60
45
Public PoC Released for Apache Superset SQL Injection Vulnerability
A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.
CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.
45
45
CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability
CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.
CVE-2026-9586 (CVSS 4.0: 9.3) is an unauthenticated SQL injection in the /pa endpoint of Sangoma Switchvox SMB Edition, where the unsanitized PhoneIP value in XML phone notification requests reaches the PostgreSQL database. Horizon3 demonstrated escalation to OS command execution, and honeypots run with Defused Cyber observed exploitation attempts on August 30, 2026, using PostgreSQL commands with nc and curl. Fixed in Switchvox 8.4.0.2 released July 14, 2026; one attacker IP (176.65.148.184) was documented.
64
Apache Superset SQL Injection Flaw Gets Public PoC Exploit
A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.
A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.
52
GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.
A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.
80
60
Hackers Exploit Critical Cisco Secure Email Gateway Flaw to Execute Commands as Root
Cisco patched critical unauthenticated SQL injection CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway enabling root command execution, with malicious activity already detected.
Cisco disclosed CVE-2026-76461, a critical SQL injection (CVSS 9.8) in Cisco Secure Email Gateway appliances running AsyncOS, letting unauthenticated remote attackers execute arbitrary commands as root via crafted emails containing malicious SQL statements. Cisco detected malicious activity and directly contacted Secure Email Cloud customers, indicating active exploitation. No workaround exists; fixed releases are AsyncOS 15.5.5-0141, 16.0.4-3021, and 16.5.0-780, with migration to 16.5.0-780 advised. Secure Email and Web Manager and Secure Web Appliance are not affected.
78
[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.
Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.
45
May 2026 CVE Landscape
60
60
U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.
CISA added six vulnerabilities to its KEV catalog: CVE-2015-3246 and CVE-2015-5287 (Red Hat libuser race condition and ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2021-23758 (Ajax.NET Professional deserialization), CVE-2022-0995 (Linux Kernel out-of-bounds write) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer flaw). CVE-2026-8452 has been observed under active exploitation in the wild and can cause denial-of-service. Under BOD 22-01, federal civilian agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
68
CISA Warns of Microsoft SQL Server RCE Vulnerability Exploited in Attacks
CISA warns attackers are exploiting CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, to run malicious commands on database servers.
CISA warned that CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, is being exploited in active attacks. Successful exploitation allows an attacker to execute malicious commands on a vulnerable database server, with access limited to the privileges of the SQL Server service account. The warning signals active exploitation of a long-known flaw and makes patching a priority for organizations running affected SQL Server deployments.
70
[webapps] Payload CMS 3.72.0 - Blind SQL Injection
A proof-of-concept exploit for a blind SQL injection vulnerability in Payload CMS 3.72.0 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in Payload CMS 3.72.0. The listing falls under the webapps category and allows reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.
25
[webapps] EasyAppointments 1.5.1 - Blind SQL Injection
A proof-of-concept exploit for a blind SQL injection vulnerability in EasyAppointments 1.5.1 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in EasyAppointments 1.5.1. The listing falls under the webapps category and enables reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.
20
[webapps] CubeCart 6.7.4 - SQL injection
A second proof-of-concept SQL injection exploit for CubeCart 6.7.4 was published on Exploit-DB.
Exploit-DB lists a SQL injection proof-of-concept affecting CubeCart 6.7.4, the open-source shopping cart application. The entry demonstrates the flaw but the provided text does not include a CVE identifier or reports of exploitation in the wild. It appears alongside related CubeCart XSS and SQL injection listings published the same day.
12
[webapps] CubeCart 6.7.4 - SQL
A proof-of-concept SQL injection exploit targeting CubeCart 6.7.4 was published on Exploit-DB.
Exploit-DB carries a proof-of-concept exploit for a SQL injection vulnerability in CubeCart 6.7.4, an open-source e-commerce platform. The listing demonstrates the injection issue but the provided text includes no CVE identifier or evidence of active exploitation. SQL injection in the storefront could expose or modify store data.
12
60
U.S. CISA adds Microsoft Windows, Apache HugeGraph-Server, Oracle JDeveloper, Oracle WebLogic Server, and Microsoft SQL Server bugs to its Known Exploited Vulnerabilities catalog
60
60
August 2018 Microsoft Patch Tuesday fixes two flaws exploited in attacks in the wild
60
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.
