Tag: patch-available
355 entries tagged patch-available, latest activity first.
- CVE-2026-111497, Brotli decoder flaw in Siemens Desigo CC and Industrial Edge, Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while Mitel updates and the Industrial Edge Common Configurator fix are still pending
- CVE-2026-19868, SonicWall SonicOS SSLVPN: valid credentials for an alternate authentication method bypass SAML and the MFA it enforces; SonicWall investigated a report of exploitation and CISA lists it as exploited (CVSS 3.1 7.1)
- CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)
- WordPress core 4.7 to 7.1.3: an unauthenticated race in the core update process can lead to remote code execution, fixed in 7.1.4 and backported to every supported branch, listed by CISA as exploited; Wordfence assigned CVE-2026-119977
- CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)
- CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced, Basic, M.2 and SM ship a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation
- CVE-2026-116779, FreeSWITCH 1.11.2 and earlier: one inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands, the vendor says exploitation has been observed, and 1.11.3 fixes it (CVSS 3.1 9.8)
- CVE-2026-116606 / CVE-2026-111560, Barracuda Email Security Gateway: an unauthenticated configuration-import bypass chained with a root command injection, with watchTowr's full chain and a detection tool public since 2026-11-05; patches are out and no exploitation is reported (CVSS 9.3 and 8.6)
- CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners that CloudLinux could not reproduce; Citrix XenServer, XCP-ng, MikroTik, Red Hat, Debian, CIQ and Amazon Linux have fixes, Ubuntu's are in progress and WatchGuard and Fortinet have none for their products (CVSS 9.8)
- Sekoia: an APT29-linked watering hole serves n-day iOS and Android exploit chains through compromised sites, clone domains and a one-week compromise of the Plerdy tracker; CISA lists the Apple WebKit pointer-authentication bypass CVE-2024-27834 as exploited on 2026-11-04
- CVE-2026-114424 and CVE-2026-114425, SEPPmail Secure Email Gateway before 15.1.1: an unauthenticated mail sender can reach root command execution through a replacement rule and root file access through Large File Transfer, with three more flaws fixed in the same release and no fix for the 15.0 branch (CVSS 4.0 9.2)
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)
- CVE-2026-109618 / CVE-2026-109619, PHP2Shell in management servers and storage: Trend Micro Apex Central and Apex One server have no released fix, with patches expected on 2026-11-11, Quest KACE SMA and SDA have fixes and should block ports 80, 443 and 52230 until patched, and NetApp ONTAP 9 is affected by CVE-2026-109618 only, inside the PHP jail
- CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM
- Dahua cameras and recorders: CERT-UA warns that attackers take devices over through the Easy4IP cloud relay even when no port is exposed, then view video, change configuration and add accounts
- CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, QVR Surveillance, TVR OS and Notes Station 3 now fixed, QNE (ADRA) still unfixed
- Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)
- CVE-2026-96951, Windows Shell: a Mark of the Web bypass exploited as a zero-day, fixed in the 2026-10-13 cumulative updates and listed in CISA KEV (CVSS 8.8)
- CVE-2026-109618 / CVE-2026-109619, PHP2Shell in industrial, building and network-access products: Belden NetModule NRSW is fixed in 5.0.0.105 and macmon 6.x must move to 7.x, with notices from Schneider Electric, B&R, HMS Networks, Wibu-Systems, Johnson Controls and Oracle
- Adobe Campaign Classic: eight unauthenticated CVSS 10.0 flaws in APSB26-142 and three more in APSB26-134, with build 9403 as the fix after APSB26-162
- eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)
- CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release below its train's hotfix through the management web interface, and Palo Alto reports active exploitation against internet-exposed management interfaces; all twenty hotfixes are out
- CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found
- CVE-2026-109618 / CVE-2026-109619, Broadcom Symantec Endpoint Protection Manager, Carbon Black App Control Server, CloudSOC SpanVA and Content Analysis and Malware Analysis: PHP2Shell reaches the endpoint-security management servers; App Control Server 8.12.2 and 8.13.2 are the fixes Broadcom names
- CVE-2026-118539, Drupal Commerce Core: an access bypass in routes and entity fields is exploited against online stores, fixed in 3.3.13 and 8.x-2.41 (Drupal risk 21 of 25)
- CVE-2026-109618 / CVE-2026-109619, Cisco Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder: Cisco's final PHP2Shell advisory names Expressway 15.5.21 and Duo Access Gateway 3.2.0 as the fixes and knows of no malicious use against its products
- CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)
- CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, the root-escalation step was patched on 2026-10-29 and CISA lists all three chain flaws (CVSS 8.6)
- CVE-2026-109618 / CVE-2026-109619, Check Point Force, Spark and Cloud firewalls: the PHP2Shell flaws reach the web interfaces of gateways that run Mobile Access, SSL Network Extender, SAML-realm VPN, the Identity Awareness captive portal, UserCheck or Zero Phishing; hotfixes since 2026-10-23, the R81.20 package reissued on 2026-10-28 (CVSS 9.2)
- CVE-2026-109618 / CVE-2026-109619, HPE Networking ClearPass Policy Manager: bulletin HPESBNW05171 lists the 6.14, 6.12 and 6.11 trains as affected by the PHP2Shell flaws and names a hotfix patch for each (CVSS 3.1 9.8)
- CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows code execution on self-managed servers; exploited, fixed in 19.4.2, 19.3.5 and 19.2.8 (CVSS 10.0)
- CVE-2026-76418, Cisco Secure Firewall ASA and Secure FTD: a crafted request to the remote access SSL VPN reloads the device when a tunnel group uses secondary authentication; Cisco reports active exploitation and CISA lists it (CVSS 3.1 8.6)
- Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP
- VMSA-2026-0006, VMware vCenter: unauthenticated Directory Service auth bypass and Syslog traversal RCE (both CVSS 9.8), plus a VMXNET3 guest-to-host escape
- CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), listed by CISA as exploited and chained with the PHP2Shell flaws to reach root, PoC public
- CVE-2026-109618 / CVE-2026-109619, F5 BIG-IP: the PHP2Shell flaws reach the Configuration utility of every module and the APM and SSL Orchestrator access profiles on 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0, and F5's cumulative critical releases 17.1.3.7, 17.5.1.11 and 21.1.0.4 carry the fix
