ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
LiveUpdated Sep 19, 23:51 UTC · 15m agoNext check 00:11 UTC2 new stories in the last hour
76Stories · 24h9Critical or high · 24h74Exploited in the wild · 48h108New CVEs · 24h7KEV additions · 7d197Ransomware victims · 7d44AI stories · 24h11Models tracked · 7d

Critical storiesAll →

Daily brief · 2026-09-19written

Attackers turned a Brevo breach into a supply-chain attack: after compromising Brevo's SAML SSO on September 10 — reaching 138 accounts and exporting contacts from 43 — they used a long-lived Cloudflare API key hardcoded in the company's source code to deploy a malicious Cloudflare Worker injecting malware scripts into 100,000+ customer websites, including Trezor. Sansec…

Top storiesAll →

Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access

Four patched Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—let local attackers corrupt kernel memory and gain root privileges.

Researchers disclosed four Linux kernel privilege escalation vulnerabilities in long-standing networking code: DirtyAH6 (CVE-2026-80844) in IPv6 Authentication Header/XFRM processing, TUNderflow (CVE-2026-81000) in the TUN/TAP subsystem, PPPoEject (CVE-2026-68121), a use-after-free in PPP over Ethernet's pppoe_sendmsg(), and DiagSpill (CVE-2026-74469) in SCTP sock_diag reporting caused by a wrapping 16-bit transport counter. Most are local privilege escalation bugs, though IPv6 routers using AH transport mode face narrow remote denial-of-service risk, and one researcher demonstrated remote root access in a lab via memory grooming. Researcher Asim Viladi Oglu Manizada reported the issues to the kernel security team in mid-July, and coordinated patches are now available in stable branches including 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Restricting unprivileged user namespaces helps for three flaws but does not mitigate DiagSpill.

Cyber Security Newsupdated · 3h agofirst · 1d agoVulnerability 10 sourcesCVE-2026-80844CVE-2026-81000CVE-2026-68121+1 CVEs1

CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks

CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV with a September 21 federal patching deadline.

CISA added CVE-2025-39682 (CVSS 9.8, improper condition check in the kernel TLS receive path affecting kTLS-enabled TCP sockets), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in netfilter bridge ebtables SNAT), and CVE-2025-39964 (CVSS 7.8, race condition in AF_ALG) to its Known Exploited Vulnerabilities catalog on September 18, 2026. Binding Operational Directive 26-04 requires federal civilian agencies to remediate by September 21 and perform forensic triage for evidence of compromise. The most severe flaw is remotely triggerable on internet-accessible services using kTLS, while the other two require local access and can enable denial of service or privilege escalation. CISA has not attributed the exploitation or identified attackers or victims, but KEV inclusion confirms real-world exploitation.

Cyber Security News · 8h agoExploit / PoC in the wild 19 sourcesCVE-2025-39682CVE-2026-53266CVE-2025-399641· 1 read

North Korean hackers infect thousands of devices across 100 countries as part of ‘WaterPlum’ campaign

FBI and Japanese police advisory ties North Korea's WaterPlum campaign to $10.5M stolen from job seekers via fake-recruiter malware on 30,000 devices.

A joint advisory from the FBI, US Defense Department, Japan's National Police Agency and partners describes 'WaterPlum', North Korean cyber actors posing as AI and blockchain companies to recruit job seekers. Between December 2025 and July 2026 the group infected at least 30,000 devices across 100 countries and stole funds or credentials from about 7,000 cryptocurrency wallets, totaling over $10.5 million. Victims, mostly web designers, engineers and crypto specialists in Japan and elsewhere, were contacted via social media and freelance portals and told to download files during interviews, leading to infection with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle malware plus remote management tools. The campaign is intertwined with DPRK IT-worker laptop-farm schemes and is attributed to North Korea's General Bureau of the Munitions Industry Department; Japanese police disrupted a laptop farm for the first time.

The Recordupdated · 10h agofirst · 1d agoThreat actor in the wild 5 sources1· 1 read

Researchers use AI to find widespread software decoder flaw

Hacktron researchers, aided by Claude and GPT-5.6 Sol, disclosed HEIF Heist, memory-corruption flaws in libheif/libde265 enabling RCE against major platforms.

