Vulnerebility Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME |
Info | CATEG. |
WEB |
|
24.10.26 |
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619) | Whenever a new earth shattering vulnerability like php2shell is released on the internet, our research teams are always rushing to determine the best way we can notify our customers about their exposure to it. We’ve had experience with this, both in vulnerabilities discovered by us (wp2shell), but also novel issues such as react2shell, late last year. | Vulnerebility blog | SEARCH LABS |
|
24.10.26 |
Defining a Zero Day Vulnerability | In cybersecurity, “zero day” is frequently diluted and used as a catch-all for any unpatched vulnerability. This article breaks down the three mandatory elements of a true zero day, illustrating why the distinction between a zero day and a known, but unpatched, flaw is critical for effective defense. | Vulnerebility blog | BeyondTrust |
|
24.10.26 |
October 2026 Oracle Critical Patch Update Analysis | Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across the affected Oracle product families. | Vulnerebility blog | Fortra Blog |
|
24.10.26 |
PHP2Noise - Two PHP Critical RCEs Patched As Users Scramble for Fix Amid Misinformation - | A critical PHP exploit leaked ahead of its incoming fix, after PHP alerted users such a fix was incoming. Prior to this fix being released with two critical vulnerabilities being fixed, the internet at large responded quickly by creating alleged PoCs within hours of publication, along with fake recommendations for mitigation. | Vulnerebility blog | Checkmarx |
|
24.10.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | This blog post is about an unauthenticated stored XSS vulnerability in WordPress core, tracked as CVE-2026-93485. If you use WordPress, please update to at least version 7.1.1, or to the latest release in your branch. The fix was backported to every supported branch down to 4.7.36. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth | On 25 July 2026, researchers from HacktronAI achieved remote code execution (RCE) and administrative access on the Discourse web application deployed at community.openai.com. The attack used the image upload feature, where HEIF/AVIF files were processed by ImageMagick and libheif, which contained a previously unknown memory corruption vulnerability. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Two unauthenticated RCE flaws in PHP, with exploitation attempts reported. Who is affected, how to check, and the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. | Vulnerebility blog | Hacktron AI |
|
24.10.26 |
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) | PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific conditions on it, so mass exploitation is less likely than we first expected. Update PHP anyway. | Vulnerebility blog | Sansec |
|
24.10.26 |
PHP2Shell: Critical PHP RCE CVE-2026-109618 & CVE-2026-109619 - Blackpoint Cyber | APG SitRep: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Vulnerebility blog | Blackpoint Cyber |
|
24.10.26 |
php2shell by Calif Research | This story outlines the details of two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz, and addressed in PHP October 2026 Security Release. To understand the bugs, first join us on a journey through time... | Vulnerebility blog | CALIF |
|
24.10.26 |
Understanding PHP2Shell: Everything You Need to Know | On October 20, 2026, PHP announced that they would release a patch on October 21 at 14:00 UTC for two critical vulnerabilities. | Vulnerebility blog | Akamai |
|
24.10.26 |
PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers | On October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team. The two vulnerabilities, combined, are being called PHP2Shell. The vulnerabilities are in PHP Core, which means any web application running on top of PHP is likely vulnerable. Estimates suggest that this is over two-thirds (2/3) of the web. | Vulnerebility blog | LEVELBLUE |
|
24.10.26 |
Now Detecting: CVE-2026-109618/CVE-2026-109619 (php2shell)k | CVE-2026-109618 and CVE-2026-109619 are two remote code execution vulnerabilities in PHP core. The PHP security team rates both CVSS v4.0 9.2 (php.net). The figure of 10.0 that circulated earlier came from the leak, not from PHP. | Vulnerebility blog | Ethiack |
|
24.10.26 |
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline | PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline. | Vulnerebility blog | Socket |
|
24.10.26 |
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches | The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release. | Vulnerebility blog | Socket |
|
24.10.26 |
PHP2Shell Shows the Shrinking Time to Patch | PHP2Shell, the two critical unauthenticated remote code execution vulnerabilities disclosed Wednesday in PHP, had been hiding in one of the Internet’s most widely used software components for more than a decade. Researchers at Calif and Wiz used frontier AI models during the research that led to their discovery and exploitation. | Vulnerebility blog | GAMBIT |
|
24.10.26 |
There's always a patient zero: Defending the NetScaler front door before the patch | The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. | Vulnerebility blog | Cloudflare Blog |
|
24.10.26 |
Major security alert: PHP vulnerable to critical RCE, attacks ongoing | PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. | Vulnerebility blog | Patchstack |
|
24.10.26 |
Improving navigation experience in v0 with Next.js 16.4 | Previously, we shared how a coding agent used the instant() Playwright test helper to make navigations instant in v0, Vercel's AI app builder. That work focused on the core /chat experience. | Vulnerebility blog | Next.js |
|
24.10.26 |
Php2Shell: Two critical PHP flaws disclosed | Php2Shell is the name for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched October 21, 2026. Both memory-safety flaws let unauthenticated attackers run code on any PHP installation serving web requests, including PHP-FPM, Apache mod_php, and php-cgi. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. | Vulnerebility blog | Expel |
|
24.10.26 |
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Patch Now | PHP2Shell is a family of memory-safety bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and rated CVSS 9.2. The PHP Foundation shipped an emergency fix on October 21, 2026. The flaws allow an unauthenticated attacker to execute code as the PHP web worker or read its process memory, including passwords, tokens, and API keys from other users' requests. | Vulnerebility blog | CYMULATE |
|
24.10.26 |
CVE-2026-85267: Google Cloud Shell OAuth Token Theft | How one-click and zero-click WebSocket attack vectors turned Google Cloud Shell into a tunnel for OAuth token theft. | Vulnerebility blog | CYMULATE |
|
24.10.26 |
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask | Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook. | Vulnerebility blog | TrendAI (US) |
|
24.10.26 |
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now | On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon. | Vulnerebility blog | TrendAI (US) |
|
24.10.26 |
PHP2Shell Makes PHP Inventory and Patch Ownership Urgent | PHP2Shell is the name being used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. | Vulnerebility blog | SONATYPE |
|
24.10.26 |
How to Patch PHP2Shell: CVE-2026-109618 & CVE-2026-109619 | The newly released ‘PHP2Shell’ vulnerabilities have become a hot topic hitting the desks, feeds and wires of every cybersecurity professional around the world. Starting October 20th, leaked details, disputed PoCs, conflicting exploitation reports and a patch that was scheduled but not yet released started circulating among security professionals online. | Vulnerebility blog | GuidePoint Security |
|
24.10.26 |
Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days | Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days. | Vulnerebility blog | RAPID7 |
|
24.10.26 |
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP | On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. | Vulnerebility blog | RAPID7 |
|
24.10.26 |
Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL | We uncovered a critical remote code execution vulnerability in Snowflake-managed PostgreSQL, highlighting hidden risks in cloud services. | Vulnerebility blog | VARONIS |
|
24.10.26 |
PHP2Shell: One Upload, Full Server | Varonis Threat Labs' deep dive on the critical PHP2Shell vulnerabilities that allowed remote code execution, affecting millions of websites. | Vulnerebility blog | VARONIS |
|
24.10.26 |
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099 | Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-102764: BeyondTrust Zero-Day Exploited | BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
Cisco Secure Email & PAN-OS Zero-Days Exploited | Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagged both vulnerabilities as known exploited flaws, adding them to its Known Exploited Vulnerabilities (KEV) catalog. | Exploit blog | SOCRADAR |
|
24.10.26 |
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps | Your analysts live in Splunk. Your external risk does not: SOCRadar alarms for dozens of managed companies, and vulnerability findings across an attack surface that changes every day. Why should seeing either one still mean another console, another input per customer, or another spreadsheet of CVEs? | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-105445: Docker Hub PAT Reassignment Flaw | Docker has disclosed CVE-2026-105445, a critical privilege assignment flaw in Docker Hub that could allow an attacker to reuse a personal access token (PAT) after it was reassigned to another user during account-to-organization conversion. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-114625: VeloCloud Orchestrator Flaw Exploited | Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator deployments. The flaw is being exploited in the wild and allows any authenticated portal user, including an Enterprise Read Only account, to gain local superuser operator privileges. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
Oracle October 2026 Critical Patch Update 1209 CVEs |
Oracle addresses 1209 CVEs in its final quarterly update
of 2026 with 1295 patches, including 112 critical updates. |
Vulnerebility blog | Tenable® |
|
24.10.26 |
The Adversary Economy: Threat Actors React to PHP2Shell | Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. | Vulnerebility blog | Tenable® |
|
24.10.26 |
PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 | News of two impending critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP prompted a huge, global overnight effort on Tuesday, October 20 when word of the vulnerabilities' existence leaked ahead of the planned patch release. The PHP team confirmed an upcoming security release shortly after the leak occurred. Naturally, upon seeing the leaked info, a thousand LLMs were immediately pointed at PHP source code. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. It moves the uploaded file to a path built from the raw client-supplied filename, then hands that path to LibreOffice through a shell command. The filename is concatenated into that command with almost no escaping, so a filename carrying shell metacharacters runs arbitrary commands as the web server user (CWE-78). | Vulnerebility blog | VulnCheck |
|
24.10.26 |
Exploring the Risks and Impacts of AI on Vulnerability Discovery and Exploitation | As we hear a lot of noise about AI’s impact on vulnerability discovery and exploitation, I found the need to compartmentalize the risks. So, I took it upon myself to build categories that provide a mental framework for the risks, impact, and evidence AI poses for vulnerabilities and exploitation. Most of these risks aren't new. AI makes the capabilities behind each one more accessible and accelerates how quickly attackers can use them. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
PHP2Shell: Critical PHP RCE Flaws & Runtime Protection | PHP shipped emergency fixes today for two critical flaws in its core engine that let an unauthenticated attacker run code on a web server. If you run PHP anywhere, the move is the same: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. | Vulnerebility blog | OLIGO SECURITY |
|
24.10.26 |
Node.js Brotli Vulnerability (CVE-2026-111497): Detection & Mitigation | Patching is a business process that takes time. OLIGO catches exploitation of this flaw as it happens, inside the workload under attack. | Vulnerebility blog | OLIGO SECURITY |
|
24.10.26 |
Three Critical Pillow CVEs: RCE and Heap Overflows in Python’s Imaging Library - CVE-2026-112900 CVE-2026-112393 CVE-2026-112403 | Three CVSS 9.2 vulnerabilities in the Python imaging library, allow remote code execution and heap corruption via a single malicious image upload | Vulnerebility blog | OX Security |
|
24.10.26 |
Node.js Brotli Decoder Out-of-Bounds Write (RCE) - CVE-2026-111497 | On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with the process’s privileges. | Vulnerebility blog | OX Security |
|
24.10.26 |
PHP2Shell Exposure: 73% of 2.2 Million Version-Disclosing PHP Services Run Unsupported Branches | Two critical vulnerabilities in PHP have put renewed attention on a familiar operational question: how many internet-facing PHP services are running versions that no longer receive upstream security fixes?? We examined existing internet-scan records to measure the PHP versions that services disclose to the public internet. The result was 2,220,231 service records across 224 countries. Nearly three quarters advertised a PHP branch no longer supported by the PHP project. | Vulnerebility blog | Flare |
|
24.10.26 |
Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer | It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. | Vulnerebility blog | ASEC |
|
24.10.26 |
PHP2Shell: Responding to Critical PHP Vulnerabilities | PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP web servers. PHP released fixes on October 21, 2026. | Vulnerebility blog | Threat Spotlight |
|
24.10.26 |
Node2Shell: From Brotli Data to Remote Code Execution | Node2Shell is Imperva Red Team’s name for our analysis of CVE-2026-111497, a High severity flaw in Node.js’s bundled Brotli decoder. Node.js says the out-of-bounds write can permit remote code execution and has released fixes for the 22.x, 24.x, and 26.x lines. | Vulnerebility blog | Imperva |
|
24.10.26 |
PHP2Shell: Early Attack Activity Through Imperva’s Lens | Following the public disclosure of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), Imperva Threat Research observed a sharp increase in scanning and exploitation attempts across protected environments. What had been a small number of unsuccessful probes before disclosure quickly grew into widespread automated activity targeting sites across industries and regions. | Vulnerebility blog | Imperva |
|
24.10.26 |
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released. | Vulnerebility blog | Huntress |
|
24.10.26 |
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619 | CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this behavior. | Vulnerebility blog | Elastic Security Labs |
|
24.10.26 |
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619) | Two critical PHP remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, leaked before their scheduled patch on October 21, 2026 at 14:00 UTC. | Vulnerebility blog | HUNT.IO |
|
24.10.26 |
CVE-2026-109618 and CVE-2026-109619: PHP2Shell | On October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10. The PHP security team has released emergency patches and strongly encouraged all PHP users to update immediately. | Vulnerebility blog | ThreatLabz |
|
24.10.26 |
CVE-2026-88771: NetScaler RCE Exploitation | On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. | Vulnerebility blog | ThreatLabz |
|
24.10.26 |
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell | Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP. | Vulnerebility blog | CrowdStrike |
|
24.10.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
24.10.26 |
PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | Patch now: CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped. | Vulnerebility blog | SECURITY.COM |
|
24.10.26 |
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 | Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance. | Vulnerebility blog | Palo Alto |
|
24.10.26 |
Two critical RCEs in PHP core | Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role in the discovery of these vulnerabilities | Vulnerebility blog | CISCO TALOS |
|
24.10.26 |
PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619 | On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2. They let an unauthenticated attacker run code on a web server, and because the flaws sit in PHP itself rather than in any application or plugin, a site can be exposed even when its own code is secure. | Vulnerebility blog | TRELLIX |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: AI agents running inside restricted evaluation environments had found ways around their network isolation, compromised internal infrastructure, and eventually breached systems at Hugging Face. | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE | It has been a little while since we last looked at Adobe Experience Manager (AEM). We had some excellent findings last time but were just shy of full remote code execution. This time we were able to achieve full unauthenticated remote code execution on AEM Cloud. | Vulnerebility blog | SEARCHLIGHT |
|
17.10.26 |
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) | Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. | Vulnerebility blog | labs.watchtow |
|
17.10.26 |
Submit and Execute: Weaponizing Reflected XSS in Siemens | Siemens Teamcenter is one of the most widely deployed product lifecycle management (PLM) platforms in the world, the system of record for the engineering designs, bills of materials, and approval workflows behind aircraft, vehicles, and industrial hardware. We found that a crafted link could execute JavaScript in the browser of a logged-in Teamcenter user. During an authorized assessment, we used it to silently grant one account the ability to act on behalf of another. | Vulnerebility blog | Bishop Fox |
|
17.10.26 |
TLD Launch Milestones 2026-2027: What Brand Protection Teams Need to Know | New top-level domain (TLD) launches follow public schedules, giving brand protection teams time to prepare defensive registrations, monitoring, and response plans before new namespaces become broadly available. | Vulnerebility blog | NETCRAFT |
|
17.10.26 |
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) | BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. | Vulnerebility blog | Sansec |
|
17.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
17.10.26 |
Next.js Security Update for Upstream Vulnerabilities | Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. | Vulnerebility blog | Next.js |
|
17.10.26 |
LG webOS sync-demo Preauth RCE - | First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. | Vulnerebility blog | SSD Secure Disclosure |
|
17.10.26 |
Now Detecting: CVE-2026-85706 - Unauthenticated Arbitrary File Read in GitLab | A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it. | Vulnerebility blog | Ethiack |
|
17.10.26 |
Suspected Chinese spies hit BeyondTrust via zero-day | A suspected Chinese espionage crew broke into BeyondTrust Remote Support appliances through a flaw nobody knew about, weeks before the vendor disclosed it. Google Threat Intelligence Group (GTIG) and Mandiant say the actor they now call ARMORY CASTLE, previously tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026, then used the hijacked appliances to steal credentials and reach the machines those appliances are trusted to manage. | Vulnerebility blog | IntelFusions |
|
17.10.26 |
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug | Hyperdrive support for MySQL is now generally available (GA). Hyperdrive, Cloudflare’s database connection pooler for Workers, initially only supported Postgres. Since we announced the beta for MySQL protocol support last year, we have been working on making our MySQL handling as reliable as our Postgres support. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
A fully programmable secure web gateway | Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
CVE-2026-89111: Critical SAP Cloud SDK SSRF | SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
Top RCE Vulnerabilities: 10 Critical CVEs and Exploits | A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the most common way attackers get in: it was the initial access vector in 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% the year before, and the median time to fully patch rose from 32 to 43 days. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
October 2026 Microsoft Patch Tuesday | Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild. | Vulnerebility blog | Tenable® |
|
17.10.26 |