- MDaemon mail server below 26.0.4 and Windows ClamAV 0.101.0 to 1.5.3: a crafted RAR emailed to any address runs code on the server through the bundled UnRAR flaw CVE-2025-8088, and ESET saw Russia-aligned attackers use it in Ukraine to deploy the HELLAGE and HELLTAG backdoors
- WatchGuard Fireware OS 2026.4, 12.12.4 and 12.5.22: seven of 17 fixed Fireware OS flaws are scored 9.0 or higher, among them unauthenticated memory-corruption and missing-authentication rows in the Access Portal, the SIP proxy and the FireCluster sync daemon; WatchGuard knows of no exploitation
- CVE-2026-108142, Veeam Backup & Replication: an unauthenticated authorization bypass on the CDP Coordinator Service of 13.x backup servers (CVSS 4.0 9.1), fixed in 13.1.2 and 13.0.3, with a Backup for Microsoft 365 SQL injection to code execution and a Veeam ONE MFA bypass fixed the same day
- KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network
- CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-27
- CVE-2026-61425 and the follow-up batch, Balbooa Gridbox for Joomla: a client-supplied cookie is accepted as proof of identity, giving anonymous Super User access
- CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)
- CVE-2026-109618 / CVE-2026-109619, NetScaler ADC and Gateway: the PHP2Shell flaws reach the management GUI on the NSIP, management-enabled SNIPs and the cluster IP of every supported version; fixed in 14.1-73.49, 13.1-64.32 and the FIPS and NDcPP builds
- CVE-2026-86950, Apple iOS, iPadOS and macOS CoreGraphics: out-of-bounds write exploited in an extremely sophisticated attack on targeted iOS users, CISA KEV-listed (CVSS 8.8)
- CVE-2026-15176 / CVE-2026-93479 / CVE-2026-97205, NGINX Open Source and NGINX Plus: three unauthenticated heap-corruption flaws rated CVSS 4.0 9.2, reachable only in specific configurations and fixed in 1.30.6 and 1.31.7
- NTLM relay past required signing: SpecterOps and Blackfield re-authenticate a signed LDAP or SMB session with a relayed victim identity, and Microsoft fixed it in the September and October 2026 updates
- CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)
- Fortinet FortiSandbox GUI authentication bypass (CVE-2026-107656, CVSS 9.6) and FortiSIEM 7.5.0 unauthenticated path traversal to code execution (CVE-2026-106173, CVSS 9.4): both critical, fixed 2026-10-13, neither reported exploited
- Fortinet coordinated security hardening release: critical and high-severity fixes in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with the advisories withheld until 2026-11-10
- HPESBNW05162, HPE Networking (Aruba) AOS-8 and AOS-10 wireless: 72 CVEs fixed in one bulletin, 19 of them unauthenticated and network-reachable at CVSS 9.0 or above, across controllers, gateways and access points
- CVE-2026-114625, Arista VeloCloud Orchestrator On-Prem: an SQL injection lets any authenticated user, down to the Enterprise Read Only role, act as a superuser operator, and Arista says it is actively exploited (CVSS 3.1 9.9)
- CVE-2026-76466, Cisco Expressway-C and Expressway-E: unauthenticated root command execution on clustered devices, fixed in X15.5.20 with no workaround (CVSS 9.8), alongside same-day hardening releases for Unified CM, Unity Connection and Snort 3
- Microsoft calls Nightmare Eclipse's six uncoordinated Windows zero-day releases "never justifiable"; the three May drops were fixed in June 2026
- Windows BitLocker "YellowKey" (CVE-2026-45585) and CTFMON "GreenPlasma" (CVE-2026-45586) zero-days: public PoCs in May, fixed in the June 2026 Windows updates
- Metabase CVE-2026-72898: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances, exploited since at least 2 August, with VenariX counting fifteen downstream victims
- CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaigns
- CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September; 7.2.2 fixes the root flaw on DEB and RPM installs
- CVE-2026-88779, Citrix NetScaler ADC and Gateway: a SAML-triggered memory overflow still hits appliances on the September fixed builds, and Citrix confirms targeted attacks (CVSS 4.0 8.7)
- CVE-2026-110936, Siemens Software Center: a ClickFix campaign runs a genuine signed copy of the application and side-loads its own DLLs, and Siemens confirms exploitation (CVSS 4.0 8.4)
- CVE-2026-85097, Bricksforge for WordPress: an unauthenticated upload in the Pro Forms module writes attacker PHP into the uploads directory, exploited since 7 October; fixed in 3.1.8.10 and 4.0.0, with a related upload fix in 4.0.1 (CVSS 9.8)
- Rank Math SEO PRO 3.0.123: some packages served for about eleven hours carried malware that can leave hidden backdoors, rogue administrators and cron persistence that the update to 3.0.124 does not remove
- CVE-2026-82078 / CVE-2026-81578, PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed
- CVE-2026-70571, Microsoft Exchange Server: an unauthenticated crafted-email code-execution flaw in the October 2026 security updates, the last Exchange 2016 and 2019 updates under the paid ESU (CVSS 8.1)
- CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)
- PEERSTITCH: a memory-resident FortiGate implant installed through the FortiOS CLI path traversal CVE-2025-61624, which Fortinet lists as exploited and leaves unfixed on FortiOS 7.2, 7.0 and 6.4, after a FortiManager compromise exposed the configurations of 500+ firewalls
- CVE-2026-108097, Drupal core (SA-CORE-2026-014): a critical Field UI code-execution flaw reachable through contributed modules, at least one without login; fixed in 11.4.10, 11.3.19 and 10.6.19, with no fix for end-of-life branches (Drupal risk 19/25)
- Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited
- CVE-2026-105133 / CVE-2026-105134, AhsayCBS backup management console: an unauthenticated authentication-bypass and code-execution chain exploited since 7 October to drop webshells and a cryptominer; Ahsay says its earlier patches were incomplete and ships hotfixes 10.3.4.45 and 9.15.2.70 through its partner portal
- CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)
- CVE-2026-110447, Collabora Online Built-in CODE Server (Nextcloud richdocumentscode app): an unauthenticated command injection in proxy.php, exploited in the wild to plant PHP web shells, fixed in 26.4.303 (CVSS 4.0 9.2)
- CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)
- Claroty Team82: 23 vulnerabilities in Copeland XWEB Pro supervisory refrigeration controllers chain to unauthenticated root RCE; a deterministic admin password derived from the device's own MAC address is one of THREE independent pre-auth paths
- CVE-2026-102255, SonicWall SMA1000: a third unauthenticated CVSS 10.0 Work Place SSRF this year, affecting the hotfix builds that closed the September zero-days, with exploitation attempts reported that SonicWall has not confirmed
- CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots recorded probes by the day after the patch (CVSS 10.0)
- CVE-2026-84411, MikroTik RouterOS: one unauthenticated request to the web management service can run code as root; fixed in 7.24 (v7 stable), 7.23.8 (v7 long-term) and 6.49.23 (v6 long-term) (CVSS 3.1 9.8)
- CVE-2026-107406, Citrix NetScaler ADC and Gateway: a SAML-path memory overflow that can lead to code execution still affects the 2026-10-03 fixed builds on identity-provider appliances (CVSS 4.0 9.5)
- CVE-2026-94504 / CVE-2026-93836, Ninja Forms and WPC Product Bundles for WooCommerce: stored XSS exploited to plant a hidden WordPress administrator and four persistence routes that survive the update
- CVE-2026-73570, Zimbra Collaboration: a pre-auth command injection patched without a CVE in July is exploited, with probing before disclosure and root escalation, secret theft and cluster-wide movement observed
- CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)
- CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)
- CVE-2026-76504, Cisco Catalyst SD-WAN Manager: one percent-encoded character in the login path skips the password check and mints an admin API session, exploited in the wild (CVSS 9.8)
- Kiteworks (formerly Accellion) tells customers worldwide to shut down after 'credible' law-enforcement intelligence of an imminent attack, then publishes fixes including an unauthenticated chain to root in its Email Protection Gateway (CVE-2026-54154, CVSS 10.0)
- CVE-2026-63077: JetBrains TeamCity On-Premises unauthenticated RCE through the agent-polling protocol, every on-prem version affected (critical)
- CVE-2026-13368, WatchGuard Fireware OS: pre-auth use-after-free RCE in the iked IKEv2/LDAP path (CVSS 9.2)
- CVE-2026-42533, nginx / NGINX Plus: PCRE capture-clobber pre-auth heap overflow, researcher demonstrates RCE beyond F5's DoS-only framing (CVSS 9.2)
- CVE-2026-20316: Cisco Secure Firewall Management Center ships a static low-privilege account in its web interface, and Cisco confirms active exploitation
- CVE-2025-15467, Siemens Desigo CC: a vendored OpenSSL CMS parsing overflow gives pre-auth code execution, and the V7 family still has no fix (CVSS 9.8)
- CVE-2026-20349, Cisco Secure Firewall ASA/FTD: one crafted HTTP request to the Remote Access SSL VPN reloads the device, exploitation confirmed, no workaround and a three-day KEV deadline
- GeoServer CVE-2026-76904: an unauthenticated SQL injection in the jsonArrayContains filter was exploited within hours of disclosure, before a patch existed, and NCSC-CH put it in front of Swiss operators
- WatchGuard Fireware OS: three pre-auth RCEs in the iked IKE/VPN daemon plus a pre-auth stack overflow in the deprecated Mobile Security epm service
- Oracle's September 2026 Critical Security Patch Update carries fifty unauthenticated CVSS 9.8+ flaws, concentrated in Fusion Middleware's identity, forms, directory and portal components, plus E-Business Suite, Hyperion, Analytics, Enterprise Manager, Communications and Supply Chain products
- CVE-2019-18935, Progress Telerik UI for ASP.NET AJAX: a patched-since-2020 deserialization RCE still exploited, now via an in-memory Godzilla web shell registered on ASP.NET's VirtualPathProvider
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration
- CVE-2026-48842, Roundcube Webmail pre-authentication SQL injection in virtuser_query plugin (CVSS 8.1)
- CVE-2026-5430, WSO2 API Manager, API Control Plane, Traffic Manager, Universal Gateway: a JWT algorithm-confusion bypass reaches full administrative control of the API gateway, exploited since 13 September (CVSS 10.0/9.8)
- CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)
- Virtualizor VPS/hypervisor control panel: a login-page guard's own exemption for act=login lets an unauthenticated attacker reach root
- CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment
- CVE-2026-66804, Windows Cross Device Service: a dangling COM registration reaches SYSTEM privilege escalation, and Google Project Zero publishes a general method to hunt for others
- CVE-2026-81642 / CVE-2026-82717: NLnet Labs Unbound, a self-referencing DNSSEC compression pointer overflows the validator's digest buffer, reaching remote code execution (CVSS4.0 9.1 and 8.4)
- CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)
- CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)
- CVE-2026-91843, Check Point Security Management / Multi-Domain Security Management / Log Server: unauthenticated stack overflow in the login process reaches root RCE (CVSS 9.8)
- CVE-2026-82329, JFrog Artifactory: an unauthenticated attacker gets administrative access under default configuration (CVSS 9.8)
- ShieldBreak: a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025
- CVE-2026-42016 + CVE-2026-42018, JFrog Artifactory: chaining two previously-patched token flaws turns an unauthenticated request into full administrative control in two API calls, confirmed exploited since mid-August
- CVE-2026-84869, ConnectWise ScreenConnect: a missing file-transfer authorization check lets an active remote session push and auto-run files on the Host, and Huntress traced worm-like exploitation back to 20 August, weeks before any patch existed (CVSS 9.9)
- CVE-2026-15409, SonicWall SMA1000: unauthenticated SSRF (CVSS 10.0) chained to post-auth code injection, actively exploited
- Apereo CAS: an embargoed remote-code-execution disclosure affects every 7.3.x deployment regardless of configuration, patched to 7.3.8.3, no CVE or technical detail published yet
- Ivanti September 2026 Security Update, ten CVEs across Neurons for ITSM, Sentry and EPMM, two unauthenticated CVSS 9.8 deserialization RCEs
- Chaotic Eclipse turns its zero-day drops on third-party security products: local privilege escalation in CrowdStrike Falcon and Avast, with working proof-of-concept code public; all three vendors have since remediated
- September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)
- CVE-2026-19490, Citrix NetScaler: an authentication bypass on Gateway and AAA virtual servers (CVSS 9.3), and on older builds no SAML configuration is needed to be exposed
- CVE-2026-75650 ("StyleSmuggler"), Magento/Adobe Commerce: unauthenticated CVSS 10.0 RCE via template-engine injection, exploited three days before Adobe's hotfix existed
- CVE-2026-86206 / CVE-2026-86207 / CVE-2026-86218, N-able N-central: a third, unrelated auth-bypass/RCE chain in five weeks, the third CVE a pre-auth CVSS 10.0 zero-day N-able says is already exploited
- Dell Secure Connect Gateway DSA-2026-382: an unauthenticated request replayed indefinitely mints ADMIN tokens, and Dell ships no workaround for any of the 105 flaws
- CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released
