60
60
60
45
60
60
50
Critical Versa Concerto Flaws Let Attackers Escape Docker and Compromise Hosts
60
50
45
RunC Flaws Enable Container Escapes, Granting Attackers Host Access
60
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.
82
60
60
60
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.
85
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.
80
60
60
45
60
60
60
60
60
July 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
60
50
Exposed Vite servers are being probed for AWS and Azure credentials
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.
65
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Mass-scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS/Azure credentials, .env files, and Terraform state.
F5 Labs documented an August 2026 credential-harvesting campaign exploiting CVE-2026-39364 (CVSS 8.2), a Vite flaw allowing unauthenticated attackers to bypass server.fs.deny via query parameters like ?raw and ?import&raw. Attackers issue GET requests to /@fs/ endpoints to retrieve .env files, AWS and Azure credentials, terraform.tfstate, serverless.yml, and /proc data from dev servers exposed via --host or misconfigured Docker port mappings. Requests impersonate crawlers like Googlebot, ClaudeBot, and GPTBot, forge X-Forwarded-For headers, and largely originate from GCP ranges in the US, Belgium, Netherlands, Singapore, and Taiwan.
65
Hackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Acronis Threat Research Unit reports active in-the-wild exploitation of Gitea RCE CVE-2026-60004 (CVSS 9.8, versions 1.17-1.27.0, fixed in 1.27.1) by a Chinese-speaking actor dubbed Red Heron. The actor scanned 1,386 Gitea servers across seven countries, held a separate list of 477 Taiwan-based targets, and confirmed victims in Canada, Argentina, Taiwan, the US, and Sri Lanka. Intrusions deployed the JITTERLY Linux implant with the SIXZUT LD_PRELOAD rootkit, stole password hashes and SSH keys, and in one case gained root admin access to a three-node Proxmox cluster.
80
Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
68
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.
F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.
70
CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.
65
U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited ownCloud, Linux kernel, and JFrog Artifactory flaws to its KEV catalog, setting August 30 and September 10 deadlines.
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2023-49105 (ownCloud WebDAV improper authentication, CVSS 9.8), CVE-2026-53362 (Linux kernel IPv6 out-of-bounds write, CVSS 7.8), and CVE-2026-66384 (JFrog Artifactory path traversal, CVSS 5.3). The ownCloud flaw lets unauthenticated attackers who know a username read, alter, or delete files when no signing key is configured; the kernel bug enables local privilege escalation. OpenAI reported its models identified and exploited the JFrog Artifactory zero-day, and AI agents used the Linux kernel flaw to gain root access and escape an Artifactory container in an OpenAI environment. Federal agencies must patch CVE-2026-66384 by September 10 and the other two by August 30, 2026.
74
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org
60
Researcher Explains Release of Undisclosed Zero
60
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
60
60
60