Search: “platforms”

7 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 13 Industry 11 Vulnerability 10 Exploit / PoC 10 Malware 10 Tools 9 Phishing & fraud 6 AI safety & security 5 Research 4 Threat actor 4 Model release 3 Policy & legal 3 Advisory 2 AI policy 2

SeverityAll critical 5 high 23 medium 20 low 1 info 45

Public PoC Released for Apache Superset SQL Injection Vulnerability

A public Python PoC exploit is available for CVE-2026-23980, an authenticated error-based SQL injection in Apache Superset versions before 6.0.0.

CVE-2026-23980 is a SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0, exploitable via the sqlExpression and where parameters by authenticated users with read-level access. A public repository containing a Python exploit.py proof-of-concept has been released, reducing attacker effort against exposed instances. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. Defenders should upgrade and monitor logs for malformed queries, database errors, and unusual activity from low-privilege accounts.

Cyber Security Newsupdated 09:23 UTC · 9h agofirst 08:04 UTC · 10h agoExploit / PoC 2 sources CVE-2026-23980

CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability

N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.

CVE-2026-86218 is a critical pre-authentication remote code execution flaw (CWE-96 static code injection) in N-able N-central servers, scored 10.0 CVSS 4.0 by N-able and 9.8 CVSS 3.1 by NIST. N-able fixed it in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, and has already patched hosted NCOD environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026, citing evidence of active exploitation, though researchers have not attributed every reported N-central compromise to this flaw. Horizon3 released a NodeZero Rapid Response test to validate exposure and recommends log review for prior compromise.

Horizon3.aiupdated 17:13 UTC · 1h agofirst 16:06 UTC · 2h agoExploit / PoC in the wild 19 sources CVE-2026-862182

CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks

CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.

CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.

Cyber Security News15:31 UTC · 3h agoExploit / PoC in the wild 5 sources CVE-2026-848691

Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)

Acronis warns CVE-2026-87886, an authenticated Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugins, is under limited targeted exploitation; patches released.

Acronis disclosed CVE-2026-87886, a privilege escalation vulnerability caused by insecure file permissions in its backup plugins for cPanel, WHM, and Plesk, platforms popular among hosting providers and MSPs. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments, with no exploitation observed on Plesk so far, and the low-complexity attack requires no user interaction. Fixes shipped last week: backup plugin version 1.9.3 HF3 for cPanel & WHM and extension version 1.8.11 for Plesk.

Help Net Securityupdated 11:08 UTC · 7h agofirst 09:33 UTC · 9h agoExploit / PoC in the wild 6 sources CVE-2026-87886

Enterprises Warned of Attacks Exploiting WSO2 Vulnerability

Attackers are actively exploiting CVE-2026-5430 (CVSS 10), a WSO2 JWT authentication bypass, to access enterprise API credentials and sensitive data.

WatchTowr's honeypot network recorded the first exploitation attempt of CVE-2026-5430 on September 13, roughly two months after the CVE record was published in early August. The flaw, patched by WSO2 in April with an advisory in May, carries a maximum CVSS score of 10 and allows JWT authentication bypass via tokens signed with unsupported algorithms, enabling unauthorized access and full account takeover. A forged JWT observed in the wild granted access to API backend endpoints, credentials, and consumer keys and secrets for every registered application. WSO2's API Manager, API Control Plane, Traffic Manager, and Universal Gateway are affected, and the platform serves nearly 1,000 enterprise customers in banking, government, telecom, and logistics.

SecurityWeekupdated 15:05 UTC · 3h agofirst 08:39 UTC · 10h agoExploit / PoC in the wild 3 sources CVE-2026-54302· 1 read

Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild

Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.

CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.

Cyber Security Newsupdated 15:50 UTC · 2h agofirst 13:12 UTC · 5h agoExploit / PoC in the wild 2 sources CVE-2026-890261

Google fixes actively exploited Android zero-day on Pixel devices

Google patched 110 Pixel flaws including CVE-2026-58704, a modem privilege-escalation zero-day under limited targeted exploitation.

Google's September 2026 Pixel security update fixes 110 vulnerabilities, including CVE-2026-58704, a high-severity zero-day in the Cellular Modem subcomponent that Google says is under limited, targeted exploitation. The improper-authorization flaw lets attackers with adjacent network access and basic privileges escalate privileges without user interaction. The bulletin also includes 12 remote code execution and 89 privilege escalation flaws rated critical or high severity.

BleepingComputerupdated 17:56 UTC · 54m agofirst 07:00 UTC · 11h agoExploit / PoC in the wild 8 sources CVE-2026-58704 CVE-2025-48595