- CVE-2026-63219 / CVE-2026-58400, GeoNetwork opensource: chained unauthenticated formatter upload plus unsafe Saxon XSLT processing reaches unauthenticated RCE (CVSS 8.6 / 9.1)
- Hugging Face: a fully autonomous AI agent breached production, ran 17,000+ actions before detection
- HPE Networking Fabric Composer and ArubaOS-CX: an unauthenticated CVSS 10.0 RCE and a CVSS 10.0 authentication bypass in the fabric-management plane, plus a CVSS 9.8 unauthenticated buffer-overflow RCE in the switch OS
- CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/43211
- CVE-2026-85046, Google Chrome: V8 type confusion exploited in the wild via a crafted HTML page
- CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables
- GitSpawn (CVE-2026-72718); a hostile repository's own git config runs arbitrary commands during AI coding agents' routine startup housekeeping, before any trust prompt
- CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped
- CVE-2026-83548 / CVE-2026-83549, SonicWall SMA1000: a pre-auth SSRF through an unintended alternate Work Place access path chains into post-auth command injection in the Management Console, both under active exploitation
- CVE-2026-59822, BerriAI LiteLLM: a failed key check on the MCP gateway substitutes an empty auth object instead of rejecting the request, so a fabricated Bearer token opens a live MCP session
- CVE-2026-62911, Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch
- CVE-2026-21962: an unauthenticated request bypasses access control in the Oracle WebLogic Server Proxy Plug-in, CISA KEV-listed on 24 August with exploitation running since January
- CVE-2026-18885 / CVE-2026-18886 / CVE-2026-74820 / CVE-2026-6876, ServiceNow AI Platform: three unauthenticated CVSS 10.0 flaws plus a related Now Platform sandbox escape
- Claroty Team82: Danfoss AK-SM 800A refrigeration system managers, undocumented 'code-of-the-day' authentication bypass and post-authentication command-injection RCE across thousands of internet-exposed devices
- miniOrange's SAML2Core library ships the same openssl_verify() tri-state authentication bypass across both its WordPress and Joomla SAML SSO products, one vendor code defect, two ecosystems, exploitation already attempted against the WordPress line
- Ubiquiti UniFi ecosystem: 22 CVEs in one bulletin, three at CVSS 10.0, unauthenticated CRLF-injection auth bypass, and unauthenticated command injection in UniFi Protect and UniFi Talk
- A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations
- JFrog Artifactory: authenticated Docker-cache path traversal (CVE-2026-66384) added to CISA KEV, a CI/CD artifact-store write primitive with no published exploitation narrative
- Elementor Pro (WordPress): unauthenticated arbitrary file upload to RCE via a validator/mover desynchronization in the Forms File Upload field (CVE-2026-32475, CVSS 9.0)
- isolated-vm sandbox escape (GHSA-864f-rcv7-6rh4): a TOCTOU type-confusion in ExternalCopy's transferList marshaling breaks the V8 Isolate guest/host boundary, the sandbox underneath a wide range of AI-agent and low-code automation platforms
- Zalktis (Latvian accounting software): unauthenticated SQL injection reachable by any PEPPOL/UBL e-invoice sender, no account, no network position, just a routine bookkeeping import (CVE-2026-59109)
- Johnson Controls C-CURE 9000 / victor: unauthenticated adjacent-network deserialization RCE on physical access-control application servers reaches connected security-workstation clients too (CVE-2026-21655, CVSS 9.6)
- Sourcerer for Joomla: unauthenticated RCE exploited in the wild since before a working fix existed; the vendor's first two patches did not close it, and the CVE was re-scoped in place to widen the affected range
- iCagenda Calendar module for Joomla: unauthenticated SQL injection via com_ajax needs no session, token or account (CVE-2026-67365, CVSS 9.2), and the vulnerable module's own version number does not track the package version
- YOOtheme ZOO for Joomla: unauthenticated file-upload RCE (CVSS 10.0) plus a precondition-free SQL injection reachable with no submission form at all, three releases in three days, and the 3.x line has no fix
- Splunk Enterprise August 2026 hardening release (SVD-2026-0801): three unauthenticated CVSS 9.4 flaws let anyone holding an embedded-report token hijack the report owner's session, admins included
- Adobe August 2026 Patch Day: ColdFusion ships a CVSS 10.0 unauthenticated OS command injection, and Campaign Classic ships two more unauthenticated CVSS 10.0 flaws in the same release
- CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed lineage), public PoC
- SPIP shipped two emergency releases in three days, each fixing an unconditional pre-authentication RCE the vendor says is already being exploited, and only the first one has a CVE
- NatJack, sharing a NAT table is a trust relationship nobody declared: five named primitives against NAT state, of which only the downstream TCP hijack got a CVE on each platform
- CVE-2026-72529 and CVE-2026-72530, a pre-auth chain on TrueConf Server's port 4307 reaches SYSTEM, and the operators use it to replace the client installer the server hands to everyone who joins a meeting
- CVE-2026-69836, Microsoft corrected its own Entra ID CVSS 10.0 record from exploited to not-exploited within a day, and ENISA's exploited feed still says otherwise two days later
- CVE-2026-19478; GitLab ships an out-of-band critical patch for a GraphQL directive flaw that lets an unauthenticated caller modify or delete public projects and user data (CVSS 9.4)
- Zoomsday; the Zoom client build that closes the first two annotation flaws leaves the third open, and the national advisory that raised the alarm covers only one of the three
- CVE-2026-19586, TP-Link Omada gateways: attacker-supplied data during OpenVPN connection establishment reaches command execution before authentication completes (CVSS 4.0 9.3)
- Oracle's August 2026 Critical Security Patch Update carries three unauthenticated CVSS 10.0 flaws, one of them in the LDAP server of Oracle Internet Directory
- CVE-2026-64849, MLflow: the SSRF guard resolves the webhook host and then throws the answer away, so one redirect turns an unauthenticated tracking server into a reader of its own cloud credentials
- CVE-2026-15826, User Profile Builder: a 61-to-70-character username makes WordPress return an error object, absint() turns it into the integer 1, and the plugin logs the caller in as user ID 1 (CVSS 9.8)
- CVE-2026-15748, Forminator Forms (600,000+ WordPress sites): a forged Select-field value overrides the upload allow-list, and the root cause went public seventeen days after the patch (CVSS 9.8)
- CVE-2026-18963; Keycloak's password-reset flow can be driven to completion without the verification email being clicked, handing an unauthenticated attacker any account including administrators (CVSS 9.1)
- Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days, AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)
- Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent
- CVE-2025-62593; Ray's dashboard is defended against browsers by a User-Agent string check, and CISA now records the DNS-rebinding bypass as exploited
- CVE-2026-71362, Adobe Commerce and Magento Open Source: an unauthenticated attacker switches a customer session to another customer's account (CVSS 9.1), and a WAF vendor reports it is already blocking attempts
- CVE-2026-65400: macOS Screen Sharing lets a network attacker authenticate without valid credentials, the second severe defect in the same daemon in two releases
- SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy
- Flowise ships three new CVEs into a sunset, an unauthenticated auth bypass that defeats an earlier fix, and cross-workspace credential access, with no vendor left to patch them
- CVE-2026-26035, FortiWeb: one non-default RADIUS admin setting turns any username and password into a valid GUI/CLI login, alongside an FGFM impersonation bug and a FortiClient flaw reachable by anyone who can answer a laptop's DNS
- CVE-2026-19188, Haiwell IoT Cloud HMI Gateway: the diagnostic ping in the web interface runs attacker-supplied shell commands as root, unauthenticated (CVSS 10.0)
- CVE-2026-45659, Microsoft SharePoint Server: authenticated deserialization RCE, now KEV-listed
- CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
- LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems
- Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets, FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers
- Coding-agent CI harnesses broke on the same trust boundary three different ways, and the two findings that matter most carry no CVE at all
- Linux kernel bridge STP timer use-after-free, a control-flow hijack primitive with a published exploit, no CVE, and no confirmed stable backport
- CVE-2026-66066, Ruby on Rails Active Storage: an unauthenticated image upload reaches arbitrary file read through libvips' unfuzzed loaders, exposing every application secret (CVSS 4.0 9.5)
- WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137), out-of-band 7.0.2 patch, exploited within days and KEV-listed
- CVE-2026-64638 (XSS2Shell), WordPress Core: a sanitiser disagreement on the login screen chains through DOM clobbering and a JSONP callback into administrator-minted Application Passwords and plugin upload
- Wazuh 4.14.6, two cluster-protocol paths to root that bypass the CVE-2026-25770 fix, a DAPI deserialization RCE, and a pre-auth stack overflow on the enrollment port
- CVE-2026-71851, crypto-js below 4.0.0 generates 'random' values with about 2^39 of real entropy, and attackers were draining wallets built on it while the investigation ran
- WALLIX Bastion's REST API hands full appliance administration to an unauthenticated caller (CVSS 4.0 10.0), the credential vault and session recordings included, with public technical details due in September
- Check Point breaks out of Cloudflare's Code Mode sandbox through a use-after-free in workerd's native glue, prompt injection to native host code, and a cross-tenant heap read
- Cisco IOS XE August 2026 hardening release, seven CVEs that each stand for a whole class of internally found bugs, no workarounds, and frontier AI models among the discovery tools
- CVE-2026-53359, Linux KVM/x86 "Januscape": shadow-MMU use-after-free enables guest-to-host VM escape on Intel and AMD
- CVE-2026-8037, Progress Kemp LoadMaster: pre-auth RCE via uninitialized heap in the /accessv2 API
- CVE-2026-16443, Keycloak: importing SAML metadata without key-usage attributes silently disables response signature validation, so an unauthenticated attacker forges a login as any known user
- Adobe Campaign Classic APSB26-120, three more unauthenticated CVSS 10.0 code-execution flaws, and last week's build 9398 is the version they affect
- Veeam Service Provider Console and Veeam ONE, ten CVEs, headed by an unauthenticated CVSS 10.0 remote code execution on the Veeam ONE agent host
- CVE-2026-63455 / CVE-2026-63456, HPE Aruba Networking SD-WAN Orchestrator: spoofed HTTP headers bypass REST API authentication (CVSS 9.8), with the vendor and CERT-FR scoping the affected branches differently
- CVE-2026-58048, cPanel & WHM: renaming a database drops the SQL mode that contains a tenant, handing any hosting customer database-root (CVSS 9.4)
- Traefik 3.7.10 / 3.6.25 / 2.11.54, a route identity built by joining names with hyphens lets one Kubernetes namespace silently take over another's traffic on a shared Gateway
- CVE-2026-17583, Thermo Fisher Applied Biosystems genetic analyzers write DNA result files with no integrity checking, so results can be altered after the run and no vendor fix is offered
- CVE-2026-34486, Apache Tomcat: the fix for an earlier EncryptInterceptor flaw reintroduced a bypass, and CISA's KEV listing lands months after a China-nexus campaign was already exploiting it
- CVE-2026-18574, Check Point Security Management: unauthenticated bypass of management authentication to arbitrary command execution, with no fix for seven end-of-support trains
- CVE-2026-0770, Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1
- CVE-2026-54363 and five siblings, Gladinet CentreStack: one cryptographic key shared across every installation forges a domain-administrator token, completing an unauthenticated RCE chain
- Bouncy Castle for Java 1.85, 32 CVEs published three weeks after the silent fix: three certificate-validation bypasses and a static Diffie-Hellman key-recovery flaw rated critical
- CVE-2026-48449, Adobe Campaign Classic: an authorization flaw gives unauthenticated arbitrary code execution (CVSS 10.0), on-premise and hybrid deployments only
- CVE-2026-65766 and CVE-2026-65879, SP Page Builder for Joomla: a CSRF token Joomla hands to anonymous visitors is the only guard on an ORDER BY injection, plus a shipped-in-source shared secret that opens a mail relay
- COLDCARD: a preprocessor guard that tested whether a macro was defined rather than what it was set to routed key generation to a software PRNG for five years, and the keys are now being emptied
- CVE-2026-28323, SolarWinds Web Help Desk: unauthenticated SAML 2.0 authentication bypass on a helpdesk portal (CVSS 9.8)
- CVE-2026-14512 / CVE-2026-14446, IBM WebSphere Application Server: two pre-auth CVSS 9.8 flaws with no workaround and no fix pack until 3Q2026 (interim APARs only)
- CVE-2026-65883, Aimy Captcha-Less Form Guard for Joomla: the anti-spam token is deserialized before any check, and the XOR keystream ships in the same page (CVSS 9.8)
- CVE-2026-42897: Exchange OWA cross-site scripting exploited by TA488 with the OWAReaper implant; fixed since the June 2026 Security Update, which does not remove the mitigation