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool | VulnCheck is disclosing CVE-2026-49950, a deserialization vulnerability in Xorbits Xoscar that allows for unauthenticated remote code execution. The bug is not in an application endpoint; it is in the transport layer of the actor framework itself. An actor pool is Xoscar's unit of concurrency: a process that hosts actors and exchanges messages with other pools over TCP. | Vulnerebility blog | VulnCheck |
|
17.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality. | Vulnerebility blog | SOPHOS |
|
17.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | SEQRITE |
|
17.10.26 |
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation | I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I'm writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse... | Vulnerebility blog | Check Point Research |
|
13.10.26 |
CVE-2026-102255: Critical SonicWall SMA1000 SSRF | SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances. | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE | Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in the Bricksforge plugin for WordPress. The flaw lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites, resulting in remote code execution (RCE). | Vulnerebility blog | SOCRADAR |
|
10.10.26 |
Why API Security Belongs in ECB Cyber Action Plans | An undocumented partner endpoint or an outdated mobile-banking API can expose customer information even after newer services receive stronger protections. As AI accelerates vulnerability discovery and exploitation, banks need a clearer view of these gaps and a practical way to reduce them. | Vulnerebility blog | Akamai |
|
10.10.26 |
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. | Vulnerebility blog | Akamai |
|
10.10.26 |
Upcoming Next.js Security Update for Upstream Vulnerabilities | Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination. | Vulnerebility blog | Next.js |
|
10.10.26 |
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. | Vulnerebility blog | Huntress |
|
10.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). | Vulnerebility blog | SOPHOS |
|
10.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | Seqrite |
|
10.10.26 |
CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | MLflow is one of the most widely deployed open-source platforms for managing the machine learning lifecycle, from experiment tracking and model versioning to deployment and registry management. | Vulnerebility blog | SonicWall |
|
10.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Adobe Commerce and Magento StyleSmuggler RCE - CVE-2026-75650 | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-75650, assessed its impact, and developed mitigation measures. The flaw, also known as StyleSmuggler, is a critical vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It lets an unauthenticated attacker run arbitrary code on a store by smuggling a template directive through the styles parameters of the storefront API. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
10.10.26 |
Microsoft, Adobe, Apple, and Foxit vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. | Vulnerebility blog | CISCO TALOS |
|
10.10.26 |
Windows Exploitation Techniques: Dangling COM Object Registrations | This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. | Vulnerebility blog | PROJECT ZERO |
|
7.10.26 |
CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters | As early as the beginning of September 2026, eSentire's Threat Response Unit (TRU) observed multiple threat actor clusters exploiting CVE-2026-88771, a zero-day vulnerability later disclosed in Citrix's September 27, 2026 security bulletin CTX697096. | Vulnerebility blog | eSentire |
|
6.10.26 |
CVE-2026-90970: GitLab AI Gateway RCE | GitLab has patched CVE-2026-90970, a critical vulnerability in the Self-Hosted AI Gateway that can allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Introducing the SysQL Skill: Ask your security graph anything | Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. | Vulnerebility blog | Sysdig |
|
3.10.26 |
Separating Signal from Slop: Triaging CVEs in the Age of… | Tools that can read a codebase, identify a vulnerability, and generate a working proof-of-concept have lowered the skill floor for vulnerability research. They also produce a wave of bugs that look terrifying on paper (remote code execution, popular software, no authentication,) yet they often depend on a configuration rarely enabled in real deployments. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
One Port to Root: Weaponizing Check Point Management… | The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
CVE-2026-86950: The Great Glyph Grift | Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics (CVE-2026-86950). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was actually exploited in the wild. | Vulnerebility blog | Calif |
|
3.10.26 |
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators | CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Citrix and security researchers have already documented the vulnerability and its underlying exploitation mechanism. This analysis focuses instead on exploitation activity identified by LevelBlue's Threat Hunt Operations & Research (THOR) team while hunting across multiple customer environments. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler Zero-Day Exploited Globally | On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Hackers exploit FortiMail zero-day before a patch exists | Fortinet says attackers are already exploiting a critical flaw in FortiMail, its email security gateway, and the fixed software has not shipped yet. The bug, tracked as CVE-2026-104286 and rated 9.8 on CVSS v3, lets an attacker with no login write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet rates its impact as executing unauthorized code or commands. | Vulnerebility blog | IntelFusions |
|
3.10.26 |
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) | On Wednesday, September 30, Cisco dropped an out-of-band security advisory highlighting CVE-2026-76504, a brand new critical authentication bypass in the SD-WAN vManage line of products that was disclosed as an exploited zero-day vulnerability. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
JCTables for Joomla: When "Already Escaped" Means Injectable | Today VulnCheck is disclosing CVE-2026-76570, an unauthenticated arbitrary SQL read and write in JCTables, the Joomla data-table component published by JoomCode, that chains to remote code execution as the web user. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
CVE-2026-86950: Apple CoreGraphics Zero-Day | Apple has issued an urgent security patch for CVE-2026-86950, a critical zero-day out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution via malicious files. Exploited in targeted, highly sophisticated attacks against specific individuals, this flaw presents an immediate threat across affected Apple platforms. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
CVE-2026-76504: Cisco SD-WAN Flaw Exploited | Cisco has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated remote attacker to access the management API with administrator privileges. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
TeamViewer Fixes Five Remote Access Flaws | TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, potential code execution, and remote session access control bypass. The company strongly recommends that all users update to the latest available version as soon as possible. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation | On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: | Vulnerebility blog | SOPHOS |
|
3.10.26 |
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction. | Vulnerebility blog | Microsoft blog |
|
3.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
3.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
3.10.26 |
Trust and the enticing consultancy offer | In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by those who require our services, but also by threat actors. | Vulnerebility blog | CISCO TALOS |
|
30.9.26 |
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | On August 31, 2026, eSentire's Threat Response Unit (TRU) detected exploitation of zero-day vulnerabilities disclosed in our security advisory, PaperCut Discloses Zero-Day Vulnerabilities (CVE-2026-82078 and CVE-2026-81578), published on September 3, 2026 affecting a customer in the Education industry. | Vulnerebility blog | eSentire |
|
30.9.26 |
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) | NetScaler, from Citrix (now under Cloud Software Group), is an application delivery controller - some believe it qualifies to be described as a security appliance. | Vulnerebility blog | LABS WATCHTOWR |
|
29.9.26 |
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 | Citrix has released emergency security updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days already exploited in the wild. | Vulnerebility blog | SOCRADAR |
|
29.9.26 |
Citrix NetScaler Zero-Day RCE vulnerabilities: FAQ | CVE-2026-88771 and CVE-2026-88772, two zero-day vulnerabilities in Citrix NetScaler, have been confirmed as exploited in the wild. Citrix released patches on September 27, 2026. | Vulnerebility blog | TENABLE |
|
29.9.26 |
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability | The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second incident, the attacker ran a scanner tool to search for additional Attack Targets. | Vulnerebility blog | ASEC |
|
27.9.26 |
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites | This blog post is about a Cross-Site Request Forgery vulnerability in the Elementor Website Builder plugin. One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an administrator clicking the link creates a second administrator account for the attacker. | Vulnerebility blog | Patchstack |
|
26.9.26 |
MCP Config Poisoning: Text file to RCE | Attackers can weaponize your AI agent tooling just by sneaking a text file into the right place on your system, putting developers and other users at risk. Learn how this works and how to protect yourself and your organization. | Vulnerebility blog | Checkmarx Zero |
|
26.9.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | WordPress 7.1.1 fixes CVE-2026-93485, an unauthenticated stored XSS in wpautop(). The fix was backported to every supported branch from 4.7 onward, so a site below its own branch's patched version is still affected. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
26.9.26 |
PCI DSS Gap: Relying on SAQ A Changes Exposes E-commerce | Cyberattacks targeting e-commerce payment flows continue to escalate, exposing a critical flaw in how online retailers manage client-side security. Ongoing Magecart campaigns are abusing dynamic hosting, ranging from decentralized blockchain infrastructure to trusted third-party platforms, to inject stealthy skimming code across payment networks. | Vulnerebility blog | JSCRAMBLE |