Hacktron researchers disclosed HEIF Heist, memory-corruption flaws in the libheif and libde265 image decoders triggered by crafted HEIF, HEIC, and AVIF uploads, enabling remote code execution or heap disclosure across services including Meta's product suite, GitHub Enterprise, Discourse, and OpenAI. By chaining the parser flaw with an SSO misconfiguration, they compromised an OpenAI employee's Codex account and opened a pull request in the company's internal monorepo within a 72-hour attack window. OpenAI paid a $6,500 bug bounty and the flaw was patched within days of its July 25 discovery. The team says frontier models like GPT-5.6 Sol cut exploit development time to 1-3 days, warning deployments lacking latest patches remain potentially vulnerable.

CyberScoopupdated · 11h agofirst · 1d agoResearch 11 sources1

Vulnerabilities in libheif and libde265

Multiple new security advisories affect the libheif and libde265 codecs; users should verify versions against the published fixes.

An oss-security post highlights numerous recent security advisories for libheif and libde265, the open-source libraries used to decode HEIF/HEVC images. The GitHub security pages of both strukturag projects list several new advisories published over the past few months. The poster, Alan Coopersmith, urges anyone using these codecs to check their versions, while noting the related heif-heist.com site is more promotional than informational.

oss-securityupdated · 6h agofirst · 1d agoVulnerability 2 sources

ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

ShinyHunters exploited a Grav CMS file upload flaw to breach and deface the Clop ransomware gang's leak site, claiming theft of source code, logs, and Tor private keys.

The ShinyHunters extortion gang exploited a claimed unauthenticated file upload vulnerability in Grav CMS to upload a taunting file and completely deface the Clop ransomware operation's Tor data leak site with Umbreon ASCII art. ShinyHunters claims it gained full server access, stealing source code, Grav CMS plugins, /var/log files, and the private keys for Clop's onion service, and plans to extort Clop with a 72-hour deadline. The feud reportedly stems from Clop's 2025 Oracle E-Business Suite extortion campaign, which used the zero-day CVE-2025-61882 and an exploit ShinyHunters says was stolen from them. BleepingComputer confirmed the defacement but could not verify the data theft or key theft claims.

BleepingComputerupdated · 10h agofirst · 10h agoRansomware in the wild 5 sourcesCVE-2025-61882

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

CrowdSec says the TanStack npm supply chain attack let an attacker copy 170 private GitHub repos via a former employee's retained account.

On May 22 an attacker used a GitHub OAuth token from a former CrowdSec employee whose organization access had been kept active, copying about 170 private repositories containing the web console, data science models, and blocklist consensus algorithm. CrowdSec attributes the access to CVE-2026-45321, the May 11 publication of 84 malicious versions of 42 TanStack npm packages that stole GitHub tokens, SSH keys, and cloud credentials from developer machines. The leaked archive also exposed email addresses of 83 users and names, emails, and investment context of 51 potential investors from 2020. The same campaign affected Mistral AI and OpenAI, and the only usable credential found in the leak, an AWS SNS publish token, saw an attempted misuse on August 17.

The Hacker Newsupdated · 12h agofirst · 16h agoData breach in the wild 2 sourcesCVE-2026-45321

CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

Perl DBI before 1.653 loads arbitrary modules via unvalidated DBD::DBM dbm_type and dbm_mldbm attributes, enabling code execution with attacker-controlled attributes.

CVE-2026-78030 affects the Perl DBI database interface in all versions before 1.653. The DBD::DBM driver does not validate the dbm_type and dbm_mldbm attributes before using them to load Perl modules, so applications that pass attacker-controlled attributes to DBI connect can be made to load arbitrary modules, which can lead to code execution. Robert Rothenberg disclosed the flaw on the oss-security mailing list on September 19, 2026; users should upgrade to DBI 1.653.

oss-security · 7h agoVulnerabilityCVE-2026-78030

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.

Fortinet reports active in-the-wild exploitation of CVE-2026-58138 (CVSS v3.1 9.8), an unauthenticated remote code execution flaw in Orkes Conductor 3.21.21 before 3.30.2. Attackers submit inline workflow definitions with malicious JavaScript or Python expressions to the workflow API, escaping unsandboxed GraalVM evaluators configured with HostAccess.ALL to run arbitrary OS commands. Fortinet blocked 1,290 attempts in 24 hours as of September 9, 2026, and nearly 7,000 between September 2-9, with most activity from Germany, Hong Kong, Indonesia, the U.A.E., and India. Previdian and Empirical Security also observed exploitation since July 24, 2026.

