60
GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.
A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.
80
60
May 2026 CVE Landscape
60
60
60
60
August 2018 Microsoft Patch Tuesday fixes two flaws exploited in attacks in the wild
60
60
60
60
Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day
Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.
Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.
93
60
60
60
60
Trend Micro fixes critical bugs in Apex Central and TMEE PolicyServer
60
Network Security Trends: August
60
Network Security Trends: November 2021 to January 2022
60
60
60
60
60
60
60
60
60
60
60
60
"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)
CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.
On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.
92
60
60
60
60
60
60
XE Hacker Group Exploits VeraCore Zero
60
60
U.S. CISA adds Ivanti CSA and Fortinet bugs to its Known Exploited Vulnerabilities catalog
60