|
26.9.26 |
The Major Shift in Security Vulnerability Management | Security vulnerabilities use a numbering system called CVE (Common Vulnerabilities and Exposures). The CVE number itself is an identifier that distinguishes vulnerabilities. For example, a number like 'CVE-2026-12345' refers to the exact same vulnerability anywhere in the world. | Vulnerebility blog | Enki White Hat |
|
26.9.26 |
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers | On September 4, 2026, Oren Yomtov, a security researcher from Accomplish, responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program. Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised. | Vulnerebility blog | Cloudflare Blog |
|
26.9.26 |
CVE-2026-94127 Explained: F5 BIG-IP APM Heap Overflow Attack | CVE-2026-94127 is a heap-based buffer overflow in F5 BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. Exploitation requires network access to a virtual server configured with an APM access policy and an OAuth profile, with APM operating as an OAuth Authorization Server. | Vulnerebility blog | PICUSSECURITY |
|
26.9.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE | Back in early August 2026, I was 0-day bug hunting in Cisco Smart Software Manager (CSSM). This was where I came across a post-auth RCE vulnerability. This vulnerability, located in the nginx certificate upload, involved command injection via TLS certificates. Unfortunately, a week before I finished the report, the vulnerability was silently patched in their 10-202608 upgrade uploaded on 10 Aug 2026. This short blog will detail the exploit, along with how it got patched. | Vulnerebility blog | STAR Labs |
|
26.9.26 |
Shopware fixes Store API vulnerability allowing administrator takeover | A Shopware vulnerability can lead to administrator takeover and remote code execution. Shopware merchants should install the security update now. | Vulnerebility blog | Sansec |
|
26.9.26 |
Upcoming Next.js September Security Release | Next.js is preparing a scheduled security release for September 30, 2026. This advance notice gives teams time to plan upgrades before patches are published. | Vulnerebility blog | Next.js |
|
26.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
26.9.26 |
Trust and the enticing consultancy offer | In this week’s newsletter Martin muses over a very suspicious elicitation over social media and the true value of trust within the cyber ecosystem. Hubris might be the real vulnerability that the cyber industry must worry about. | Vulnerebility blog | CISCO TALOS |
|
24.9.26 |
CVE-2026-76461 | Learn about CVE-2026-76461, an actively exploited Cisco Secure Email Gateway vulnerability that enables unauthenticated remote code execution and full system compromise through a malicious email. | Vulnerebility blog | Arctic Wolf |
|
24.9.26 |
CVE-2026-87902 in WordPress Enables Conditional RCE | Security updates released for WordPress address CVE-2026-87902, a severe unauthenticated path traversal flaw within its page-template resolution mechanism. The weakness allows the CMS to load arbitrary readable PHP files outside designated theme directories, potentially resulting in Remote Code Execution (RCE) under tailored server and theme setups. | Vulnerebility blog | SOCRADAR |
|
23.9.26 |
Virtualizor: The Login Parameter That Skips the Login | Today VulnCheck's Initial Access Intelligence team is detailing an unauthenticated remote root code execution in Virtualizor, Softaculous' commercial VPS and hypervisor control panel. It provisions and manages KVM/OpenVZ/LXC guests, so its web layer runs as root, which is exactly why a web bug here ends at uid=0 instead of www-data. | Vulnerebility blog | VULNCHECK |
|
22.9.26 |
Click2Shell: WordPress Flaw Enables RCE Chain | Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator’s browser to be manipulated into installing and previewing a theme without explicit consent. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-76460: Cisco ISE Flaw Actively Exploited | CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypasses authentication without requiring user interaction, it opens the door to severe compromise across affected network infrastructure. | Vulnerebility blog | SOCRADAR |
|
22.9.26 |
CVE-2026-91843: Check Point Root RCE | Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthenticated remote attacker could execute arbitrary code with root privileges. | Vulnerebility blog | SOCRADAR |
|
18.9.26 |
What is Style Smuggler (CVE-2026-75650)? | Sansec discovered the vulnerability in Adobe Commerce & Magento and found it being exploited in the wild prior to patches being released, as early as September 4th, 2026 | Vulnerebility blog | Fastly |
|
18.9.26 |
How Cobalt Brings Real-Time Exploit and Threat Intelligence to Vulnerability Findings | Common Vulnerabilities and Exposures (CVE) identify known vulnerabilities in specific components. They don't confirm whether you're exposed or whether attackers are actively exploiting a vulnerability. The additional context from adding reliable threat intelligence and known CVE information to your pentest findings can make the difference between wasting time on research and triage and quickly identifying pressing risks that your business needs to address. | Vulnerebility blog | COBALT.IO |
|
18.9.26 |
CVE-2026-75650: StyleSmuggler — Critical RCE in Adobe Commerce and Magento | We have been tracking a critical, unauthenticated remote code execution (RCE) vulnerability (tracked as CVE-2026-75650 and dubbed StyleSmuggler). Akamai Security Intelligence Group can confirm active exploitation attempts for this vulnerability. | Vulnerebility blog | AKAMAI |
|
18.9.26 |
CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild | On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions. | Vulnerebility blog | RAPID7 |
|
18.9.26 |
CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild | On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance. | Vulnerebility blog | RAPID7 |
|
18.9.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
18.9.26 |
PaperCut NG/MF Unauthenticated Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threats CVE-2026-81578 and CVE-2026-82078, assessed their impact, and developed mitigation measures. Chained together, these two flaws in PaperCut NG and PaperCut MF, a widely deployed print management platform, give an unauthenticated remote attacker code execution on the Application Server. | Vulnerebility blog | SonicWall |
|
17.9.26 |
ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell | Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. | Vulnerebility blog | JFROG |
|
15.9.26 |
GitLab CVE-2026-85706 Added to CISA KEV | CVE-2026-85706 represents a severe path traversal flaw in GitLab CE and EE, permitting unauthenticated remote actors to retrieve arbitrary files from affected self-managed deployments. Following GitLab’s patch release on September 10, 2026, CISA incorporated the security issue into its KEV catalog the next day. | Vulnerebility blog | SOCRADAR |
|
15.9.26 |
Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676 | A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, three bytes of length. `SslClientHelloHandler` has to read both before it knows how much ClientHello to expect, and the standard permits a handshake message to be split across several records, so it must be prepared for the header to arrive incomplete. | Vulnerebility blog | OX SECURITY |
|
12.9.26 |
ShieldCrash PoC: Microsoft Defender Fix Bypass | Microsoft recently fixed CVE-2026-69414 (ShieldBreak), a High-severity elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Cisco FMC CVE-2026-20079 Actively Exploited | Cisco has confirmed active exploitation of CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) with a maximum CVSS score of 10.0. | Vulnerebility blog | SOCRADAR |
|
12.9.26 |
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880) | Microsoft addresses 964 CVEs, smashing July’s release as the largest Patch Tuesday release. This month’s updates include patches for two zero-days that were exploited in the wild | Vulnerebility blog | TENABLE |
|
12.9.26 |
FileRun: Four More Ways to Run Your Files | Today VulnCheck is disclosing four vulnerabilities in FileRun, the self-hosted file manager and sharing platform. They are being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy, and all four were allocated through the VulnCheck CNA. Each one ends in remote code execution as the web-server user: | Vulnerebility blog | VULNCHECK |
|
12.9.26 |
CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox | OX Research found and disclosed a critical vulnerability in DeepSeek Harness, DeepSeek’s open-source AI coding-agent harness, that allowed a sandboxed AI agent to disable its own confinement with a single shell command – on shipped defaults, with no network exposure and no credentials. | Vulnerebility blog | OX SECURITY |
|
12.9.26 |
Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source | TL;DR: CVE-2026-75650, dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. | Vulnerebility blog | IMPERVA |
|
12.9.26 |
UK Council Attack Linked to SonicWall SMA 1000 Campaign | Disclosure note: Hunt.io notified the UK National Cyber Security Centre (NCSC) and other relevant national CERTs ahead of publication, so that affected organisations identified during the research could be contacted. | Vulnerebility blog | HUNT.IO |
|
12.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
12.9.26 |
This SonicWall bug is 2 years old. Akira ransomware is still exploiting it. | The Akira ransomware gang is still breaking into networks through a firewall bug SonicWall fixed two years ago. The critical vulnerability, CVE-2024-40766, carries a CVSS score of 9.3 out of 10. | Vulnerebility blog | THREATDOWN |
|
12.9.26 |
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." | Vulnerebility blog | CISCO TALOS |
|
11.9.26 |
DCOM Service PsmServiceExtHost LPE - SSD Secure Disclosure | Threre is a heap buffer overflow vulnerability in a DCOM service that can be leveraged to achieve LPE from a Medium IL standard user to System IL. | Vulnerebility blog | SSD-DISCLOSURE |
|
10.9.26 |
September 2026 Patch Tuesday: 974 Flaws, 2 Zero-Days | Microsoft’s September 2026 Patch Tuesday release addresses 974 vulnerabilities, including two actively exploited zero-days. Both zero-days are Windows elevation of privilege flaws, and both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