The Hacker News · 15h agoExploit / PoC in the wild 2 sourcesCVE-2026-581381· 1 read

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV; federal patch deadline September 21, 2026.

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 19, 2026, citing evidence of active exploitation: CVE-2025-39682 (CVSS 9.8, memory disclosure/DoS in the TLS receive path), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in the ebtables SNAT ARP rewrite path enabling local privilege escalation), and CVE-2025-39964 (CVSS 7.8, race condition in concurrent AF_ALG socket writes causing DoS or data corruption). Red Hat updated its advisories to acknowledge active exploitation, stating known public exploits exist and urging high-priority remediation. Under BOD 26-04, federal civilian agencies must apply fixes by September 21, 2026. Separately, researcher Asim Manizada disclosed four local privilege escalation flaws: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).

The Hacker News · 17h agoExploit / PoC in the wildCVE-2025-39682CVE-2026-53266CVE-2025-39964+4 CVEs

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds patched CVE-2026-28326 (CVSS 8.8), a hard-coded-key flaw enabling unauthenticated remote code execution in Access Rights Manager 2026.2 and prior.

SolarWinds released ARM 2026.2.1 on September 17, 2026 to fix CVE-2026-28326, an unauthenticated remote code execution flaw in Access Rights Manager caused by a hard-coded static key, reported by Armadin researcher Kai Huang. The company stated there is no evidence of exploitation in the wild. The same cycle resolved Web Help Desk issues CVE-2026-28323 (CVSS 9.8, SAML authentication bypass) and CVE-2026-28299 (CVSS 8.2, denial-of-service), plus 16 Serv-U flaws enabling privilege escalation, RCE, and administrator account creation.

The Hacker News · 14h agoVulnerabilityCVE-2026-28299CVE-2026-28302CVE-2026-28304+16 CVEs

RatHat Turns Android Accessibility Into an Attack Weapon

Zimperium details RatHat, a China-linked Android trojan abusing Accessibility, wireless debugging, and generative AI to steal banking credentials and persist on phones.

Zimperium analyzed RatHat, an Android trojan from China-based operators distributed via fake app stores through malvertising, smishing, and third-party forums. It abuses Accessibility Services to silently enable wireless debugging, reads the on-screen ADB pairing code to self-pair, and drops Go binaries including an FRP reverse proxy that exposes the phone's ADB shell to remote attackers. It captures credentials via accessibility keylogging, fake overlays on banking apps, WeChat, and Alipay, SMS 2FA interception, and a /dev/input hardware-level keylogger, while sending accessibility-tree XML to a popular generative AI assistant for resilient screen automation and reinstalling itself if uninstalled.

