60
60
Russian Hackers Exploit Safari and Chrome Flaws in High
60
60
60
60
60
60
60
60
60
60
60
60
57
60
60
60
60
60
60
50
60
45
60
60
60
60
Apache Superset SQL Injection Flaw Gets Public PoC Exploit
A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.
A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.
52
60
Network Security Trends: November 2021 to January 2022
60
[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
Public exploit released for CVE-2026-80428, unauthenticated PHP object injection via Shibboleth in ILIAS LMS, enabling remote code execution.
Exploit-DB entry 52682 publishes a proof-of-concept for CVE-2026-80428, an unauthenticated PHP object injection flaw in the ILIAS learning management system. The vulnerability is reachable through the Shibboleth authentication integration and can result in remote code execution. Affected versions are ILIAS below 9.22, 10.x below 10.10, and 11.x below 11.3. No evidence of in-the-wild exploitation is stated in the disclosure.
48
60
60
WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...
Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.
CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.
92
60
60
60
60
60