E-Commerce Access, Vedicline Data, Langflow RCE, ASUS Claim, and Energy Shell Access | SOCRadar Dark Web Team identified several new underground posts, including an alleged Bangladeshi e-commerce customer database sale, an alleged Vedicline customer database sale, and a claimed Langflow 1.12.0 zero-day RCE exploit. Other posts advertised an alleged ASUS database and shell access to an Indian energy sector organization. | Vulnerebility blog | SOCRADAR |
|
10.9.26 |
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT | One of the most common entry points for attackers is the exploitation of public-facing edge devices (such as VPNs, routers, and firewalls). Over the years, FortiGate firewalls have remained a consistent target, as evidenced by the recent widespread FortiBleed campaign conducted jointly by the INC and Lynx ransomware groups. | Vulnerebility blog | SOCRADAR |
|
9.9.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Vulnerebility blog | PROOFPOINT |
|
7.9.26 |
N-able N-central HF4 Patches Critical Pre-Auth RCE | N-able has released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to fix CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in its remote monitoring and management platform. The update supersedes three hotfixes issued between August 2 and September 5 and is the current security baseline for the 2026.3 branch. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-73749: HPE ArubaOS-CX RCE | HPE patched CVE-2026-73749, a critical unauthenticated Remote Code Execution (RCE) vulnerability in HPE Aruba Networking AOS-CX, also known as ArubaOS-CX. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
CVE-2026-20212: Cisco Nexus 9000 RCE Flaw | Cisco has disclosed a critical vulnerability, CVE-2026-20212, in the Silicon One integration used by certain Nexus 9000 switches. The flaw allows an unauthenticated remote attacker who can access the affected service to execute code with root privileges. | Vulnerebility blog | SOCRADAR |
|
7.9.26 |
Elementor Pro RCE Flaw Under Active Attack | A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload files through the plugin’s Forms module. Tracked as CVE-2026-32475, the flaw could lead to remote code execution on affected sites. Wordfence reported blocked exploitation attempts beginning August 19, 2026, the same day Elementor released a fix. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
Video encoders can be rooted and no patch is coming | Taking over a QVidium Opera11 video encoder takes one web request, and there is nobody left to ship a fix. The company that built the devices has gone out of business. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
ServiceNow flaws let strangers run code on an instance | ServiceNow has fixed four security flaws in the platform many large organizations use to run their IT service desks, and its own security team scored every one of them at the top of the scale: CVSS 10.0. Three of the four can be reached by someone with no account and no password at all. | Vulnerebility blog | INTELFUSIONS |
|
5.9.26 |
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models | Your scanner just flagged 4,000 new vulnerabilities, 78 of them critical. Which one do you fix first? | Vulnerebility blog | CLOUDFLARE |
|
5.9.26 |
Contagious Interview steps outside the developer workflow | Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. | Vulnerebility blog | JAMF |
|
5.9.26 |
SonicWall CVE-2026-83548 Leads to CISA Alert | SonicWall disclosed two actively exploited vulnerabilities in SMA1000 Series appliances: CVE-2026-83548, a pre-authentication server-side request forgery flaw, and CVE-2026-83549, a post-authentication OS command injection flaw. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
JFrog Artifactory CVE-2026-82329 Exploited | A critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329, is under active exploitation, posing an immediate threat to self-managed software supply chains worldwide. Under default configurations, unauthenticated network attackers can gain full administrative control over exposed instances. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
FalconFlank: CrowdStrike Falcon 0-Day PoC | FalconFlank is an alleged privilege escalation zero-day vulnerability in CrowdStrike Falcon Sensor for Windows, published with working Proof-of-Concept (PoC) code by researcher Chaotic Eclipse. The concern: a security product running with elevated privileges may be tricked, through its own malicious-macro remediation workflow, into acting on an attacker’s behalf. | Vulnerebility blog | SOCRADAR |
|
5.9.26 |
One Blank Field Bypasses Direct Send Control | This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest’s own environment. Nothing in this report should be read as a vulnerability in ReliaQuest’s systems or data. | Vulnerebility blog | RELIAQUEST |
|
5.9.26 |
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help | Microsoft's August 2026 Patch Tuesday included a fix for CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The severity has a CVSS score of 8.0 from Microsoft. | Vulnerebility blog | Zscaler |
|
5.9.26 |
Oracle HTTP & WebLogic Servers Proxy Plug-in Authentication Bypass | The SonicWall Capture Labs threat research team became aware of an unauthenticated authentication bypass vulnerability in Oracle HTTP & WebLogic Servers, assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
|
5.9.26 |
The Bug Report – August 2026 Edition | This blog will walk through the complete kill chain: an attacker enumerates domain-wide SPNs, identifies a vulnerable user account, and silently requests a Kerberos Ticket Granting Service (TGS) ticket encrypted with the weak RC4-HMAC algorithm. | Vulnerebility blog | TRELLIX |
|
3.9.26 |
Langflow and Rails Exploitation Raises Credential Risks | Attackers are exploiting two separate critical vulnerabilities affecting Langflow and Ruby on Rails. CVE-2026-0768 allows unauthenticated attackers to execute Python code on affected Langflow deployments, while CVE-2026-66066 can expose files and application secrets through Rails Active Storage. | Vulnerebility blog | SOCRADAR |
|
31.8.26 |
ServiceNow Patches Multiple CVSS 10.0 Flaws | ServiceNow disclosed four vulnerabilities affecting its AI Platform and related Now Platform components on August 27, 2026. Three received vendor-assigned CVSS v4.0 scores of 10.0, while a fourth was rated 8.7 High. | Vulnerebility blog | |
|
31.8.26 |
PaperCut RCE Chain: CVE-2026-82078 Exploited | PaperCut disclosed two vulnerabilities in PaperCut NG and PaperCut MF that can be chained into a pre-authentication Remote Code Execution (RCE) path against vulnerable Application Servers. | Vulnerebility blog | SOCRADAR |
|
29.8.26 |
The August 2026 security release is now available. Upgrade to 16.3.3 (Active LTS) or 15.5.24 (Maintenance LTS) now to address two Critical severity vulnerabilities. |
|||
|
29.8.26 |
Next.js is moving the August security release forward to August 25, 2026. |
|||
|
29.8.26 |
A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. |
|||
|
29.8.26 |
On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. |
|||
|
29.8.26 |
A critical vulnerability chain tracked as CVE-2026-18431 affects the Avada WordPress theme and its required Fusion Builder plugin, now branded as Avada Builder. The flaw carries a CVSS score of 9.8 and can allow an unauthenticated attacker to write and execute arbitrary PHP files, potentially leading to complete site compromise. |
|||
|
29.8.26 |
Cisco released security updates for Cisco Crosswork and Cisco Secure Workload, addressing nine vulnerabilities across the two product families. |
|||
|
29.8.26 |
GitLab has patched CVE-2026-19478, a critical code injection vulnerability affecting self-managed Community Edition (CE) and Enterprise Edition (EE) instances. Under certain conditions, an unauthenticated remote attacker could leverage a GraphQL directive to modify or delete public projects and user data. |
|||
|
29.8.26 |
Microsoft recently disclosed CVE-2026-69836, a critical Remote Code Execution (RCE) vulnerability in Microsoft Entra ID (formerly Azure Active Directory). Because this issue affected a Microsoft-hosted cloud service, remediation was applied on the backend rather than through a traditional customer patch. |
|||
|
29.8.26 |
What CISA's FY2024-2025 Vulnerability Review Means for Runtime Security |
CISA's new Vulnerability Review for Fiscal Years 2024 and 2025 opens by correcting a widely held assumption. Cybersecurity conversations naturally gravitate toward nation-state adversaries and novel zero-days, but most compromises have not relied on advanced techniques. |
||
| 29.8.26 | Not another Log4Shell: inside the Log4j 2 deserialization allowlist bypass | We reproduced this java deserialization vulnerability against official Log4j 2.26.1 JARs. Getting to command execution took two more things that Log4j itself does not ship. Here is how the bypass works, which versions carry it, and what to hunt for. | Vulnerebility blog | ELASTIC |
| 27.8.26 | Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain | Blog | VulnCheck | VulnCheck’s Initial Access Intelligence team shipped an exploit last week chaining two recently disclosed Microsoft SharePoint CVEs that, when used together, allow a remote unauthenticated adversary to bypass authentication and execute code on vulnerable target SharePoint servers. | Vulnerebility blog | VULNCHECK |
| 27.8.26 | Tenable & SentinelOne: 93 CVEs Expose Edge Risk | Tenable® | A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. | Vulnerebility blog | TENABLE |
| 22.8.26 | CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway | On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges. | Vulnerebility blog | RAPID7 |
|
22.8.26 |
Critical infrastructure security Is back in the headlines | Recent cyber threats affecting water infrastructure and industrial control systems have renewed attention on the cybersecurity challenges facing critical infrastructure across the United States. This article examines emerging risks to water utilities, proposed legislation aimed at improving resilience and the ongoing debate over how critical infrastructure security should be funded and managed. | Vulnerebility blog | BARRACUDA |
| 22.8.26 | Threat Spotlight: The average web application has 20 security vulnerabilities | Barracuda research finds the average web application has 20 security vulnerabilities. Learn the seven most common flaw types and how to reduce risk. | Vulnerebility blog | BARRACUDA |
|
22.8.26 |