Security Affairsupdated · 15h agofirst · 1d agoMalware in the wild 8 sources

LatestAll →

Critical CVEsAll →

  • CVE-2026-681217.8<1%
    Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject)
    CVE-2026-68121 is a use-after-free in the Linux kernel's PPPoE implementation: pppoe_sendmsg() caches a pointer to the PPPoE header before calling dev_hard_header(), but device header callbacks are allowed to reallocate the socket buffer head, leaving that pointer dangling. The race is triggered when a send blocks in copy_from_user() while the first non-Ethernet port is added to an empty team device, causing the team's delegated GRE header callback to expand the skb head; PPPoE then writes six bytes through the stale pointer into freed memory. A local attacker can leverage this memory corruption for privilege escalation, reportedly reaching a root shell as one of four recently disclosed Linux kernel LPE flaws dubbed 'PPPoEject'. Any Linux system with PPPoE support enabled is potentially affected, though practical exploitation requires local code execution plus the uncommon combination of a PPPoE socket and a team device. A public proof-of-concept has been published on GitHub, but the flaw is not in CISA's KEV catalog and EPSS remains low at 0.1%.
    public PoC seen · Linux kernel (PPPoE subsystem, pppoe_sendmsg()) PoC mass
  • CVE-2026-810007.8<1%
    Linux kernel TUN/TAP headroom integer underflow enables local memory corruption
    An integer underflow in the Linux kernel's TUN/TAP driver (net/tun.c) lets tun_get_user() compute a negative linear data size when the configured headroom (tun->align) exceeds the one-page skb-head budget; the value wraps when stored as a size_t, so tun_alloc_skb() can place skb->data outside the allocated buffer. The oversized headroom can be set locally or propagated to a TUN/TAP port by Open vSwitch when packets arrive from another port, so triggering requires injecting packets into a TUN/TAP device with a large alignment value, which needs local access with privileges. Successful exploitation corrupts kernel memory adjacent to the skb, giving a local attacker full confidentiality, integrity, and availability impact (CVSS 7.8), i.e., potential ring-0 code execution and complete host compromise. Any system running a kernel with the vulnerable tun_get_user() logic is affected, with VPN gateways, container hosts, and Open vSwitch/SDN deployments the most likely exposure paths. No public PoC is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported.
    public PoC seen · Linux kernel (net/tun.c TUN/TAP driver) PoC mass
  • CVE-2026-936599.3—
    Stored XSS in Concrete CMS Community Store order fields hijacks admin sessions
    Community Store, the e-commerce add-on for Concrete CMS, renders customer-supplied order fields such as billing name, email, and phone number without HTML escaping in both checkout and admin order views. An unauthenticated attacker can submit an order containing JavaScript in those fields, and the payload executes when a manager or administrator later views the order in the dashboard. Because the script runs inside an authenticated staff session, the attacker can create rogue user accounts or exfiltrate data from the CMS. All sites running Community Store versions before 2.7.8 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.
    public PoC seen · Concrete CMS Community Store all versions before 2.7.8 PoC moderate
  • CVE-2026-939859.4—
    Sandbox Escape in OpenPanel js-runtime Webhook Template Validator Enables RCE
    OpenPanel's js-runtime component, through commit bad75bdd, contains a sandbox escape (CWE-94) in its JavaScript webhook template validator, which fails to block computed member access to constructor chains. An attacker who holds project write access can create a webhook template that uses computed property notation to reach the Function constructor and execute arbitrary code inside the worker process. Successful exploitation yields full confidentiality, integrity, and availability impact on the worker and downstream scope, reflected in the critical CVSS 4.0 score of 9.4 (network vector, low complexity, low privileges, no user interaction). Any deployment running the affected js-runtime revision and allowing users or projects to define webhook templates is exposed. No public proof-of-concept is known, the issue is not in CISA KEV, and no in-the-wild exploitation has been reported.
    published · OpenPanel js-runtime (JavaScript webhook template validator) all versions through commit bad75bdd (no fixed commit or release specified in available data)niche
  • CVE-2026-283239.8<1%
    SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability.
    SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
    first coverage · solarwinds web help desk—
  • CVE-2026-283139.1<1%
    SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover.
    SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.
    first coverage · solarwinds serv-u—
  • CVE-2026-283069.1<1%
    SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator.
    SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
    first coverage · solarwinds serv-u—
  • CVE-2026-283089.1<1%
    SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution.
    SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
    first coverage · solarwinds serv-u—

Live wirechecked 00:06:14 UTC

Newest ingested first · refreshes every 30s while this tab is open · times in UTC

