Auth0 | Incident signal |
In the Jan. 15–May 15, 2026 window, I found no credible public report of an Auth0 customer-data breach or ransomware-style compromise. The notable current security signal is a moderate Auth0 Next.js SDK issue, GHSA-xq8m-7c5p-c2r6, published Apr. 17, 2026 and tracked by NVD as CVE-2026-40155; it affects certain @auth0/nextjs-auth0 versions with DPoP and specific proxy handlers and is fixed in v4.18.0. The Auth0 public status page was operational when checked, though third-party status history shows several February 2026 authentication-impacting outages, which appear availability-related rather than security breaches. I also checked the current CISA KEV feed and found no Auth0 entry by vendor name. |
|
| Insperity | No strong signal |
I found no confirmed, credible public report in the Jan. 15–May 15, 2026 window of an Insperity data breach, ransomware event, or regulatory cybersecurity action. Insperity’s public security and privacy page and security statement describe its incident-response, DLP, access-control, vulnerability-management, and privacy programs, but do not disclose a current incident. A May 2026 UpGuard vendor-risk page flags “infostealer malware detected” as a potential data-leakage signal, but I did not find corroborating vendor, regulator, or reputable-news confirmation tying that to an Insperity breach. I also checked the current CISA KEV feed and found no Insperity entry. |
|
| Jellyfish | Breach signal |
I found no credible public report in the Jan. 15–May 15, 2026 window of a Jellyfish data breach, ransomware incident, customer-data leak, or major platform security compromise. Jellyfish’s Trust Center page states that it maintains SOC 1 Type II and SOC 2 Type II attestations, performs vulnerability assessments and third-party penetration tests, and provides vulnerability reporting via security@jellyfish.co. Its public Security Advisories and Bulletins page listed advisories from 2024 and 2023, with no 2026 advisory visible. I also checked the current CISA KEV feed and found no Jellyfish entry; third-party status monitoring showed no recent unresolved incident on Jellyfish status. |
|
| Lucidchart | Breach signal |
I found no credible public signal in the Jan. 15–May 15, 2026 window of a Lucidchart/Lucid Software data breach, ransomware incident, customer-data leak, or actively exploited Lucidchart platform vulnerability. Lucid’s public security page describes its incident-response, encryption, MFA/SSO, vulnerability disclosure, and trust-center posture, and points users to status.lucid.co for service incidents. Third-party status history showed only a brief Feb. 12, 2026 Lucid Gov login outage, not a security incident or data exposure, in the Lucid outage history. I also checked the current CISA KEV feed and found no Lucid/Lucidchart match. |
|
| WebFlow | Breach signal |
I found no credible public report in the Jan. 15–May 15, 2026 window that Webflow itself suffered a data breach, ransomware incident, or customer-data leak. There was a major Apr. 14, 2026 availability incident, but Webflow’s CTO wrote that it was caused by an infrastructure/database-capacity constraint, “not” a security vulnerability or malicious attack, and that service was restored with no CMS data loss in the April 14 incident report. A Jan.–Feb. 2026 Webflow community thread reported a sophisticated Webflow-themed phishing campaign targeting active clients and agencies, but the post says the reporting agency found no indication of a breach in its own systems and does not establish a Webflow platform compromise. Webflow’s security documentation access page points customers to its Trust Center, and I found no Webflow match in the current CISA KEV feed. |
|
| Google Chrome Extensions | No strong signal |
There were multiple credible, recent public signals about malicious extensions in the Chrome Web Store, though these are ecosystem/storefront risks rather than a breach of Google itself. On Apr. 13, 2026, Socket reported 108 Chrome extensions linked to data exfiltration and session theft, including Google account identity harvesting, Telegram session theft, backdoors, and shared C2 infrastructure; Socket said the extensions collectively had about 20,000 installs and remained live at publication. In February 2026, LayerX published research on the “AiFrame” campaign, describing 30 fake AI-assistant Chrome extensions affecting over 260,000 users, several of which were “Featured” by the Chrome Web Store and could transmit page/Gmail content to remote infrastructure. I did not find a CISA KEV entry specific to Chrome extensions, but these reports are credible current signals that extension allowlists, Chrome Web Store trust assumptions, and enterprise browser-extension controls should be reviewed. |
|
| Hubspot | Incident signal |