CVE-2026-19490: NetScaler Auth Bypass Patched | CVE-2026-19490: NetScaler Auth Bypass Patched Cloud Software Group released a critical security bulletin for customer-managed NetScaler ADC and NetScaler Gateway deployments, fixing two vulnerabilitie... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
CVE-2026-69836: Microsoft Entra ID RCE Exploited | CVE-2026-69836: Microsoft Entra ID RCE Exploited Microsoft has disclosed CVE-2026-69836, a maximum-severity Remote Code Execution (RCE) vulnerability in Microsoft Entra ID, the cloud identity and acce... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
Windows IKE CVE-2026-33824 Added to CISA KEV | Windows IKE CVE-2026-33824 Added to CISA KEV Windows IKE CVE-2026-33824 is now in CISA’s Known Exploited Vulnerabilities catalog, giving defenders a short deadline to verify patching and exposure. CIS... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
July 2026: OpenAI Agent Incident, KDDI Breach | July 2026: OpenAI Agent Incident, KDDI Breach July 2026 brought a mix of large scale data exposures, supply chain access risks, credential-driven activity, and a new kind of AI-related incident respon... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
Can NVD Modernization Keep Pace With AI? | Can NVD Modernization Keep Pace With AI? AI can help security teams find vulnerabilities faster. That sounds entirely positive until we consider what happens after those vulnerabilities are found. Eve... | Vulnerebility blog | SOCRADAR |
|
22.8.26 |
Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs | Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates. | Vulnerebility blog | TENABLE |
|
22.8.26 |
FileRun: When Your File Manager Runs Your Files | Today VulnCheck is disclosing CVE-2026-14863, an OS command injection to remote code execution in FileRun, a commercial self-hosted file manager. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated. | Vulnerebility blog | VULNCHECK |
|
22.8.26 |
Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive | Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. | Vulnerebility blog | OX |
|
22.8.26 |
Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure | vm2’s sandbox denylist forgot two modules: “os” and “dns.” Under the wildcard config vm2’s own docs recommend, that gap lets sandboxed code read the host process owner’s identity and hijack the host’s DNS with a single call — a change that outlives the sandbox run and never notifies the embedder. Patched in 3.11.6. | Vulnerebility blog | OX |
|
22.8.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
15.8.26 |
NightmareEclipse releases new PoC, ShieldBreak, exploits same weakness as RoguePlanet | NightmareEclipse claims Microsoft did not properly patch RoguePlanet vulnerability | Vulnerebility blog | THREATLOCKER |
|
15.8.26 |
FileRun: When Your File Manager Runs Your Files | Today VulnCheck is disclosing CVE-2026-14863, an OS command injection to remote code execution in FileRun, a commercial self-hosted file manager. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated. | Vulnerebility blog | VULNCHECK |
|
8.8.26 |
XSS2Shell (CVE-2026-64638): Patch WordPress Now | XSS2Shell (CVE-2026-64638): Patch WordPress Now A new WordPress Core vulnerability chain called XSS2Shell turns a login page XSS bug into a much more serious risk for exposed WordPress sites. The issu... | Vulnerebility blog | SOCRADAR |
|
7.8.26 |
CVE-2026-44613: Turning a CSRF into Silent Unauthorized Actions | Apache Zeppelin’s default CORS configuration allowed cross-origin, credentialed, state-changing requests (and accepted text/plain request bodies), letting a remote attacker who lures an authenticated user to a malicious site perform unauthorized actions through Zeppelin’s REST and WebSocket endpoints. | Vulnerebility blog | OX |
|
8.8.26 |
Secure Agent Harness Execution: Preventing Escape | CrowdStrike uses a defense-in-depth architecture, consisting of seven independent control layers, to prevent autonomous AI agents from taking unintended actions. | Vulnerebility blog | CROWDSTRIKE |
|
8.8.26 |
N-able N-central exploitation results in RMM tool deployment | After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access | Vulnerebility blog | SOPHOS |
|
1.8.26 |
Apple Libnotify/notifyd Stack Overflow (CVE-2026-64739) — Discovered by ThreatBook XGPT | On July 27, 2026, Apple released security updates for iOS 26.6 and iPadOS 26.6, fixing vulnerabilities across several components — Accessibility, Kernel, Libnotify, and WebKit. Among them is CVE-2026-64739, a stack-based buffer overflow in Libnotify/notifyd found and reported to Apple by ThreatBook XGPT. | Vulnerebility blog | THREATBOOK |
|
1.8.26 |
DbGate JSON Script Runner Unauthenticated Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-47668, assessed its impact, and developed mitigation measures. The flaw, also known as the DbGate JSON Script Runner Unauthenticated Remote Code Execution, is a critical vulnerability affecting the DbGate web-based database manager (dbgate/dbgate, distributed on npm as dbgate-serve) in all versions up to and including 7.1.8 | Vulnerebility blog | SonicWall |
|
25.7.26 |
In code we trust? Why the most trusted software receives the least scrutiny. | Recent CVEs across GitHub, Anthropic, Google, dbt, and MISP expose a simple truth: the most trusted code is often the least questioned. As organizations connect AI agents to production systems, those overlooked assumptions can become powerful new attack paths. | Vulnerebility blog | SOPHOS |
|
25.7.26 |
Volume Is Not Risk: Making Sense of the 'Vulnpocalypse' | A briefing for security leaders on separating vulnerability disclosure volume from exploitable risk in 2026. | Vulnerebility blog | Trend Micro |
|
25.7.26 |
Joomla Multiple COM Extensions Unauthenticated File Uploads to RCE | Joomla! Multiple COM_Extensions Unauthenticated File Uploads to RCE | Vulnerebility blog | SonicWall |
|
18.7.26 |
SonicWall SMA1000 vulnerabilities in active exploitation | On July 14, 2026, SonicWall disclosed two vulnerabilities in SonicWall SMA1000 appliances. Models 6210, 7210, and 8200v are affected. | Vulnerebility blog | SOPHOS |
|
18.7.26 |
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy | We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure. | Vulnerebility blog | Palo Alto |
|
18.7.26 |
Begun, the Patch Wars have | Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story. | Vulnerebility blog | CISCO TALOS |
|
18.7.26 |
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical." | Vulnerebility blog | CISCO TALOS |
|
18.7.26 |
WolfSSL, GeoVision, VTK vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in WolfSSF, fourteen in GeoVision, and one vulnerability in VTK-DICOM. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to | Vulnerebility blog | CISCO TALOS |
| 11.7.26 | rclone Remote-Control API Unauthenticated Command Execution | rclone Remote-Control API Unauthenticated Command Execution (CVE-2026-41179) | Vulnerebility blog | SonicWall |
| 4.7.26 | Joomla Content Editor Remote Code Execution | The SonicWall Capture Labs threat research team became aware of a PHP code upload and execution vulnerability in Joomla products, assessed its impact, and developed mitigation measures. Joomla is a free, open-source Content Management System (CMS) used to build and manage websites and online applications. It serves as a powerful, flexible alternative to platforms like WordPress, offering extensive customization through thousands of extensions and templates. | Vulnerebility blog | SonicWall |
| 27.6.26 | Mythos Finds Vulnerabilities. But Can Anyone Patch Fast Enough? | Security teams are scrambling to reprioritize their security plans based on the revelation of Anthropic’s Mythos model, and its ability to rapidly discover security vulnerabilities. T | Vulnerebility blog | Eclypsium |
| 27.6.26 | CISA BOD 26-04: What it Means and How Eclypsium Can Help | The new CISA BOD 26-04 shifts the focus from simply patching vulnerabilities to actively identifying and replacing internet-facing edge devices that are at or beyond vendor support. | Vulnerebility blog | Eclypsium |
| 27.6.26 | CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | The SonicWall Capture Labs threat research team has identified active exploitation attempts targeting CVE-2025-7544, a critical stack-based buffer overflow vulnerability affecting Tenda AC1206 routers running firmware version 15.03.06.23. | Vulnerebility blog | SonicWall |
| 19.6.26 | No Patch Coming: The Arista EOS Tunnel Bug Your Scanner Will Miss | CVE-2026-7473 allows an attacker to sneak traffic into your network; there is no fix planned, and because the flaw lives in configuration rather than in a version number, your scanner will likely miss it. | Vulnerebility blog | Eclypsium |
| 19.6.26 | File Browser Hook Command Runner OS Command Injection | File Browser Hook Command Runner OS Command Injection (CVE-2026-35585) | Vulnerebility blog | SonicWall |
| 13.6.26 | Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open | Two separate Russia-aligned campaigns are still exploiting the WinRAR flaw CVE-2025-8088 against Ukrainian organizations nearly a year after it was patched, showing how unmanaged software keeps an exploited entry point open long after the fix ships. | Vulnerebility blog | Trend Micro |
| 13.6.26 | Microsoft Security Bulletin Coverage for June 2026 | Microsoft’s June 2026 Patch Tuesday has 210 vulnerabilities, of which 67 are Elevation of Privilege. SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of June 2026 and has produced coverage for 14 of the reported vulnerabilities. | Vulnerebility blog | SonicWall |
| 13.6.26 | Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 | Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS® software, which could allow unauthorized attackers to circumvent security controls and initiate VPN connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 29. | Vulnerebility blog | Palo Alto |
| 6.6.26 | NGINX Rift Rewrite Module Remote Code Execution | The SonicWall Capture Labs threat research team became aware of a heap buffer overflow vulnerability in NGINX products, assessed its impact and developed mitigation measures. NGINX is the top web server and reverse proxy globally. | Vulnerebility blog | SonicWall |
| 6.6.26 | Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 | Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. | Vulnerebility blog | Palo Alto |
| 6.6.26 | Less panic patching, more precision | In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter. | Vulnerebility blog | CISCO TALOS |