Exploited in the wildAll →

  • CVE-2025-396827.11%
    Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS
    The Linux kernel's in-kernel TLS (kTLS) implementation mishandles zero-length records on the rx_list: each recvmsg() call must process either contiguous DATA records or a single non-DATA record, and the missed corner case occurs when the initial record is pulled from the rx_list and is zero length, breaking the check on record-type changes after zero-copy decryption. A local, low-privileged attacker able to use kTLS sockets can trigger this flaw, and the CVSS vector indicates high confidentiality impact (kernel information disclosure) and high availability impact (crash/DoS), with no integrity impact. Any Linux deployment running a kernel with the TLS (kTLS) feature enabled is affected, including Debian systems, which are listed as affected vendors in CISA's data. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed.
    added to KEV · Linux Kernel · Debian Linux KEVmass
  • CVE-2026-532668.8<1%
    Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge)
    CVE-2026-53266 is an out-of-bounds write (CWE-787) in the Linux kernel's netfilter bridge ebtables SNAT target: when the optional ARP sender-hardware-address rewrite is active, the kernel writes the new MAC address via skb_store_bits() without first making that byte range writable. If the ARP sender hardware address bytes sit in a nonlinear skb fragment backed by a splice-imported file page, the write maps the fragment page and copies the MAC directly into a file-backed page-cache page, corrupting kernel-managed memory. A local, low-privileged attacker (for example a container tenant, VM, or user able to send traffic into a bridge using ebtables SNAT with ARP rewriting) can trigger this with crafted ARP packets, gaining kernel memory corruption usable for privilege escalation or integrity/availability impact (CVSS 3.1 8.8, scope changed). Any Linux system running a kernel with the vulnerable ebtables SNAT code in a bridged-networking configuration that performs this ARP rewrite is affected; the source data does not state specific affected version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation, although EPSS is low (0.1%, 2nd percentile) and no public proof-of-concept is known.
    added to KEV · Linux kernel KEVmass
  • CVE-2025-399645.5<1%
    Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg)
    CVE-2025-39964 is a race condition (CWE-362) in the Linux kernel's AF_ALG crypto socket interface: the af_alg_sendmsg function did not prevent concurrent writes to the same socket, so two simultaneous writes could interleave data unpredictably and leave the kernel's internal socket state inconsistent. It is triggered by a local user (or local process) issuing concurrent write/sendmsg operations on the same AF_ALG socket, which is why the CVSS v3.1 score is low (3.3, local vector, low availability impact). An attacker exploiting the race primarily gains the ability to corrupt socket state, with potential for degraded availability; confidentiality and integrity are not rated as impacted. Any Linux kernel deployment whose build includes the vulnerable af_alg code is affected, though exploitation requires the ability to run local code that uses the crypto socket API. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild per CISA, but no public proof-of-concept is known and ransomware use is unknown; EPSS estimates a 0.3% probability of exploitation in the next 30 days.
    added to KEV · Linux kernel KEVmass
  • CVE-2026-587048.8<1%
    Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
    A logic error in the cellular modem component causes an improper authorization check (CWE-285/CWE-693), allowing a permission bypass. An attacker who already has low privileges and is on an adjacent network (proximal, e.g., a hostile local or cellular-adjacent network) can trigger the flaw without any user interaction, and successful exploitation yields remote escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw was assigned through Google's device security CNA ([email protected]), consistent with modem firmware shipped in Google Pixel-class devices; specific affected firmware versions were not provided in the source data. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and there is no evidence of exploitation in the wild. Defenders should treat this as a patch-on-next-bulletin item unless devices operate in high-risk adjacent-network environments.
    added to KEV · Google Cellular Modem (modem firmware on Google Pixel-class devices, per assigning CNA) KEVmass
  • CVE-2026-878867.8<1%
    Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation
    CVE-2026-87886 is an incorrect default permissions flaw (CWE-276) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Because files or objects installed by the plugin/extension carry overly permissive default permissions, a local attacker with low-privileged access to a Linux hosting server can abuse them to escalate privileges. Successful exploitation grants elevated Linux privileges on the hosting server, which could enable persistence, access to hosted customer data, or further lateral movement. Any hosting provider or administrator running the Acronis Backup integration on cPanel & WHM or Plesk servers is affected. The flaw was added to the CISA KEV catalog on 2026-09-16, and multiple reports describe targeted attacks exploiting it in the wild, though no public proof-of-concept is known and ransomware use is undetermined.
    added to KEV · Acronis Backup plugin for cPanel & WHM · Acronis Backup extension for Plesk KEVmoderate
  • CVE-2026-7646010.0<1%
    Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
    Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending.
    added to KEV · Cisco Identity Services Engine (ISE) · Cisco ISE Passive Identity Connector (ISE-PIC) KEV PoC large
  • CVE-2026-764619.82%
    Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway
    Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.
    added to KEV · Cisco Secure Email Gateway (Cisco AsyncOS Software) KEV PoC ×3large
  • CVE-2026-420187.511%
    Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
    JFrog Artifactory contains an improper authentication flaw (CWE-287) in which the server may return its internal anonymous-user token to an unauthenticated caller, even on instances where anonymous access is disabled. An attacker triggers the issue by sending unauthenticated requests to the affected Artifactory interface over the network; the vector requires no privileges or user interaction and is of low complexity. Successful abuse yields the internal anonymous-user token, which can then be used to reach sensitive resources (such as repositories or artifacts) that should be protected when anonymous access is disabled, with high confidentiality impact but no integrity or availability impact. Any organization running an affected JFrog Artifactory deployment - particularly those relying on disabled anonymous access as a control - is affected, though only instances where the vulnerable endpoint is reachable are actually exposed. Exploitation has been reported in the wild as part of an ongoing Artifactory attack campaign alongside CVE-2026-42016 and CVE-2026-82329, although there is no public PoC and the flaw is not yet in the CISA KEV catalog.
    added to KEV · JFrog Artifactory KEVlarge

