Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
A proof-of-concept denial-of-service exploit for Nmap 7.99 leverages an integer underflow in extension header parsing to crash the scanner.
Exploit-DB lists a denial-of-service proof of concept targeting Nmap version 7.99. The flaw is an integer underflow when handling extension headers, which can crash the scanner. No exploitation in the wild or patch details are mentioned in the listing.
CISA added CVE-2026-86218, a CVSS 10.0 unauthenticated RCE in N-able N-central RMM, to its KEV catalog; on-premises admins must patch to 2026.3.1.14.
CISA added CVE-2026-86218, a CVSS 10.0 static code injection (CWE-96) enabling unauthenticated RCE in N-able N-central, to the Known Exploited Vulnerabilities catalog on September 8, 2026. The flaw affects all on-premises builds before 2026.3.1.14 across the 2025.4 through 2026.3 release lines; N-able shipped Hotfix 4 for 2026.3 on September 5-6, 2026. Huntress research indicates at least one customer's N-central instance was compromised on September 4, and federal civilian agencies must mitigate by September 11 under BOD 26-04. Hosted environments were patched server-side, but a compromised RMM server can serve as a single point of entry into entire MSP client bases.
Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.
CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.
N-able shipped an emergency hotfix for CVE-2026-86218, a pre-auth RCE zero-day in N-central RMM observed exploited in the wild.
N-able released Hotfix 4 for N-central 2026.3 on September 5 (build 2026.3.1.14), fixing CVE-2026-86218, a critical pre-authenticated remote code execution flaw in its RMM platform popular with MSPs. A private customer notice marked urgent said the zero-day 'has been observed being exploited in the wild,' while the public advisory said there were no confirmed production exploits. Huntress also flagged two high-severity vulnerabilities, CVE-2026-86206 and CVE-2026-86207, which allow authentication bypass and unrestricted access; they were patched the same weekend and were discovered by Rapid7's Stephen Fewer. N-able advised auditing N-central user accounts for unexpected users.
CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth RCE in N-able N-central, to KEV after N-able confirmed in-the-wild exploitation; patch by September 11.
CISA added CVE-2026-86218, a maximum-severity static code injection flaw enabling pre-authentication remote code execution in N-able N-central, to its Known Exploited Vulnerabilities catalog with a September 11, 2026 deadline for federal agencies. The flaw is fixed in N-central 2026.3 Hotfix 4 (released September 5), and N-able told customers it has been observed being exploited in the wild. Separately, Huntress is investigating the compromise of a fully patched customer N-central environment on September 4 and cannot yet confirm which flaw was used, while Rapid7-disclosed CVE-2026-86206 and CVE-2026-86207 can be chained by an unauthenticated attacker to create a rogue System Administrator account.
Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.
Joomla disclosed a response header injection flaw (CVE-2026-71572) in multiple download views, caused by lack of output processing, enabling reflected file download and content-type confusion. It is rated low impact, severity, and probability and affects Joomla CMS 3.0.0-5.4.7 and 6.0.0-6.1.2. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.
N-able patches critical unauthenticated RCE zero-day CVE-2026-86218 in N-central, exploited in the wild; on-premises admins must apply hotfix 2026.3 HF4.
N-able released an urgent hotfix (2026.3 HF4) for CVE-2026-86218 (CVSS 10), an unauthenticated RCE in N-central exploited as a zero-day. Scanning/exploitation attempts observed from IP range 23.234.64.0/18 starting September 4; admins should check logs for scanning and unrecognized new accounts. The hotfix supersedes patches for CVE-2026-86206 and CVE-2026-86207, which Huntress observed potentially chained in the wild to bypass authentication in production environments.
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.
Apache Syncope's Neo4j persistence layer permits Cypher injection via certain FIQL search expressions, affecting versions through 3.0.16, 4.0.7, and 4.1.2.
CVE-2026-86460 is a moderate-severity Cypher injection in Apache Syncope's syncope-core-persistence-neo4j module, triggered when processing some FIQL search strings. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation is reported; upgrade to fixed releases is advised.
Apache Syncope allows privilege escalation for an admin user via misconfigured internal JWT JWKS authentication settings, versions through 4.1.2.