- HCSEC-2026-23, HashiCorp Terraform MCP Server leaks its own bearer token to an attacker-supplied address, and its credential cache crosses sessions and tenants (CVE-2026-14869, CVE-2026-16496, CVE-2026-16498)
- CVE-2026-59726 (RufRoot), Ruflo's MCP bridge took unauthenticated tool calls on all interfaces, and the memory it poisons is not cleaned up by the patch (CVSS 10.0)
- CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)
- CVE-2026-59243, Apache Airflow FAB provider: the Azure AD OAuth login decoded ID tokens with signature verification off by default, letting anyone log in as Admin
- CVE-2026-61511, vBulletin: an arithmetic-only regex filter in front of eval() yields unauthenticated RCE, with a working exploit now public
- CVE-2025-68686, FortiOS SSL-VPN: the fix for the symlink-persistence technique is itself bypassable, and CISA now lists it as exploited
- CVE-2026-16812, Arista VeloCloud Orchestrator on-prem: unauthenticated OS command injection on an interface exposed by default, confirmed exploited (CVSS 10.0)
- Oracle July 2026 CPU, nine unauthenticated CVSS 10.0 flaws in Fusion Middleware, with NCSC-NL assessing large-scale abuse as very likely in the short term
- GitLab CE/EE RCE via the Jupyter-notebook diff renderer and two ~5-year-old Oj Ruby-parser memory-corruption bugs, public PoC, silent patch, no CVE
- CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)
- Mitel MiCollab AWV: unauthenticated command injection to full system compromise (CVSS 9.8, MTLVULN-1694, CVE pending)
- SolarWinds Serv-U 2026.3, 15 critical IDOR flaws let authenticated users escalate to root RCE on the file-transfer server (CVSS 9.1)
- GLPI 11.0.8 / 10.0.26, critical RCE via form import and complete MFA bypass in the public-sector ITSM platform
- Zimbra Collaboration Suite 10.1.20, permanent fix for an SNMP command-injection RCE plus four stored-XSS bugs; NCSC-CH and BSI both flag the release
- CVE-2026-2291; dnsmasq DNS-cache heap overflow is a pre-auth RCE, not just a DoS (Exodus exploit-dev write-up)
- CVE-2026-6875: ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)
- Moodle local_o365 plugin: unverified JWT signature on the Teams SSO endpoint lets anyone authenticate as any user (CVE-2026-54733)
- CVE-2025-40948/-40947/-40949, Siemens RUGGEDCOM ROX II: Unit 42 chains three OT-switch flaws to persistent root
- Firefox 152.0.6, chained WebAssembly memory-safety and DOM-navigation site-isolation flaws with public exploit code (CVE-2026-15718, CVE-2026-15719)
- Abacus ERP: unauthenticated RCE (CVSS 9.8, no CVE) and authenticated path traversal in a widely-deployed Swiss ERP platform, flagged by NCSC-CH
- CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)
- CISA ICS batch (14 Jul): Rockwell 1715-AENTR unauthenticated debug-port takeover (CVE-2026-10577, CVSS 10.0, fixed in firmware 3.011) and a Swiss-vendor ABB T-MAC Plus auth chain (CVSS 9.9)
- Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat'; the cause is a path-traversal flaw, fixed in 5.12.5 and 6.0.2
- SAP July 2026 Security Patch Day: three CVSS ≥9.1 flaws in NetWeaver AS ABAP, Approuter and Commerce Cloud, two reachable without authentication
- CVE-2026-8863, CVE-2026-10797, forgotten pre-0.9 UEFI shims bypass Secure Boot via a signature-length validation mismatch
- CVE-2026-61500, Rejetto HFS < 3.2.1: predictable session-signing PRNG lets an unauthenticated attacker forge admin sessions to RCE (CVSS 9.3)
- CVE-2026-4769, WAGO I/O System Field: undocumented early-boot interface allows unauthenticated full compromise (CVSS 9.8)
- PraisonAI agent framework: three CVEs, unsandboxed LLM code execution, tool-call RCE, and vector-store DDL injection
- Progress MOVEit Transfer: pre-auth SFTP DoS (CVE-2026-10699), admin table-scope bypass (CVE-2026-10698) and stored XSS (CVE-2026-11903), patched 2026.0.2
- Joomla file-upload RCE wave adds RSFiles! (CVE-2026-57827, unauth, CVSS 10.0) and Phoca Download (CVE-2026-57828, CVSS 9.0)
- Zimbra Classic Web Client: crafted-email code execution fixed in ZCS 10.1.19, surfaced by NCSC-CH (no CVE, exploitation unknown)
- Siemens SICAM 8 (A8000/EGS/S8000) grid RTUs: firmware-signature-validation bypass + OPC-UA-off-by-default among four CVEs (SSA-229470)
- Open WebUI's six broken-access-control CVEs are one recurring authorization-architecture defect, not six isolated bugs
- CVE-2026-48939, iCagenda for Joomla: unauthenticated file-upload-to-RCE, exploited as a zero-day, added to CISA KEV (CVSS 4.0 10.0)
- CVE-2026-20896: Gitea's official Docker image trusted the reverse-proxy login header from any source, so where reverse-proxy authentication is enabled anyone can impersonate any user
- Cisco Talos batch disclosure: wolfSSL PKI name-constraint bypasses, GeoVision command injection, and a VTK-DICOM heap overflow (41 CVEs)
- CVE-2026-50656: Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day series
- CVE-2026-56291, Balbooa Forms for Joomla: unauthenticated file-upload RCE exploited as a zero-day (CVSS 10.0)
- GhostApproval (CVE-2026-12958, CVE-2026-50549), symlink + confirmation-UI misrepresentation lets a malicious repo write outside six AI coding assistants' workspace sandbox
- CVE-2026-48614, Plesk XML API code injection: authenticated low-privilege user to root (CVSS 9.9)
- Ubiquiti UniFi SAB-066, 25 vulnerabilities incl. unauthenticated CVSS 10.0 command injection in UniFi Connect (CVE-2026-50746)
- CVE-2026-48908 / CVE-2026-56290, two Joomla page-builder extensions hit CISA KEV the same day for unauth file-upload RCE zero-days
- GhostLock (CVE-2026-43499), Linux kernel rtmutex use-after-free with a public, 97%-reliable root and container-escape exploit
- CVE-2026-55255, Langflow cross-tenant IDOR now CISA KEV-listed, chained with the pre-auth RCE CVE-2026-33017
- CVE-2026-40138/-40139/-40140/-40141, BeyondTrust Remote Support / Privileged Remote Access: critical pre-auth bypass, flagged by NCSC-CH
- CVE-2026-48276, -48277, -48281, -48282, -48283, -48316, Adobe ColdFusion: six CVSS 10.0 unauthenticated RCE paths
- CVE-2026-59509, cve-search: unauthenticated /fetch_cve_data parameter manipulation exposes admin credential hashes (CVSS 9.2)
- CVE-2026-57517, Control Web Panel: pre-auth blind SQL injection to web-shell RCE (CVSS 9.8)
- CVE-2026-34038, Coolify: authenticated command injection to RCE and secrets exfiltration (CVSS 9.9)
- CVE-2026-14439, Altium Enterprise Server / Altium 365: authenticated path-traversal to RCE
- CVE-2026-43503, Linux kernel "DirtyClone": page-cache corruption via XFRM/IPsec skb cloning (working PoC)
- Keycloak JWT algorithm confusion (CVE-2026-11800): forging federated identity in the EU public sector's dominant IdP
- CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available