CISA added six flaws to the KEV catalog on August 27, 2026, citing evidence of active exploitation, led by CVE-2026-8452, an improper buffer restriction in Citrix NetScaler ADC and Gateway that can cause denial-of-service. Defused Cyber and Previdian reported active exploitation of CVE-2026-8452, with 36 attempts over 12 days from 12 attacker IPs deploying web shells x.php and z.php. The other additions cover SQL Server RCE (CVE-2019-1068), Linux kernel out-of-bounds write (CVE-2022-0995), Red Hat ABRT and libuser privilege escalations (CVE-2015-5287, CVE-2015-3246), and AjaxPro deserialization RCE (CVE-2021-23758). FCEB agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.
72
60
60
60
U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) to KEV; federal agencies must patch by September 17, 2026.
CISA added CVE-2026-76461 (CVSS 9.8), a critical zero-day in Cisco AsyncOS for Cisco Secure Email Gateway, to its Known Exploited Vulnerabilities catalog. The flaw stems from insufficient validation in email parsing, letting an unauthenticated remote attacker send a crafted email with malicious SQL statements to achieve arbitrary command execution with root privileges. Cisco confirmed active exploitation in the wild, notes no workarounds exist, and recommends checking mail_logs for suspicious SQL statements like 'COPY.*TO PROGRAM' on every cluster device. Under BOD 22-01, FCEB agencies must remediate by September 17, 2026.
85
Critical Cisco Secure Email Gateway zero-day gives attackers root access
Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.
Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.
92
Cisco Secure Email Gateway Vulnerability Exploited in Attacks (CVE-2026-76461)
Cisco Secure Email Gateway flaw CVE-2026-76461 enables root command execution via crafted email SQL injection and is actively exploited, added to CISA KEV.
Cisco disclosed critical vulnerability CVE-2026-76461 in Secure Email Gateway, caused by insufficient validation in email parsing logic, allowing arbitrary SQL statements that lead to root-level command execution. CISA added the flaw to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 17, 2026. The bug affects all SEG deployments regardless of configuration, with fixed releases including 15.5.5-014, 16.0.4-302, and 16.5.0-780. Defenders can check mail_logs for anomalous 'COPY ... TO PROGRAM' SQL statements to detect compromise.
82
Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day
Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.
Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.
93
Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)
Actively exploited zero-day SQL injection (CVE-2026-76461) in Cisco Secure Email Gateway allows unauthenticated root command execution; CISA ordered federal remediation by September 17.
Cisco confirmed attackers are exploiting zero-day CVE-2026-76461, an unauthenticated SQL injection in the email parsing logic of AsyncOS on Secure Email Gateway appliances (versions 16.5, 16.0, 15.5 and earlier) and Secure Email Cloud. Successful exploitation yields arbitrary SQL execution and root-level command execution on the underlying OS without user interaction. Cisco became aware of active exploitation in September 2025, has directly contacted affected cloud customers, and released fixed releases 15.5.5-014, 16.0.4-302, and 16.5.0-780. CISA added the flaw to its Known Exploited Vulnerabilities catalog and required federal civilian agencies to patch by September 17 and hunt for compromise.
85
CVE-2019-1068: A remote code execution vulnerability exists in ...
CISA added CVE-2019-1068, a high-severity remote code execution flaw in Microsoft SQL Server, to its KEV catalog after confirming exploitation in the wild.
CVE-2019-1068 (CVSS 8.8, CWE-20) is an improper input validation flaw allowing unauthenticated RCE in Microsoft SQL Server 2014 SP2/SP3, 2016, and 2017 on 32-bit and x64 builds. Exploitation requires low complexity and low privileges with no user interaction, and CISA formally added it to the KEV catalog on August 26, 2026. The CVE was originally published on July 15, 2019 and carries an EPSS score of 52.8%. Administrators must inventory affected SQL Server assets and apply vendor patches on an accelerated timeline.
72
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Attackers exploit unauthenticated SQL injection CVE-2026-9586 in Sangoma Switchvox to run PostgreSQL commands and deploy reverse shells.
Threat actors are exploiting CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997), since August 30, 2026, running arbitrary SQL as the PostgreSQL superuser and achieving remote code execution. The /pa endpoint concatenates the user-controlled PhoneIP value into PostgreSQL queries; attackers can extract database contents, escalate to Switchvox web administrator, exfiltrate the cookie signing key to forge authentication, and invoke reverse shells. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, roughly 4,000 instances are internet-exposed (mostly in the US), and honeypot activity from IP 176.65.148.184 deploys reverse shells followed by Base64-encoded process enumeration.
70
60
60
60
60
Trend Micro fixes critical bugs in Apex Central and TMEE PolicyServer
60
Network Security Trends: August
60
Network Security Trends: November 2021 to January 2022
60