CVE-2026-78330 is a moderate-severity incorrect privilege assignment vulnerability in Apache Syncope's syncope-core-spring module. When the configured JWKS settings for internal JWT authentication are misconfigured, an admin user can escalate privileges. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
N-able says CVE-2026-86218 in N-central is exploited in the wild; MSPs must apply hotfix 2026.3.1.14 (2026.3 HF4).
Canadian Centre for Cyber Security advisory AV26-885 covers CVE-2026-86218 in N-able N-central, which the vendor confirms is being exploited in the wild. Versions prior to 2026.3.1.14 are affected, and the fix ships as N-central 2026.3 Hotfix 4. The Cyber Centre urges users and administrators to apply the update promptly.
CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.
N-able disclosed CVE-2026-86218 on September 6, a pre-authentication remote code execution flaw with CVSS 10.0 in its N-central RMM platform, and both N-able and Huntress report it is being exploited in the wild. It follows Huntress's disclosure of an exploit chain combining CVE-2026-86206 and CVE-2026-86207 that bypasses access controls to create unauthorized administrative accounts, investigated after a September 4 compromise of a fully patched customer environment. N-able has applied mitigations to all hosted N-central instances; on-premises customers must upgrade to Hotfix 4 (build 2026.3.1.14) immediately.
Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.
Apache Syncope disclosed CVE-2026-73178, an Exposure of Sensitive Information to an Unauthorized Actor vulnerability rated important that allows JWT access token takeover. Affected versions include syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.
CISA added actively exploited CVE-2026-82329 in JFrog Artifactory to its KEV catalog; administrators of affected versions should patch.
Canada's Cyber Centre (advisory AV26-867, Update 1) relays a JFrog security advisory covering Artifactory, where open-source reporting indicates CVE-2026-82329 is being exploited in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, 2026. Multiple Artifactory release lines prior to fixed versions (e.g., prior to 7.111.21 through 7.161.20) are affected; users and administrators are urged to apply available updates.
Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.
Apache Syncope disclosed CVE-2026-73191, a moderate-rated open redirect vulnerability in the Syncope SRA. When the SRA is configured for CAS authentication, the target Apereo CAS service URL can be manipulated through Forwarded HTTP headers, redirecting users to an untrusted site. The flaw affects syncope-sra in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed releases.
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
SonicWall disclosed and patched two zero-days in SMA 1000 appliances: CVE-2026-83548, a maximum-severity pre-authentication SSRF, and CVE-2026-83549, a high-severity OS command injection. Rapid7 said chaining the flaws yields unauthenticated remote code execution, and CISA added both to its KEV catalog Wednesday. The vendor provided no IOCs or victim counts, urging customers to hunt for compromise, reimage or redeploy appliances, and reset all passwords and tokens. The product has faced repeated exploitation, including ransomware-linked flaws used by INC and Akira.
N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.
N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.
Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).
CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.
Zero Day Initiative discloses CVE-2026-20215, an integer overflow in ClamAV's 7z archive parsing enabling remote code execution, rated CVSS 8.4.
The Zero Day Initiative published ZDI-26-583 for an integer overflow in Clam AntiVirus's 7z archive parsing. A remote attacker can execute arbitrary code when the antivirus processes a crafted archive, with attack vectors varying by implementation. The flaw is tracked as CVE-2026-20215 and rated CVSS 8.4. The advisory does not mention active exploitation.
NVIDIA Megatron Bridge load_model_config code injection flaw (CVE-2026-24251, CVSS 7.8) enables remote arbitrary code execution on affected installs.
ZDI-26-594 describes a code injection vulnerability in NVIDIA Megatron Bridge's load_model_config function, tracked as CVE-2026-24251 with CVSS 7.8. Exploitation allows remote attackers to execute arbitrary code on affected installations and requires user interaction. The advisory was published by the Zero Day Initiative on August 24, 2026.
Opinion piece urges migrating 35KB preprompts from Anthropic/OpenAI to self-hosted Ollama, citing session privacy risks and safety filters blocking security research.
The author documents gotchas migrating 35KB preprompts from Claude Opus to self-hosted Ollama, motivated by fears that frontier providers train on user sessions, citing the OpenAI Navier-Stokes controversy. The piece argues inference providers cannot audit their own retention or training pipelines and that only self-hosted hardware offers verifiable privacy. It also criticizes frontier safety filters for refusing vulnerability research tasks and calls for models that support exploitability testing in CI/CD pipelines.