- CVE-2026-46331, Linux kernel "pedit COW": out-of-bounds write in the tc act_pedit module (public weaponised PoC)
- CVE-2026-56447, CVE-2026-56446, CVE-2026-56425, CVE-2026-56424, CVE-2026-56423, CVE-2026-56422, MISP 2.5.42: two site-admin RCE paths plus Azure-AD auth and broken-access-control hardening
- Ubiquiti UniFi OS triple-flaw chain to unauthenticated root (CVE-2026-34908 / -34909 / -34910)
- CVE-2025-67038, Lantronix EDS5000 serial-to-IP converter: unauthenticated OS command injection to root, first BRIDGE:BREAK flaw added to CISA KEV
- CVE-2026-20230: Cisco Unified CM WebDialer SSRF to root file write, exploited and KEV-listed; WebDialer is off by default
- SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog
- ShapedPlugin build pipeline compromised, three Pro WordPress plugins backdoored to steal credentials, 2FA secrets and drop a web shell
- CVE-2026-4020, Gravity SMTP WordPress plugin: unauthenticated config-dump of email-connector credentials, mass-exploited
- CVE-2026-20253: Splunk Enterprise unauthenticated file write through the PostgreSQL sidecar chains to RCE, exploited and KEV-listed
- Cisco ISE CVE-2026-20181 / CVE-2026-20190: administrator-level command execution to root and an unauthenticated disclosure of hashed credentials, two independent flaws
- CVE-2026-55803 / CVE-2026-55804, Drupal core: PHP object-injection chain in JSON:API, BSI-rated critical
- CVE-2026-42530 / CVE-2026-42055, NGINX: HTTP/3 QUIC use-after-free and HTTP/2-proxy heap overflow, out-of-band F5 patches
- CVE-2026-12046 / CVE-2026-12045 / CVE-2026-12048, pgAdmin 4: unauthenticated pickle deserialization RCE, AI-Assistant read-only-transaction bypass, stored XSS
- BSI flags 13 vulnerabilities patched in Zammad 7.1, admin privilege escalation in a DACH public-sector helpdesk platform
- CVE-2026-0647 et al. Rockwell Automation FLEX I/O unauthenticated password reset (CVSS 9.4) and Logix CIP denial-of-service, flagged by NCSC-CH
- CVE-2026-46978 / CVE-2026-35278, Oracle June 2026 CSPU: unauthenticated Solaris RAD flaw (CVSS 10.0) and PeopleSoft RCE (9.8)
- CVE-2026-50751: Check Point Security Gateway IKEv1 VPN authentication bypass, actively exploited, actor assessed with medium confidence to use Qilin ransomware
- CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8 base)
- Varonis "SearchLeak" (CVE-2026-42824): one-click M365 Copilot data exfiltration, now patched
- Obsidian Security: a three-CVE chain turns any LiteLLM user into root on the AI gateway
- CVE-2026-48611 / CVE-2026-48612: phpBB authentication bypass gives a session as any user from one unauthenticated request, plus an OAuth account-link CSRF
- CVE-2026-10795, UpdraftPlus WordPress backup plugin: unauthenticated authentication bypass to RCE
- MariaDB CVE-2026-49261: Galera wsrep_notify_cmd shell injection (CVSS 10.0)
- June 2026 Patch Tuesday: four CVSS ≥ 9.1 criticals, Windows kernel TCP/IP RCE, Nuance PowerScribe, Azure Stack Edge, Exchange Online
- CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild
- Keycloak 26.6.3: privilege escalation via OAuth token-exchange and SSRF in the EU public sector's reference identity platform
- An autonomous AI agent finds 21 zero-days in FFmpeg for ~$1,000, nine numbered (CVE-2026-39210 to -39218), parser bugs up to 23 years old
- CVE-2026-10881, Google Chrome (ANGLE graphics engine): out-of-bounds read/write enabling sandbox escape (CVSS 9.6)
- CVE-2026-28318, SolarWinds Serv-U: unauthenticated DoS added to CISA KEV
- Redis CVE-2026-23479: a public use-after-free→GOT-overwrite RCE in a database 80% of cloud estates run passwordless
- GMO Flatt Security: one GitHub issue could hijack any public repo running Anthropic's claude-code-action, and could have poisoned the action itself
- One-click GitHub OAuth-token theft via github.dev, full-disclosed with PoC; Microsoft patched 3 June
- Enclave: a single debug flag left on in six Microsoft 365 Android apps allowed silent OAuth-token theft
- CVE-2026-10611, MISP: OTP bypass when LDAP mixed-auth and OTP enforcement are both enabled
- CVE-2026-8206 + CVE-2026-8181, Kirki and Burst Statistics WordPress plugins: unauthenticated account takeover under active mass-exploitation
- CVE-2026-45247, Mirasvit Full Page Cache Warmer (Magento 2 / Adobe Commerce): unauthenticated PHP object-injection RCE, now in CISA KEV
- Linux cgroups v1 release_agent container escape (CVE-2022-0492) re-enters active exploitation
- Sekoia consolidates Gamaredon tooling under GammaPhish / GammaWorm, details an NTFS-ADS USB+network worm
- CVE-2025-48595, Android Framework: actively-exploited integer-overflow privilege escalation
- CVE-2024-21182, Oracle WebLogic Server: unauthenticated T3/IIOP data access, KEV-listed on active exploitation
- Microsoft May 2026 Patch Tuesday: Netlogon pre-auth RCE on domain controllers (CVE-2026-41089), later reported exploited by Belgium's CCB, leads four critical fixes
- Mautic 7.1.2 / 6.0.9, seven authenticated flaws, including two post-auth RCE paths (SSTI and path-traversal-to-PHP-RCE), an SSRF and an API authorization bypass
- CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass via Malformed Host Header
- FortiClient EMS CVE-2026-35616: exploited API authentication bypass used to push VPN on-connect scripts that drop EKZ Infostealer on managed endpoints
- CVE-2026-32996 & CVE-2026-32997, Veeam Backup & Replication KB4852: LPE in Windows Agent, arbitrary file write in Linux appliance
- CVE-2026-4868 (+ five further CVEs), GitLab 19.0.1 / 18.11.4 / 18.10.7 patch release: Duo AI identity impersonation, unauthenticated project enumeration
- CVE-2026-9170: IBM HTTP Server improper input validation allows denial of service and potential remote code execution without authentication (CVSS 9.8)
- CVE-2026-44848 & CVE-2026-44849, Portainer CE: Docker plugin endpoints unguarded; Swarm-service security checks bypassed (CVSS 9.4)
- CVE-2026-44939 (+ CVE-2026-41052, CVE-2026-41053), SUSE Rancher: command injection on cluster import, PSA label privilege-escalation, GitHub-App over-inclusive team membership
- CVE-2026-4408 & CVE-2026-4480, Samba: unauthenticated RCE in SAMR RPC and print-command subsystems (CVSS 10.0)
- Apereo CAS version 7.3.7.1 patches an OIDC-provider flaw reported by Coop Switzerland; CERT-FR issues advisory CERTFR-2026-AVI-0654
- CVE-2026-35087 / CVE-2026-35089 / CVE-2026-35090, Slican PBX telephony exchanges, triple pre-authentication admin bypass (CERT Polska)
- CVE-2026-9312, GitHub Enterprise Server (< 3.22): unauthenticated SSRF via upload-endpoint path traversal exposes internal services and credentials
- CVE-2026-9058, Szafir SDK (KIR): signature-verification routine reports success on an untrusted certificate chain, enabling auth bypass in Polish e-government