I found no credible public report of a HubSpot data breach, ransomware event, or security compromise in the Jan. 14–May 14, 2026 window. HubSpot’s official status page shows availability incidents, including a May 12, 2026 short unavailability event attributed to a “database impairment,” a May 7 regional degradation tied to an AWS outage, and April/May email delivery/DMARC issues; these are operational reliability signals but not clearly security-related, so I would not treat them as breach indicators. I also checked HubSpot’s account-security guidance, including its login and password best practices, and did not find a new incident notice. Public filings and security pages discuss cybersecurity risk management generally, but I did not find a recent, on-topic confirmed incident. |
|
Breach signal |
I did not find a confirmed LinkedIn data breach, ransomware event, or CISA KEV-style product vulnerability in the Jan. 14–May 14, 2026 window. The main current security/privacy signal is the April 2026 “BrowserGate” reporting: BleepingComputer independently observed LinkedIn JavaScript checking for 6,236 Chrome extensions and collecting device/browser attributes, while LinkedIn told the outlet this is used to detect scraping extensions and protect site stability, not infer sensitive data. The underlying advocacy report is hosted at browsergate.eu and makes broader legal/privacy claims, but those claims are disputed and should be treated as an allegation rather than a confirmed breach. I also checked LinkedIn’s own security practices and security vulnerability reporting page and did not see a recent public breach notice. |
||
| Mosaic | No strong signal |
“Mosaic” is ambiguous, so I checked several likely vendors and found mixed same-name signals rather than one clearly attributable incident. For the finance/SaaS-style Mosaic properties, I did not find a credible recent breach notice on the mosaic.tech security page or the Mosaic Trust Center / mosaic.pe security page. However, if your vendor is Mosaic Health System / Mosaic Life Care, there is an on-topic January 2026 notice: Mosaic says it was notified around Jan. 13, 2026 by Epic that there may have been misuse of the Carequality platform by Health Gorilla-connected participants, and it posted a Notice of Data Security Incident Related to TEFCA and Health Gorilla. Separately, if your “Mosaic” is The Adaptavist Group product, Adaptavist disclosed a late-March 2026 credential-based IT security incident but said it had no reason to believe customer personal data processed through products including ScriptRunner and Mosaic or production systems was accessed, per its April 2026 security incident note. |
|
| Spokenly | Incident signal |
I found no credible public report of a Spokenly data breach, leak, ransomware event, or security compromise in the Jan. 14–May 14, 2026 window. I checked Spokenly’s current privacy policy, which was updated Mar. 2, 2026 and explains that local models keep audio on device while cloud models send audio to Spokenly’s backend and third-party transcription services without permanent server copies by Spokenly. I also checked the Spokenly support/logs documentation, which says support logs do not include private information, transcripts, or audio recordings. The relevant risk signal is architectural/privacy due diligence around cloud transcription and listed third-party AI providers, not a known public security incident. |
|
| 1Password | Incident signal |
The most material recent signal is academic, not an actual breach. In February 2026, ETH Zurich's Applied Cryptography Group published a paper analyzing zero-knowledge claims of major cloud password managers under a malicious-server threat model, presenting three attack scenarios against 1Password including full vault confidentiality/integrity compromise and missing public-key authentication in vault sharing (ETH Zurich announcement, SecurityWeek coverage, Help Net Security, paper preprint). 1Password's CISO/CIO publicly responded that the attack vectors fall within already-documented architectural limitations from their Security Design White Paper and that no production incident occurred (1Password's response). No breach of 1Password's own infrastructure, no CISA KEV entry, and no customer-data exposure was reported in this window — but the research is worth tracking because it will be presented at USENIX Security 2026 and may prompt future hardening. |
|
| HISAC | Breach signal |
No public breach of Health-ISAC (H-ISAC) itself was reported in roughly the previous four months. Activity from H-ISAC in this window is outbound advisory work, not an incident against the organization: on 2026-01-28 AHA republished an H-ISAC TLP:WHITE bulletin warning of active exploitation of an authentication bypass vulnerability (AHA / H-ISAC bulletin), and Health-ISAC released its 2026 Annual Threat Report flagging a 55% surge in healthcare cyber incidents during 2025 and ranking AI-enabled attacks, zero-days, ransomware, and third-party breaches as 2026's top threats (Industrial Cyber summary). The Health-ISAC homepage and member portal show no incident notice. Net: no credible signal that H-ISAC was compromised in the window. |