Joomla fixed CVE-2026-73372, an improper ACL check that leaks inaccessible contact items' data into schema.org snippets, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260809 describes CVE-2026-73372, an incorrect access control issue when injecting schema.org contact data. Improper access checks inject contact information for inaccessible contact items into schema.org snippets, exposing restricted data. Affected versions are 5.1.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Stefan Wendhausen on 2026-07-31.
Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76461 enabling unauthenticated root command execution; CISA adds it to KEV.
Cisco disclosed that a critical zero-day (CVE-2026-76461) in the email parsing logic of AsyncOS for Secure Email Gateway is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary SQL statements that lead to root-level command execution on virtual and physical appliances. CISA added the flaw to its KEV catalog and ordered federal agencies to patch within three days, by September 17. Cisco also patched four other critical SEG/SEWM vulnerabilities (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443) with no evidence of exploitation, and shared IOCs including suspicious SQL statements in mail_logs.
N-able shipped Hotfix 4 for a CVSS 10.0 unauthenticated RCE (CVE-2026-86218) in N-central RMM, with conflicting statements on exploitation.
N-able released 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a static code injection weakness (CWE-96) scored 10.0 on CVSS 4.0 that enables pre-authentication remote code execution on on-premises N-central RMM servers. Hosted NCOD instances are already patched; N-able's incident notice says the flaw was observed exploited in the wild while its release notes say exploitation is unconfirmed. Huntress, which has tracked N-central attacks since August, advises IP allowlisting, VPN-only access, or taking internet-reachable servers offline until patching. It is the fourth hotfix in five weeks, following fixes for CVE-2026-86206 and CVE-2026-86207, which CISA added to its Known Exploited Vulnerabilities catalog.
Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.
Francesco Chicchiriccò posted a low-severity advisory for CVE-2026-77181, an Incorrect Authorization vulnerability in Apache Syncope's syncope-core-am-logic module. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. An administrator holding the ClientApp update entitlement finds it is not applied as expected. No exploitation is reported and the issue is rated low severity.
Security Affairs general newsletter Round 591 aggregates recent security news; the provided page text contains only cookie-consent boilerplate.
This general Security Affairs newsletter (Round 591 by Pierluigi Paganini, international edition) aggregates recent cybersecurity news. The provided page text contains only cookie-consent language, so the specific covered stories are unknown.
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
An ongoing campaign exploits chained zero-days CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in internet-facing PaperCut NG and MF Application Servers, enabling authentication bypass and arbitrary Java bytecode execution. Post-compromise activity includes user and domain enumeration, payload download from sendit.sh, and silent installation of SimpleHelp and AnyDesk for redundant remote access; Defused observed CVE-2026-81578/CVE-2026-82078 exploit activity in honeypots since August 29, including data theft via Derby database dumps. Emergency patches were released August 28 and August 30, but 47% of roughly 2,500 PaperCut installs tracked by Huntress run v23 or older, for which no patch is available.
N-able ships an emergency hotfix for a maximum-severity RCE flaw in its N-central RMM platform that attackers are actively exploiting.
N-able has released an emergency hotfix for a maximum-severity remote code execution vulnerability affecting its N-central remote monitoring and management (RMM) platform. The company urges customers to apply the fix immediately because attacks against N-central instances are ongoing. N-central is widely used by managed service providers, so a compromise of one deployment can expose many downstream customer environments.
An 8.9B-parameter latent-space language model using next-concept prediction matches OLMo-3-7B pretraining loss with only 51.3% of the training tokens.
NCP-ArchPreview augments next-token prediction with Next Concept Prediction over a product-quantized concept vocabulary built from hidden states, trained jointly end-to-end. The 8.9B model was trained on 5.73T tokens from the Dolma-3 dataset, the largest latent-space language model demonstration to date. It consumes 51.3% of the tokens to reach OLMo-3-7B's final pretraining loss and outperforms it by 2.45 points on the downstream macro-average, including a 5.99-point GSM8K gain. The learned latent space also enables lightweight domain adaptation via a 17M-parameter VQ module and improves speculative drafting accepted length by 4.17%.