Patch prioritiesAll →

  • CVE-2026-8570610.015%
    Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE
    CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.
    · GitLab Community Edition · GitLab Enterprise Edition KEV PoC ×11mass
  • CVE-2026-420168.89%
    Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
    JFrog Artifactory (Self-Hosted) versions before 7.133.11 fail to validate a token's scope, checking only the token's signature and issuer, which constitutes an incorrect authorization flaw (CWE-863). A remote, authenticated user with low privileges can obtain or present a token whose scope is never verified, bypassing authorization checks and escalating to higher privileges. Successful attackers gain administrative control of the Artifactory instance; in observed attacks this flaw has been chained with CVE-2026-42018 and CVE-2026-82329 to bypass authentication, take admin control, and deploy backdoor malware. Only self-hosted Artifactory deployments are within the stated affected scope. Exploitation is confirmed in the wild and the vulnerability was added to CISA's KEV catalog on 2026-09-11, although no public proof-of-concept code is known.
    · JFrog Artifactory (Self-Hosted) All versions before 7.133.11 KEVlarge
  • CVE-2026-848699.9<1%
    Missing authorization in ScreenConnect client allows unauthorized file execution
    CVE-2026-84869 is a critical authorization flaw (CWE-862 missing authorization, CWE-269 improper privilege management) in the ScreenConnect client, the endpoint-side agent of ConnectWise's widely used remote access and remote support platform, in which files can be transferred to a machine and executed during an active remote session without the expected authorization or without confirmation by the Host (technician). It is triggered in certain circumstances during an active session, with a network attack vector, low attack complexity, low privileges required, and no user interaction per the CVSS 3.1 vector. An actor who obtains or already holds access to a session context could thereby push and run files on the managed endpoint, potentially achieving code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 score 9.9, scope changed). Only endpoints running the ScreenConnect client are affected; ScreenConnect servers are not impacted, and the affected client version ranges are governed by ConnectWise security advisory AV26-903 (not enumerated in the available data). The flaw is not currently known to be exploited: it is not in CISA KEV, no public proof of concept is known, and EPSS assigns a modest 0.4% probability of exploitation within the next 30 days (32nd percentile).
    · ConnectWise ScreenConnect client (endpoint agent) KEVmass
  • CVE-2026-860609.21%
    Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
    CVE-2026-86060 is an argument-injection flaw (CWE-88) in MikroTik RouterOS's SSH login path: when a login supplies a username beginning with a prohibited character, the RouterOS login helper mishandles the argument, allowing the trusted RouterOS policy mask to be changed and privileges to be escalated. An unauthenticated attacker only needs the ability to reach the router's SSH service, since exploitation happens during the SSH login process itself. By altering the policy mask the attacker gains elevated rights on the device, and news reports indicate attackers have used this technique — including logins with usernames such as '-2' — as part of chains that take over routers without needing a password. Any RouterOS deployment running versions before the fixes (6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable) with SSH enabled or reachable is affected, with internet-exposed SSH at highest risk. Multiple outlets report the RouterOS flaws are being actively exploited in the wild, although no public proof-of-concept is known and the flaw is not yet in CISA KEV.
    · MikroTik RouterOS v6 (Long-term channel) versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS v7 (Long-term channel) versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC ×2mass
  • CVE-2026-672778.8<1%
    Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