|
| HITRUST Services Corp | No strong signal |
No credible breach, ransomware event, or regulatory action against HITRUST Services Corp / HITRUST Alliance itself surfaced in the previous ~4 months. The most prominent HITRUST-related news in the window is the company's own 2026 HITRUST Trust Report and accompanying press release, which reports that 99.62% of HITRUST-certified environments remained breach-free in 2025 and that none of the top 50 healthcare breaches in the HHS OCR portal occurred in HITRUST-certified environments — i.e., self-published positive metrics, not an incident. HITRUST's Security Events FAQ likewise shows no current event disclosures. Caveat: HITRUST is principally a certification/assurance body, so the relevant residual risk to monitor is the integrity of the certification framework and assessor ecosystem rather than a hosted-data breach. |
|
| SonarCloud | Incident signal |
No credible reports of a breach of SonarCloud / SonarQube Cloud (Sonar / SonarSource) infrastructure or customer code surfaced in the previous ~4 months. The Sonar Trust Center and SonarQube Cloud release notes show routine activity, and the SonarSource CVE history on cvedetails.com lists only product-side CVEs in self-hosted SonarQube Server (e.g., information-disclosure / SQLi issues fixed in 25.6 / 2025.3 / 2025.1.3 LTA) — none of which point to a SonarCloud-tenant compromise. Worth noting in the window is the broader CI/CD supply-chain narrative that Sonar itself wrote about in its March 2026 post "Why your supply chain attack surface is expanding", discussing the Trivy GitHub Actions secrets-theft incident — that is a peer-tooling incident, not a SonarCloud one, but it underscores the relevance of token hygiene for any code-scanning SaaS that holds repo credentials. |
|
| Gat+ | No strong signal |
No credible public reports of a breach, CVE, regulatory action, or major security incident involving GAT+ / GAT Labs (the Google Workspace audit/DLP tool from gatlabs.com) were found in the roughly December 2025 – April 2026 window. Neither breach trackers nor mainstream security outlets surfaced anything on GAT+ specifically. The vendor's own GAT+ product page and Security Policy Statement remain the primary references, and the app is still listed on the Google Workspace Marketplace without any notable advisories. Net: no credible new signals in the window. |
|
| Sigma | Incident signal |
No new credible security incident involving Sigma Computing surfaced in roughly the December 2025 – April 2026 window. Sigma was one of hundreds of organizations swept up in the August 2025 Salesloft Drift OAuth token supply-chain compromise (threat actor UNC6395), but that event predates the 4-month window; follow-on analysis has continued into 2026 without new material impact to Sigma's own platform, per their statements. Sigma's Trust Center and status history show no newly disclosed security events in this window. For context on the Drift campaign that did touch them, see UpGuard's Drift breach recap and CyberScoop's root-cause coverage. |
|
| Granola | No strong signal |
Two notable signals hit in the 4-month window. First, in early April 2026 multiple outlets reported that Granola notes are public-by-default via shareable link and that meeting content is used for AI training unless users opt out — a sharp contrast with the vendor's "private by default" marketing; coverage includes TechBuzz, Business Story (PSA, 2026-04-02), and The Meridiem. Second, PromptArmor disclosed that Granola's mobile app lacked Markdown-image sanitization that the desktop app had, enabling prompt-injection-driven data exfiltration; Granola deployed a mitigation the week of March 23, 2026. Granola's own Security page remains the authoritative vendor statement. |
|
| CultureAmp | Issues / advisories |
No credible breach, ransomware, regulatory action, or security-related major outage involving Culture Amp surfaced in the ~4-month window (late Dec 2025 – Apr 2026). Culture Amp proactively posted on their Security Trust Centre that their infrastructure is not impacted by the widely-exploited CVE-2025-55182 "React2Shell" RCE in React Server Components (disclosed Dec 3, 2025 and under active exploitation per AWS/Microsoft threat intel), and they similarly noted no Ivanti exposure. Third-party risk sources including UpGuard's Culture Amp security rating and Nudge Security's profile show no new incidents in the window. No CISA advisories or CVEs were identified referencing Culture Amp's platform directly in this period. |
|
| Fathom | No strong signal |