- Ghost CMS CVE-2026-26980: Content API SQL injection mass-exploited to steal Admin API keys and turn 700+ sites into ClickFix lures
- DNS-resolver patch cluster, Unbound 1.25.1 (11 CVEs) and ISC BIND 9.18.49 / 9.20.23
- CVE-2026-48172, LiteSpeed User-End cPanel plugin: authenticated cPanel user to root via lsws.redisAble, actively exploited
- CVE-2026-46333 ssh-keysign-pwn: a 9-year ptrace race in the Linux kernel reaching root and SSH host keys
- CVE-2026-9082: anonymous SQL injection in Drupal core on PostgreSQL, Highly critical, exploited and CISA KEV-listed
- ANSSI / CERT-FR publishes CERTFR-2026-AVI-0635 on SPIP < 4.4.15, security-policy bypass in the dominant French public-administration CMS
- CVE-2026-41091: exploited Microsoft Defender link-following privilege escalation to SYSTEM, with the CVE-2026-45498 Defender denial of service
- CVE-2025-34291, Langflow AI Workflow Platform: CORS misconfiguration + SameSite=None refresh token enables cross-origin token theft (CISA KEV, ITW, Flodric botnet)
- CVE-2026-34926, Trend Micro Apex One On-Premise: post-auth directory traversal by admin-credential holder injects code deployed fleet-wide to all managed agents (CISA KEV, ITW)
- PinTheft: Linux kernel RDS zerocopy double-free (CVE-2026-43494) turned into a root exploit through io_uring fixed buffers, public PoC; V12 found RDS loaded by default only on Arch Linux among the distributions it tested
- Keycloak 26.6.2 fixes 16 security issues, among them an OIDC login session fixation (CVE-2026-7507) and a WebAuthn execute-actions token replay (CVE-2026-37982)
- CVE-2026-42822: improper authentication in Azure Local Disconnected Operations allows privilege escalation over the network (CVSS 10.0), fixed in ALDO 2604
- SEPPmail Secure E-Mail Gateway: unauthenticated code execution and five more flaws in NCSC-CH's advisory (CVE-2026-44128 et al., CVSS up to 9.3), fixed by 15.0.4
- vm2 Node.js sandbox: two waves of critical sandbox escapes in May 2026, fixed in 3.11.2 and then 3.11.4
- DirtyDecrypt (DirtyCBC): public root exploit for a Linux kernel RxGK page-cache write, mapped to CVE-2026-31635, on kernels built with CONFIG_RXGK
- CVE-2026-45584: Microsoft Defender heap buffer overflow gives code execution when Defender scans a malicious quarantined file
- n8n CVE-2026-42231 et al.: five authenticated prototype-pollution and node flaws (CVSS 4.0 9.4) let workflow editors reach code execution or read server files
- MiniPlasma: Chaotic Eclipse PoC turns the 2020 Windows Cloud Files driver flaw CVE-2020-17103 into a SYSTEM shell on patched Windows 11; June 2026 updates fix it
- BigBlueButton bbb-web before 3.0.21 and 3.0.23: predictable session tokens, an API checksum bypass and an SSRF (CVE-2026-46351, CVE-2026-46353, CVE-2026-46404)
- CVE-2026-41553: DHTMLX PDF Export Module executes JavaScript injected into its data parameter without authentication (CVSS 4.0 10.0), with two file-read flaws (CVE-2026-41552, CVE-2026-7182)
- CVE-2026-41225: F5 BIG-IP iControl REST lets an authenticated Manager-role account run arbitrary commands and bypass Appliance mode (May 2026 quarterly)
- FunnelKit Funnel Builder for WooCommerce: unauthenticated settings write (CVE-2026-47100) exploited to plant card skimmers on checkout pages, fixed in version 3.15.0.3
- CVE-2026-44088: SzafirHost, KIR's qualified e-signature helper, verifies a JAR's signature and loads its classes from different parts of the file (fixed in 1.2.1)
- AMD-SB-7052 / CVE-2025-54518: AMD Zen 2 op-cache corruption lets local code run instructions at a higher privilege, guest to host included (CVSS 7.3); OS updates on EPYC 7002, OEM BIOS updates on Ryzen
- OpenClaw "Claw Chain": four chainable sandbox, exec-allowlist and MCP loopback flaws (CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, CVE-2026-44118) fixed in release 2026.4.22
- CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in rewrite module ("NGINX Rift"), PoC public
- CVE-2026-20182: Cisco Catalyst SD-WAN peering authentication bypass (CVSS 10.0) exploited by UAT-8616; affects Controller, Manager and Validator
- CVE-2026-45793, PHP Composer: GitHub Actions and GitHub App installation tokens printed in full to CI job logs when GitHub's new token format failed validation (CVSS 7.5)
- CVE-2026-45691, Nextcloud Server and Enterprise Server: second-factor bypass on DAV endpoints by reusing a pre-2FA session cookie (CVSS 5.9)
- CVE-2026-8043, Ivanti Xtraction: authenticated file read and HTML write (CVSS 9.6), patched with an Endpoint Manager SQL injection to RCE and a Virtual Traffic Manager admin command injection in Ivanti's May 2026 batch
- CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE, exploited by a likely state-sponsored cluster; fixed builds for every supported branch
- CERTFR-2026-AVI-0572: Centreon April 2026 bulletin, SQL injection in eight components, command injection in MBI and XSS in MAP
- CERTFR-2026-AVI-0564: SPIP before 4.4.14, two remote code execution flaws in the private area and, on certain nginx configurations, the public area
- CVE-2026-34263 and CVE-2026-34260: SAP Commerce Cloud unauthenticated code injection and S/4HANA Enterprise Search SQL injection (May 2026 Patch Day)
- CVE-2026-45185 "Dead.Letter": Exim use-after-free in BDAT/CHUNKING on GnuTLS builds, fixed in 4.99.3
- CVE-2026-44277 and CVE-2026-26083: unauthenticated code execution in the Fortinet FortiAuthenticator API and the FortiSandbox web UI
- CVE-2026-6722: PHP SOAP extension use-after-free in the ref_map deduplication can lead to code execution, fixed in PHP 8.2.31 to 8.5.6
- Microsoft Semantic Kernel CVE-2026-26030 / CVE-2026-25592: prompt injection reaches eval() and the host Startup folder in an AI agent framework, fixed since February
- cPanel & WHM security update of 2026-05-08: CVE-2026-29202 Perl code injection, CVE-2026-29203 symlink chmod and CVE-2026-29201 arbitrary file read
- CVE-2026-6973: Ivanti EPMM admin-authenticated RCE exploited in limited attacks, fixed with four further EPMM flaws including unauthenticated Sentry certificate issuance (CVE-2026-5787)
- CVE-2025-68670: xrdp pre-authentication stack overflow (CVSS 9.1), fixed in 0.10.5 in January; canary-protected builds need a second flaw to exploit
- CVE-2026-40982: Spring Cloud Config Server unauthenticated directory traversal (CVSS 9.1); open-source fixes only for 4.3.x and 5.0.x
- CVE-2026-42208: LiteLLM Proxy pre-authentication SQL injection in API-key verification, first exploitation attempt 36 hours after the advisory, CISA KEV-listed (CVSS 4.0 9.3)
- GLPI 10.0.25 and 11.0.7 fix seven CVEs: three stored XSS flaws and missing-authorization bugs that let users delete files and items
- CVE-2026-32202 in Windows Shell: an incomplete fix for an APT28-exploited LNK flaw leaks NTLM hashes when a folder is opened, exploited and re-released in July (CVSS 4.3)