| 6.6.26 | MediaArea heap-based buffer overflow vulnerabilities | EvidenceForge generates high-quality, realistic, and consistent datasets across multiple log formats, enabling teams to effectively train personnel and validate detection models without the need for complex manual simulations. | Vulnerebility blog | CISCO TALOS |
| 6.6.26 | Lessons for life: Why children’s data is a long-term identity risk | Your child’s first data breach may happen before they’ve even opened a bank account. Here’s how to keep their digital life safe. | Vulnerebility blog | Eset |
| 30.5.26 | H2O-3 Unauthenticated RCE via PostgreSQL JDBC socketFactory | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-3960, assessed its impact, and developed mitigation measures for this vulnerability. The flaw, also known as the H2O-3 ImportSQLTable PostgreSQL JDBC SocketFactory RCE, is a critical remote code execution vulnerability affecting the open-source H2O-3 machine learning platform (h2oai/h2o-3) in all releases up to and including 3.46.0.9 | Vulnerebility blog | SonicWall |
| 30.5.26 | MediaArea heap-based buffer overflow vulnerabilities | Talos researchers find 4 heap-based buffer overflow vulnerabilities in MediaArea's MediaInfoLib. | Vulnerebility blog | CISCO TALOS |
| 16.5.26 | Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for May 2026, which includes 137 vulnerabilities affecting a range of products, including 16 that Microsoft marked as “critical”. | Vulnerebility blog | CISCO TALOS |
| 16.5.26 | On the Effectiveness of Mutational Grammar Fuzzing | Mutational grammar fuzzing is a fuzzing technique in which the fuzzer uses a predefined grammar that describes the structure of the samples. When a sample gets mutated, the mutations happen in such a way that any resulting samples still adhere to the grammar rules, thus the structure of the samples gets maintained by the mutation process. | Vulnerebility blog | Project Zero |
| 9.5.26 | Pull the Plug: FIRESTARTER Survives Patches, Reboots, and Your Incident Response Plan | You patched your Cisco ASA. You rebooted it. Your vulnerability scanner shows green. You closed the ticket. However, the backdoor is still there! | Vulnerebility blog | Eclypsium |
| 9.5.26 | Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution | On May 6, 2026, Palo Alto Networks released a security advisory for CVE-2026-0300, identifying a buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. Vulnerable systems allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. | Vulnerebility blog | Palo Alto |
| 9.5.26 | Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years | On April 29, 2026, researchers publicly disclosed a highly reliable local privilege escalation (LPE) vulnerability tracked as CVE-2026-31431. This vulnerability is commonly referred to as Copy Fail. Discovered in about an hour through an AI-assisted process, this logic flaw allows an unprivileged local attacker to consistently escalate their access to root across virtually all major Linux distributions released since 2017. | Vulnerebility blog | Palo Alto |
| 2.5.26 | CISA’s Advisory On Botnets: Why Banning SOHO Routers Won’t Fix Critical Infrastructure Cyber Risk | CISA recently released a new cybersecurity advisory focused on defending against botnets built from compromised consumer and small-office/home-office (SOHO) routers. The advisory highlights how threat actors are actively exploiting vulnerable, internet-exposed devices to build large-scale proxy networks. | Vulnerebility blog | Eclypsium |
| 25.4.26 | The calm before the ransom: What you see is not all there is | A breach claims the systems as well as the confidence that was, in retrospect, a major vulnerability | Vulnerebility blog | Eset |
| 18.4.26 | The Week in Vulnerabilities: Azure AI, Spring AI, Fortinet, and Critical ICS Exposure | Cyble’s weekly vulnerability report tracked 1,431 vulnerabilities and 6 ICS flaws last week. Know more... | Vulnerebility blog | Cyble |
| 18.4.26 | A Deep Dive Into Attempted Exploitation of CVE-2023-33538 | We identified active, automated scans and probes attempting to exploit CVE-2023-33538, a vulnerability in several end-of-life TP-Link Wi-Fi router models: | Vulnerebility blog | Palo Alto |
| 18.4.26 | The Q1 vulnerability pulse | Thor provides an overview of the Q1 2026 vulnerability statistics, highlighting key trends in legacy CVEs and the evolving impact of AI on the threat landscape. | Vulnerebility blog | CISCO TALOS |
| 18.4.26 | Foxit, LibRaw vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed one Foxit Reader vulnerability, and six LibRaw file reader vulnerabilities. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s thir | Vulnerebility blog | CISCO TALOS |
| 11.4.26 | Eclypsium Detects F5 BIG-IP Remote Code Execution Vulnerability (CVE-2025-53521) | A vulnerability in F5 BIG-IP systems that allows unauthenticated remote code execution by attackers has been added to the CISA Known Exploited Vulnerabilities catalog. CVE-2025-53521 was disclosed on October 15, 2025, but only added to the KEV on March 27, 2026. The vulnerability was originally given a severity score of 7.5, but was adjusted upward to 9.8 when new information emerged in March. | Vulnerebility blog | Eclypsium |
| 11.4.26 | The Week in Vulnerabilities: OpenClaw, FreeBSD, F5 BIG-IP, and Critical ICS Bugs | Vulnerabilities in OpenClaw, FreeBSD, F5 BIG-IP, and industrial control systems show risks growing across enterprise and critical infrastructure environments. | Vulnerebility blog | Cyble |
| 11.4.26 | Year in Review: Vulnerabilities old and new and something React2 | The year was characterized by an unending beat-down on infrastructure that relied on older enmeshed dependencies (e.g., Log4j and PHPUnit), while React2Shell rocketed to the highest percentage of attacks for the entire year within the last three weeks of 2025. | Vulnerebility blog | CISCO TALOS |
| 4.4.26 | Eclypsium Detects F5 BIG-IP Remote Code Execution Vulnerability (CVE-2025-53521) | A vulnerability in F5 BIG-IP systems that allows unauthenticated remote code execution by attackers has been added to the CISA Known Exploited Vulnerabilities catalog. CVE-2025-53521 was disclosed on October 15, 2025, but only added to the KEV on March 27, 2026. | Vulnerebility blog | Eclypsium |
| 4.4.26 | Three Decades for a 3-Line Fix: The Critical telnetd Bug Hiding in Plain Sight (CVE-2026-32746) | The SonicWall Capture Labs threat research team became aware of an out-of-bounds write vulnerability in the Telnet server shipped with GNU Inetutils, assessed its impact and developed mitigation measures. Telnetd hardly needs an introduction. It is one of the oldest and most widely distributed network utilities on Linux systems. | Vulnerebility blog | SonicWall |
| 28.3.26 | Juniper JunOS Evolved Pre-authenticated Remote Code Execution (CVE-2026-21902) | The SonicWall Capture Labs threat research team became aware of a severe unauthenticated Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved (PTX Series), assessed their impact, and developed mitigation measures. | Vulnerebility blog | SonicWall |
| 28.3.26 | Three Decades for a 3-Line Fix: The Critical telnetd Bug Hiding in Plain Sight (CVE-2026-32746) | The SonicWall Capture Labs threat research team became aware of an out-of-bounds write vulnerability in the Telnet server shipped with GNU Inetutils, assessed its impact and developed mitigation measures. Telnetd hardly needs an introduction. It is one of the oldest and most widely distributed network utilities on Linux systems. | Vulnerebility blog | SonicWall |
| 28.3.26 | Google Authenticator: The Hidden Mechanisms of Passwordless Authentication | Passwordless authentication is often presented as the end of account takeover. But to understand the real threat landscape, we need to examine how passwordless is actually deployed in the real world. Attackers do not break protocols in theory. | Vulnerebility blog | Palo Alto |
| 28.3.26 | TP-Link, Canva, HikVision vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed a vulnerability in HikVision, as well as 10 in TP-Link, and 19 in Canva. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-p | Vulnerebility blog | CISCO TALOS |
| 21.3.26 | Your KVM is the Weak Link: How $30 Devices Can Own Your Entire Network | 9 vulnerabilities across 4 vendors turn low-cost IP-KVMs into attack platforms | Vulnerebility blog | Eclypsium |
| 21.3.26 | The Week in Vulnerabilities: Juniper, Cisco SD-WAN, and Critical ICS Exposure | Critical Juniper, Cisco SD-WAN, and EV charging infrastructure vulnerabilities surfaced on underground forums, while ICS flaws impacted Energy and Transportation sectors. | Vulnerebility blog | Cyble |
| 21.3.26 | Juniper JunOS Evolved Pre-authenticated Remote Code Execution (CVE-2026-21902) | The SonicWall Capture Labs threat research team became aware of a severe unauthenticated Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved (PTX Series), assessed their impact, and developed mitigation measures. Juniper PTX Series routers are high-performance core and peering routers built for high throughput, low latency, and scale. They are commonly used by internet service providers, telecommunication services, and cloud network applications. | Vulnerebility blog | SonicWall |
| 21.3.26 | A Deep Dive into the GetProcessHandleFromHwnd API | In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. | Vulnerebility blog | PROJECT ZERO |
| 14.3.26 | DirectX, OpenFOAM, Libbiosig vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in the BioSig Project Libbiosig library and OpenCFD OpenFOAM, as well as an unpatched vulnerability in Microsoft DirectX. The vulnerabilities mentioned in this blog post have been patched | Vulnerebility blog | CISCO TALOS |
| 14.3.26 | Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for March 2026 which includes 79 vulnerabilities, including three that Microsoft marked as “critical.” | Vulnerebility blog | CISCO TALOS |
| 7.3.26 | Budibase Cloud View Filter Eval Injection Allows Full Remote Code Execution | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-27702, assessed its impact, and developed mitigation measures for this vulnerability. CVE-2026-27702, also known as Budibase Cloud View Filter Map Function RCE, is a critical remote code execution vulnerability affecting Budibase in versions prior to 3.30.4. | Vulnerebility blog | SonicWall |
| 7.3.26 | Patch, track, repeat: The 2025 CVE retrospective | Thor analyzes CVE data from 2025 and provides recommendations for where and how organizations should strengthen their defenses. | Vulnerebility blog | CISCO TALOS |