No credible reports of a breach, ransomware event, or widespread security incident involving Fathom (the AI meeting notetaker / fathom.video) surfaced in the ~4-month window (late Dec 2025 – Apr 2026). Searches of news, breach trackers, and third-party vendor-risk reports such as UpGuard's Fathom security report and Nudge Security's Fathom profile show no new incidents during this period. Fathom's Trust Center and "Is Fathom secure?" FAQ continue to list SOC 2 Type II, HIPAA, and GDPR postures with no disclosed incidents. No CISA advisories or CVEs referencing Fathom were identified in the window. The only current privacy consideration (non-incident) noted in press/analysis is Fathom's default use of de-identified customer data for model improvement with opt-out, which predates the window. |
|
| Mozilla Firefox Extensions | No strong signal |
In December 2025, Koi Security disclosed the GhostPoster campaign — 17 malicious Firefox add-ons with over 50,000 cumulative downloads that used steganography to hide JavaScript payloads inside the extensions' PNG icons, enabling affiliate-link hijacking, tracking injection, and ad/click fraud (The Hacker News, Dec 2025, Koi Security write-up). A follow-up investigation in late December attributed GhostPoster to a broader Chinese-linked threat cluster called DarkSpectre, whose cross-browser extension campaigns (ShadyPanda, GhostPoster, Zoom Stealer) collectively reached roughly 8.8M users across Chrome, Edge, and Firefox over ~7 years (The Hacker News DarkSpectre coverage, Malwarebytes, Jan 2026). Mozilla removed and blocklisted the identified add-ons (disabling them in installed Firefox profiles), and Mozilla's security advisories page continued routine Firefox CVE publishing through the window (e.g., MFSA 2026-06). Takeaway for vendor risk: the AMO store's review pipeline was bypassed for months via image-embedded code, so any internal reliance on Firefox extensions should include a review of whether any flagged IDs were installed. |
|
| ScormHero | No strong signal |
No credible public security signals were found for ScormHero in roughly the previous 4 months — no breach disclosures, CVE/KEV entries, or reputable news coverage tied to this vendor specifically turned up in news or breach-tracker searches. ScormHero is a small SaaS that converts PowerPoint/PDF/video into SCORM packages and has a minimal public footprint; its own site (scormhero.com) does not appear to publish a formal trust/security page or status page, which itself is a diligence gap worth flagging. For context, the only recent SCORM-ecosystem security research in the window applies to the unrelated Rustici Software / SCORM Cloud product line (Tenable TRA-2022-21 on Rustici) rather than to ScormHero. Recommend requesting a SOC 2 or equivalent attestation from ScormHero directly, since automated monitoring has little to reference. |
|
| Atlassian | Issues / advisories |
Atlassian disclosed a high volume of product vulnerabilities across monthly security bulletins in this window, headlined by CVE-2026-21571 (CVSS 9.4), a critical OS command injection in Bamboo Data Center/Server patched in the April 21, 2026 bulletin, which addressed 38 vulnerabilities total (7 critical, 31 high). The March 2026 bulletin patched CVE-2026-23950 (CVSS 8.8, Jira path traversal), CVE-2025-64756 (Confluence OS command injection), and multiple high-severity file inclusion flaws via node-tar dependencies. Earlier, the January 2026 bulletin addressed critical Apache Tomcat-related RCE flaws in Confluence (CVE-2024-50379, CVE-2024-56337, both CVSS 9.8) and an authentication bypass in Crowd (CVE-2024-52316, CVSS 9.8), as reported by Security Affairs. A separate third-party risk emerged in February 2026 with CVE-2026-27825 (CVSS 9.1), a critical unauthenticated RCE in the open-source mcp-atlassian MCP server used to integrate AI tools with Confluence. Additionally, Trend Micro reported that threat actors abused free-trial Jira Cloud instances from late December 2025 through January 2026 to send spam email that passed SPF/DKIM checks, targeting government and corporate entities. No Atlassian-specific CVEs were added to the CISA KEV catalog in this window, and no direct breach of Atlassian's own infrastructure was confirmed. |
|
| Amazon Web Services, Inc. | Breach signal |
AWS published Security Bulletin 2026-005 on March 2, 2026, disclosing three vulnerabilities in its open-source cryptographic library AWS-LC (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338) — including a PKCS7 certificate chain validation bypass and a timing side-channel in AES-CCM — all patched in AWS-LC v1.69.0. In March 2026, a supply-chain attack on AquaSec's Trivy scanner enabled attackers to steal an AWS API key from the European Commission, exfiltrating ~340 GB of data; AWS stated its services operated as designed and the compromise was customer-side. Separately, LexisNexis suffered a breach in February–March 2026 when attackers exploited an unpatched React frontend to access their AWS environment, exfiltrating ~2 GB of legacy data via over-permissive ECS task roles. In April 2026, a critical Axios HTTP library vulnerability (CVE-2026-40175) was disclosed that can bypass AWS IMDSv2 protections to steal instance credentials. A major power outage struck AWS Middle East regions on March 1, 2026, cascading across me-central-1 and me-south-1, though this was infrastructure-related rather than a security breach. No AWS-specific entries were added to the CISA KEV catalog during this period. |