    CVE-2026-67277 is a missing-authentication flaw (CWE-306) in the bandwidth-test (btest) service of MikroTik RouterOS: the service accepts a "related" btest connection before the primary session has completed authentication, so an unauthenticated remote client can start an IPv4 UDP bandwidth test. When the test runs with "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer, leaking a small amount of kernel memory, and a separate unchecked, inverted packet-size interval causes an unsigned integer underflow that produces anomalously large fragmented output capable of restarting the RouterOS kernel. An unauthenticated network attacker therefore gains limited information disclosure and, more significantly, a remote denial of service through repeated router crashes, with no credentials or user interaction required (CVSS 4.0: 8.8 High). Any MikroTik device running an unpatched RouterOS version with the bandwidth-test server enabled and reachable from an untrusted network is affected. No public PoC or CISA KEV listing exists for this CVE and EPSS is low (0.4%), but it is part of the batch of RouterOS fixes in MikroTik advisory AV26-887 that attackers have recently chained to hijack routers, so in-the-wild exploitation of the flaw set is reported.
    · MikroTik RouterOS (Long-term channel, v6) All versions prior to 6.49.21 (fixed in 6.49.21) · MikroTik RouterOS (Long-term channel, v7) All versions prior to 7.23.4 (fixed in 7.23.4) KEV PoC mass
  • CVE-2026-2007910.076%
    Authentication bypass to root access in Cisco Secure Firewall Management Center
    CVE-2026-20079 is an authentication bypass (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, caused by an improper system process created at boot time. An unauthenticated, remote attacker can exploit it by sending crafted HTTP requests to the FMC web interface, which allows the execution of script files and commands on the device. A successful exploit grants the attacker root access to the underlying operating system, giving full control of the management platform (CVSS 3.1: 10.0, network-exploitable, no privileges or user interaction required, scope changed). The flaw affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management deployments. Cisco has confirmed the vulnerability is being exploited in active attacks, it carries a 35.9% EPSS score (98th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.
    · Cisco Secure Firewall Management Center (FMC) Software (web interface) · Cisco Security Cloud Control (SCC) Firewall Management KEV PoC ×2large
  • CVE-2026-194909.36%
    Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
    Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).
    · Citrix NetScaler ADC and NetScaler Gateway KEV PoC large
  • CVE-2025-252499.82%
    Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
    CVE-2025-25249 is a heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that allows an attacker to execute unauthorized code or commands. It is triggered by sending specially crafted packets to an affected device, causing an out-of-bounds write in heap memory that can be leveraged for code execution. Successful exploitation gives attackers command execution on the appliance; in observed intrusions against FortiGate firewalls, attackers have deployed custom Node.js malware and a post-exploitation RAT dubbed PivotC2. Any organization running the affected Fortinet products is at risk, with internet-facing FortiGate firewalls the primary concern. The flaw was added to CISA's KEV on 2026-09-09, confirming active exploitation in the wild (ransomware use unknown); no public PoC is known.
    · Fortinet FortiOS · Fortinet FortiSwitchManager KEV PoC mass

AIAll →

Ransomware & breachesAll →

  • Company ID : bgsedfhgsbdfs · zawoo
  • Company ID : vdssdcnhuysdz · zawoo
  • Company ID : daszxvbgfnczm · zawoo
  • voltgames.io · unsafe
  • Schneider’s Computing · arcus media
  • AKAZZO · arcus media
  • Kreishandwerkerschaft Borken · rhysida
  • Young Injury Law · cry0
  • AUDIT ENTITY: td***up · audit team
  • Quy Nhon University · vexy

ModelsAll →

Activity

CyberAI
Table view
DayCyberAI
2026-09-0789102
2026-09-08286131
2026-09-09257142
2026-09-10240135
2026-09-11176106
2026-09-122548
2026-09-134051
2026-09-14208127
2026-09-15221115
2026-09-16272143
2026-09-17203151
2026-09-1816871
2026-09-193244
2026-09-2000

Categories

Threat actors & malwareAll entities →

Trending tags

openai 118anthropic 92ai-agents 89rce 81ai-safety 80patch 74cisco 74cisa 69privilege-escalation 62google 61llm 54microsoft 50kev 48supply-chain 48privacy 46ubuntu 46benchmark 44advisory 44opinion 42social-engineering 42