| 28.2.26 | Cisco SD-WAN vulnerabilities (CVE-2026-20127, CVE-2022-20775) in active exploitation | On February 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and UK National Cyber Security Centre warned that vulnerabilities affecting Cisco software-defined wide-area network (SD-WAN) systems (CVE-2026-20127 and CVE-2022-20775) are actively being exploited. | Vulnerebility blog | SOPHOS |
| 28.2.26 | Mandiant and Google Threat Intelligence Group (GTIG) have identified the zero-day exploitation of a high-risk vulnerability in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769, with a CVSSv3.1 score of 10.0 | Vulnerebility blog | GTI | |
| 28.2.26 | The Week in Vulnerabilities: WordPress, BeyondTrust, and Critical ICS Bugs | Critical WordPress, BeyondTrust, Honeywell CCTV, and PUSR router vulnerabilities surfaced on underground forums, while CISA issued 8 ICS advisories impacting critical manufacturing sectors. | Vulnerebility blog | Cyble |
| 28.2.26 | From Token Theft to Full System Takeover: Breaking OpenClaw’s RCE Flaw (CVE-2026-25253) | The SonicWall Capture Labs threat research team became aware of an authentication token theft vulnerability in OpenClaw, assessed its impact and developed mitigation measures. OpenClaw is a widely used open-source AI assistant platform that integrates with numerous messaging services and provides deep system-level capabilities. | Vulnerebility blog | SonicWall |
| 28.2.26 | Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 | Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. | Vulnerebility blog | CHECKPOINT |
| 28.2.26 | Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 | Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that allows an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. | Vulnerebility blog | CISCO TALOS |
| 28.2.26 | “Good enough” emulation: Fuzzing a single thread to uncover vulnerabilities | A Talos researcher used targeted emulation of the Socomec DIRIS M-70 gateway’s Modbus thread to uncover six patched vulnerabilities, showcasing efficient tools and methods for IoT security testing. | Vulnerebility blog | CISCO TALOS |
| 21.2.26 | The Week in Vulnerabilities: SolarWinds, Ivanti, and Critical ICS Exposure | Critical SolarWinds, Ivanti EPMM, Microsoft Office, and Siemens ICS vulnerabilities are being discussed on underground forums, while 15 CISA ICS advisories impacted Energy and Critical Manufacturing sectors. | Vulnerebility blog | Cyble |
| 21.2.26 | VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731) | On Feb. 6, 2026, BeyondTrust released a security advisory regarding CVE-2026-1731. BeyondTrust is an identity and access management platform. This specific vulnerability involves a pre-authentication remote code execution (RCE) issue within BeyondTrust remote support software. | Vulnerebility blog | Palo Alto |
| 21.2.26 | Critical Vulnerabilities in Ivanti EPMM Exploited | Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) affecting Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, affecting enterprise mobile fleets and corporate networks. These vulnerabilities allow unauthenticated attackers to remotely execute arbitrary code on target servers, granting them full control over mobile device management (MDM) infrastructure without requiring user interaction or credentials. | Vulnerebility blog | Palo Alto |
| 14.2.26 | The Week in Vulnerabilities: SolarWinds, AI Fixes Urged by Cyble | SolarWinds Web Help Desk and OpenClaw flaws are among the vulnerabilities, drawing significant interest by threat actors. | Vulnerebility blog | Cyble |
| 14.2.26 | The Bug Report - January 2026 Edition | New Year, new exploits! We break down critical January CVEs in Microsoft Office, n8n, and AI tools. Don't let your resolution be a breach—read the report. | Vulnerebility blog | Trelix |
| 7.2.2026 | The Week in Vulnerabilities: Open-Sources Fixes Urged by Cyble | Vulnerabilities affecting n8n, OpenSSL and GNU Inetutils are among the flaws being noticed by threat actors and security researchers alike. | Vulnerebility blog | Cyble |
| 7.2.2026 | Living Off Legit Tools: Stealthy Installation of Remote Monitoring Agents Using SmartScreen Bypass | Recently, the SonicWall Capture Labs threat research team has observed a new campaign delivering batch files leading to unwanted installation of remote connect software like ScreenConnect or Action1 Agent. Once installed, a service is created so, threat actors may get control of the infected system. | Vulnerebility blog | SonicWall |
| 1.2.26 | Microsoft Office vulnerability (CVE-2026-21509) in active exploitation | On January 26, 2026, Microsoft released an out-of-band update to address a high-severity (CVSS score of 7.8) vulnerability affecting multiple Microsoft Office products. This vulnerability, tracked as CVE-2026-21509, is being actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. | Vulnerebility blog | SOPHOS |
| 1.2.26 | Fortinet Under Fire: Why Your Network Edge Remains Attackers' Favorite Entry Point | Fortinet’s January patch for CVE-2025-59718 didn’t hold. On January 21, FortiGate admins began reporting that patched systems were still being exploited. Two days later, Fortinet confirmed the patch had failed to fully remediate the vulnerability. As reported by BleepingComputer, Fortinet is now recommending that admins restrict administrative access and disable FortiCloud SSO while they work on a follow-up fix. | Vulnerebility blog | Eclypsium |
| 1.2.26 | Fortinet Under Fire: Why Your Network Edge Remains Attackers' Favorite Entry Point | Fortinet’s January patch for CVE-2025-59718 didn’t hold. On January 21, FortiGate admins began reporting that patched systems were still being exploited. Two days later, Fortinet confirmed the patch had failed to fully remediate the vulnerability. As reported by BleepingComputer, Fortinet is now recommending that admins restrict administrative access and disable FortiCloud SSO while they work on a follow-up fix. | Vulnerebility blog | Eclypsium |
| 1.2.26 | The Week in Vulnerabilities: Cyble Urges Oracle, OpenStack Fixes | Oracle, OpenStack, SAP, Salesforce and ServiceNow are among the high-profile enterprise products with vulnerabilities in need of attention by security teams. | Vulnerebility blog | Cyble |
| 1.2.26 | "Ni8mare" - RCE Vulnerability in N8n AI Workflow Automation (CVE-2026-21858) | The SonicWall Capture Labs threat research team became aware of a Critical unauthenticated file read vulnerability in n8n – a flexible AI workflow automation platform, assessed their impact, and developed mitigation measures. | Vulnerebility blog | SonicWall |
| 1.2.26 | Multiple vulnerabilities in SolarWinds Web Help Desk Leading to RCE: CVE-2025-40551 | The SonicWall Capture Labs threat research team became aware of a critical vulnerability chain in SolarWinds Web Help Desk (WHD), assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
| 1.2.26 | Foxit, Epic Games Store, MedDreams vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Foxit PDF Editor, one in the Epic Games Store, and twenty-one in MedDream PACS.. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, al | Vulnerebility blog | CISCO TALOS |
| 1.2.26 | Microsoft releases update to address zero-day vulnerability in Microsoft Office | Microsoft has published three out-of-band (OOB) updates so far in January 2026. One of these updates was released to address a vulnerability, CVE-2026-21509, affecting Microsoft Office that has been reportedly exploited in the wild. | Vulnerebility blog | CISCO TALOS |
| 1.2.26 | Bypassing Windows Administrator Protection | A headline feature introduced in the latest release of Windows 11, 25H2 is Administrator Protection. The goal of this feature is to replace User Account Control (UAC) with a more robust and importantly, securable system to allow a local user to access administrator privileges only when necessary. | Vulnerebility blog | Project Zero |
| 24.1.26 | Foxit, Epic Games Store, MedDreams vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Foxit PDF Editor, one in the Epic Games Store, and twenty-one in MedDream PACS.. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, al | Vulnerebility blog | CISCO TALOS |
| 17.1.26 | Executive Summary Check Point Research identified active, large-scale exploitation of CVE-2025-37164, a critical remote code ... | Vulnerebility blog | CHECKPOINT | |
| 17.1.26 | Threat Brief: MongoDB Vulnerability (CVE-2025-14847) | On Dec. 19, 2025, MongoDB publicly disclosed MongoBleed, a security vulnerability (CVE-2025-14847) that allows unauthenticated attackers to leak sensitive heap memory by exploiting a trust issue in how MongoDB Server handles zlib-compressed network messages. This flaw occurs prior to authentication, meaning an attacker only needs network access to the database's default port to trigger it. | Vulnerebility blog | Palo Alto |
| 17.1.26 | Analyzing React2Shell Threat Actors | In this installment of the Sensor Intel Series, we provide an analysis of the most exploited vulnerabilities, highlighting trends and significant activity, with a deep-dive into React2Shell exploitation attempts, methods and tactics. This article focuses on the top 10 CVEs, their rankings, and long-term trends, offering insights into the evolving threat landscape. | Vulnerebility blog | F5 |
| 10.1.26 | The Week in Vulnerabilities: 2026 Starts with 100 PoCs and New Exploits | The year may be a little more than a week old, but threat actors have already amassed nearly 100 Proof of Concepts and newly exploited vulnerabilities. | Vulnerebility blog | |
| 10.1.26 | Singapore Cyber Agency Warns of Critical IBM API Connect Vulnerability (CVE-2025-13915) | A critical authentication bypass flaw, CVE-2025-13915, affects IBM API Connect. Singapore issues alert as IBM releases fixes. | Vulnerebility blog | |
| 10.1.26 | Fortinet Under Fire: Why Your Network Edge Remains Attackers' Favorite Entry Point | CVE-2020-12812, a five-year-old authentication bypass flaw that should have been relegated to history, is being actively exploited. Coming on the heels of two brand-new SAML authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) discovered in late 2025, Fortinet administrators must be on high alert and work to remediate them as quickly as possible, as the trend of network device exploitation is continuing. | Vulnerebility blog | Eclypsium |
| 10.1.26 | MongoBleed MongoDB SBE Use-After-Free (CVE-2025-6706 / CVE-2025-14847) | SonicWall Capture Labs threat research team became aware of the threats CVE-2025-6706 and CVE-2025-14847, assessed their impact, and developed mitigation measures for these vulnerabilities. CVE-2025-6706, also known as MongoDB SBE Use-After-Free, is a critical memory corruption vulnerability affecting MongoDB Server in versions 7.0.0 through 7.0.16. | Vulnerebility blog | SonicWall |