|
| V0 | Breach signal |
Vercel, the parent platform of V0, disclosed a significant security breach on April 19, 2026 stemming from a supply-chain OAuth attack. A Context.ai employee was infected by Lumma Stealer malware in February 2026, and because a Vercel employee had connected their enterprise Google Workspace account to Context.ai with full Drive read access, attackers pivoted into internal Vercel systems. BleepingComputer reported that a limited subset of customer environment variables (those not marked "sensitive") were accessed and potentially exfiltrated, while a threat actor posted a $2 million sale listing on BreachForums claiming to have Vercel databases, access keys, and source code. Vercel confirmed that Next.js, Turbopack, and npm packages were not compromised and engaged Google Mandiant for incident response. While V0 itself was not specifically named as impacted, as a Vercel product sharing the platform, any customer projects deployed on Vercel — including those built with V0 — could have had non-sensitive environment variables exposed, as noted by NowSecure. Vercel advised all customers to rotate secrets and review environment variable configurations. |
|
| Coderpad.io | No strong signal |
No confirmed data breaches, cybersecurity incidents, or regulatory actions were identified for CoderPad.io in the December 2025 – April 2026 window. Their security page confirms SOC 2 Type 2 compliance, annual penetration tests, and a bug bounty program with no disclosed incidents. The CoderPad status page shows two minor operational incidents in this period — a Screen Projects service interruption (Jan 26, 2026) and an AI assistant outage (Mar 12, 2026) — neither security-related. An UpGuard security report gives CoderPad an "A" rating (893/950) but flags a provisional, undated infostealer malware detection associated with the organization; this is unconfirmed with no public corroboration from CoderPad or any news outlet. The CoderPad Trust Center was also reviewed and contained no advisories or incident disclosures. |
|
| Aikido | Incident signal |
No live web searches could be performed (all web-access tools were permission-blocked), and the requested window (Dec 2025–Apr 2026) falls mostly after the training-data cutoff (May 2025). The most notable Aikido-related event near the window boundary was in April 2025, when Aikido Security's malware-detection system publicly identified a supply-chain compromise of the official |
|
| Conga | Breach signal |
No live web searches could be performed (all web-access tools were permission-blocked), and the requested window (Dec 2025–Apr 2026) falls after the training-data cutoff (May 2025). As of mid-2025, no publicly reported data breaches, significant CVEs, or regulatory actions involving Conga (the document automation and contract lifecycle management platform) were found in available training data. Conga handles sensitive contract and revenue data primarily within the Salesforce ecosystem and has undergone private-equity ownership changes, but no security incidents were publicly attributed to those transitions. Enterprise B2B vendors like Conga sometimes handle breach disclosures through private customer notification, limiting public visibility. Verify current status at Conga's trust center and check the CISA KEV catalog. Because live searches could not be completed, incidents between December 2025 and April 2026 may have been missed. |
|
| Calamari.io | Breach signal |
No live web searches could be performed (all web-access tools were permission-blocked), and the requested window (Dec 2025–Apr 2026) falls after the training-data cutoff (May 2025). As of mid-2025, no publicly reported data breaches, CVEs, or security incidents involving Calamari.io (the Polish HR/leave-management and time-tracking SaaS platform) were found in available training data. Calamari is a niche, smaller vendor with limited security-news footprint, so the absence of reported incidents is not strong evidence of no incidents — it more likely reflects limited coverage. The company advertises GDPR compliance and hosts on AWS. Verify current status at Calamari.io's security page and check general breach trackers such as Have I Been Pwned. Because live searches could not be completed, incidents between December 2025 and April 2026 may have been missed entirely. |
|
| Loom | No strong signal |
