Cisco alerts customers to second actively exploited zero-day in as many days
Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.
88
Vendor
VulnCheck
- Mentions · 7d0
- Mentions · 30d0
- All mentions11
- First seenAug 20, 2026
- Last mentionedSep 17, 2026
Timeline
11 articles · newest firstAttackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.
74
China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.
68
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
68
Hackers Target Langflow in CVE-2026
Threat actors are actively exploiting CVE-2026-0768, an unauthenticated Python RCE in Langflow, hunting OpenAI, AWS, and SSH credentials.
72
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
35
Attackers Exploit Critical Langflow and Rails Flaws in Credential
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
88
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.
82
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.
58
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
50
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.
74
Related CVEs
by mentions- CVE-2026-07682%9.8Langflow code Code Injection Remote Code Execution Vulnerability
- CVE-2026-6606630%9.5Unauthenticated Arbitrary File Read in Ruby on Rails Active Storage
- CVE-2026-74232<1%9.3Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access
- CVE-2026-66747<1%9.3Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
- CVE-2026-742333%9.3Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2026-7646130%9.8Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway
- CVE-2026-6484910%9.3Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets
- CVE-2026-890263%9.3Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework
- CVE-2022-24346<1%7.8In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible
Appears with
- CISAorganization · 3
- ZBTvendor · 2
- watchTowrvendor · 2
- Langflowvendor · 2
- VulnCheckorganization · 2
- Langflowproduct · 2
- US, Germany, Malaysia, Brazil, India Langflow hostsvictim · 1
- JPLvendor · 1
- Huntressvendor · 1
- Ruby on Railsvendor · 1
- xAIorganization · 1
- Shadowserver Foundationvendor · 1
- PyPIorganization · 1
- FBIorganization · 1
- Marimo notebookproduct · 1
- AIT-GUIproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.