No credible public security signals — including confirmed data breaches, major cybersecurity incidents, regulatory actions, or CISA KEV entries — were identified specifically for Loom (now an Atlassian product) in the December 2025 through April 2026 review window. Web search tools were unavailable during this research session, limiting live verification. Atlassian, Loom's parent company, has historically had CISA KEV entries for products like Confluence and Jira, so broader Atlassian advisories should be reviewed for any infrastructure-level impacts that could affect Loom. The Loom Trust & Security page, Loom status page, and the Atlassian Trust Center should be checked directly for any recent disclosures in this period. |
|
| Pave.com | No strong signal |
No credible public security signals — including confirmed data breaches, ransomware incidents, authentication bypasses, regulatory actions, or CISA KEV entries — were identified for Pave.com in the December 2025 through April 2026 review window. Web search tools were unavailable during this research session, so live verification against news outlets, breach trackers, and government advisories could not be completed. Pave.com is a relatively small compensation-benchmarking SaaS vendor and does not appear in historical CISA KEV entries or major breach databases. Their security page and trust center should be checked directly for any recent disclosures or advisories covering this period. |
|
| Salesforce | Incident signal |
No credible public security signals — including confirmed data breaches, major cybersecurity incidents, or CISA KEV entries — were identified specifically for Salesforce in the December 2025 through April 2026 review window. Web search tools were unavailable during this research session, so live verification could not be completed. Salesforce has historically faced recurring concerns around misconfigured guest-user permissions exposing org data, and its subsidiary products (MuleSoft, Tableau, Slack) have had CVEs in prior years, but no new confirmed incidents in this window could be verified. The Salesforce Trust status page, Salesforce Security Advisories, and the CISA KEV catalog filtered for Salesforce should be checked directly to confirm the absence of incidents during this period. |
|
| Zendesk Inc. | Incident signal |
No credible public security signals — including confirmed data breaches, ransomware incidents, major platform vulnerabilities, or CISA KEV entries — were identified for Zendesk Inc. in the December 2025 through April 2026 review window. Web search tools were unavailable during this research session, preventing live verification against news outlets, the NVD, and breach trackers. Zendesk does not appear in historical CISA KEV entries as of mid-2025. The most recent widely reported Zendesk security event was a 2022-era credential-stuffing incident, which falls well outside this review window. The Zendesk Trust Center, Zendesk status page, and CISA KEV catalog should be checked directly to confirm no new incidents in this period. |
|
| SmartSheet | No strong signal |
No credible public security signals — including confirmed data breaches, ransomware incidents, platform vulnerabilities, regulatory actions, or CISA KEV entries — were identified for Smartsheet in the December 2025 through April 2026 review window. Web search tools were unavailable during this research session, so live verification against news sources, the NVD, and government advisories could not be completed. Smartsheet was taken private by Blackstone in early 2025, which may reduce public disclosure visibility going forward. The Smartsheet Trust Center and Smartsheet status page should be consulted directly, along with the CISA KEV catalog filtered for Smartsheet, to confirm no incidents occurred in this window. |
|
| Looker | No strong signal |
No major data breach or security compromise of the Looker platform (now part of Google Cloud) was publicly reported through early 2025. Looker operates under Google Cloud's security umbrella and maintains SOC 2 Type II, ISO 27001, and other certifications documented at Google Cloud Security. Google publishes Looker-specific patches via Looker Security Bulletins; historically these have addressed moderate-severity issues (XSS, SSRF, access-control flaws) patched server-side. Looker does not appear in the CISA KEV catalog. No critical CVEs (CVSS 9.0+) specific to Looker were identified in this review period. Live web searches for mid-2025 through April 2026 could not be completed; checking the Looker release notes and Google Cloud security bulletins is recommended for the most current status. |
|
| SimpliContract | No strong signal |
No publicly reported data breaches, security incidents, CVEs, or regulatory actions involving SimpliContract (the India-headquartered contract lifecycle management platform at simplicontract.com) were identified through early 2025. SimpliContract is a smaller CLM vendor; as such, coverage in major breach-tracking databases and cybersecurity news outlets is limited. The vendor does not appear in the CISA KEV catalog or the NIST NVD. Their website references enterprise security practices, though specific certifications (SOC 2, ISO 27001) should be confirmed directly. Live web searches for mid-2025 through April 2026 could not be completed; manual review of their security page and state attorney-general breach notification portals is recommended. |
|
| Anthropic | No strong signal |
No confirmed public data breaches, ransomware incidents, or major cybersecurity compromises targeting Anthropic have been reported through May 2025. Anthropic has not appeared in the CISA Known Exploited Vulnerabilities catalog and no CVEs specific to Anthropic products have been published in the NVD. On the regulatory front, Anthropic has participated in voluntary AI safety commitments with the White House and has faced general FTC scrutiny around AI industry data practices, but no formal enforcement actions or fines specific to a security breach have been announced. Anthropic maintains a security page and a responsible disclosure policy for reporting vulnerabilities. The company holds SOC 2 Type II certification and has undergone third-party security audits. Note: Web search was unavailable; events after May 2025 could not be verified — check the links above for the latest posture. |
|
| Digicert | Breach signal |
The most significant recent Digicert incident occurred in July 2024, when Digicert announced an urgent mass revocation of approximately 83,000 TLS/SSL certificates due to a domain control validation (DCV) bug in CNAME-based verification that had been present since approximately 2019. Affected certificates had to be revoked within 24 hours per CA/Browser Forum rules, causing widespread disruption for customers. CISA issued an alert warning organizations to prepare for the revocation impact. The incident was widely covered by outlets including BleepingComputer and The Register. Beyond this DCV/revocation event, no confirmed direct data breaches or ransomware compromises targeting Digicert have been publicly reported through May 2025. Note: Web search was unavailable; events after May 2025 could not be verified — check the Digicert status page and security advisories for the latest. |
|
| OpenAI/ChatGPT | No strong signal |
In December 2024, Italy's data protection authority (Garante) fined OpenAI €15 million for GDPR violations related to the processing of personal data for model training and insufficient age-verification mechanisms, marking the most significant regulatory enforcement against the company to date. Security researchers also reported in late 2024 that ChatGPT's search feature could be manipulated via hidden-text prompt injection on web pages, potentially poisoning search results; OpenAI acknowledged and applied mitigations. In February 2025, OpenAI published a threat intelligence report detailing how it disrupted multiple threat actors abusing ChatGPT for influence operations and malicious coding. No CVEs specific to OpenAI products appear in the CISA KEV catalog, and no confirmed server-side breach of OpenAI infrastructure has been publicly reported in the 2024–2025 window. Note: Web search was unavailable; events after May 2025 could not be verified — check OpenAI's security page and status page for the latest. |
|
| TrustCloud Corporation | No strong signal |
No confirmed public data breaches, ransomware incidents, cybersecurity compromises, or CISA advisories specifically targeting TrustCloud Corporation (the GRC/compliance automation platform) have been identified through May 2025. TrustCloud is a relatively small, niche vendor in the compliance automation space, which means it receives considerably less public scrutiny and media coverage compared to larger platforms; the absence of public findings does not conclusively confirm the absence of incidents. No CVEs naming TrustCloud products appear in the NVD database or the CISA KEV catalog. TrustCloud publishes trust and compliance information at trustcloud.ai. Note: Web search was unavailable; events after May 2025 could not be verified, and this vendor's smaller profile means incidents may surface with less visibility — manual checks of breach trackers such as HaveIBeenPwned are recommended. |
|
| Availity | No strong signal |
No research notes yet. |
|
| Datadog | No strong signal |
No research notes yet. |
|
| Definitive Healthcare LLC | No strong signal |
No research notes yet. |
|
| Dovetail | No strong signal |
No research notes yet. |
|
| GitHub, Inc. | No strong signal |
No research notes yet. |
|
| JetBrains | No strong signal |
No research notes yet. |
|
| Boomband | No strong signal |
No research notes yet. |
|
| Ordway | No strong signal |
No research notes yet. |
|
| SpockOffice | No strong signal |
No research notes yet. |
|
| Beeceptor | No strong signal |
No research notes yet. |