Search: “http proxy”

9 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 18 Exploit / PoC 16 Vulnerability 9 AI safety & security 6 Threat actor 3 Advisory 2 Research 2 Policy & legal 1 Tools 1 Phishing & fraud 1

SeverityAll critical 8 high 22 medium 23 low 2 info 4

ZDI-26-708: (0Day) Microsoft Windows HTTP Proxy Privilege Escalation Vulnerability

ZDI disclosed an unpatched local privilege escalation flaw (CVSS 5.3) in Microsoft Windows HTTP Proxy, requiring prior low-privileged code execution.

ZDI-26-708 details a privilege escalation vulnerability in the Microsoft Windows HTTP Proxy component. A local attacker who can already execute low-privileged code on the target system can escalate privileges. ZDI assigned a CVSS rating of 5.3 and published it as a 0day advisory; no CVE id is listed in the bulletin text.

ZDI Published AdvisoriesSep 16, 05:00 UTC · 19h agoVulnerability

Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...

CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.

CVE-2026-60004 is a CWE-94 code injection flaw in Gitea's POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, disclosed July 28, 2026 with a CVSS v3.1 score of 9.8 and credited to researcher Shai Rod (NightRang3r). An add/add collision with the three-way merge fallback (--3, Git 2.32+) writes attacker-controlled content into the temporary bare clone's hooks directory, where it executes as a live Git hook running commands as the Gitea OS user. Exploitation requires repository write access, but Gitea's default open registration allows anonymous users to obtain it, exposing app.ini secrets, database credentials, OAuth tokens, and mounted repositories; a public PoC requires no outbound callback. All releases from 1.17 through 1.27.0 are affected; the fix shipped in Gitea 1.27.1 on July 27, 2026, and Gitea Cloud instances were upgraded automatically.

Web discovery (articles for new exploits & KEV entries)Sep 8, 09:18 UTC · 8d agoVulnerability CVE-2026-600041

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded FutureSep 8, 00:00 UTC · 9d agoVulnerability in the wildCVE-2025-62593 CVE-2026-72898 CVE-2026-9198+4 CVEs1

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 BlogSep 8, 11:01 UTC · 8d agoVulnerability CVE-2026-86206 CVE-2026-86207 CVE-2026-18577

SAP warns of maximum severity 'OVERPASS' kernel vulnerability

SAP's September 2026 patches fix maximum-severity kernel flaw CVE-2026-44756 (OVERPASS), letting unauthenticated attackers execute commands on 10,000+ internet-facing SAP systems.

SAP's September 2026 Patch Tuesday addresses 20 vulnerabilities, headlined by CVE-2026-44756, a buffer overflow in the Extended Passport Protocol (EPP) library of the SAP Kernel dubbed OVERPASS by Onapsis researchers. Unauthenticated attackers can gain administrative command execution via SAP Internet Communication Manager; Onapsis counted more than 10,000 internet-facing SAP systems. SAP also fixed CVE-2026-58240 (S4GET), a critical missing-authentication flaw in the NetWeaver Message Server enabling unauthenticated remote code execution as <sid>adm. Since November 2021, CISA has added 14 SAP flaws to its actively exploited list, three abused by ransomware gangs.

BleepingComputerSep 8, 14:55 UTC · 8d agoVulnerability 2 sources CVE-2026-44756 CVE-2026-58240 CVE-2026-58231

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.

CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.

The Hacker NewsAug 26, 11:55 UTC · 21d agoVulnerability CVE-2026-19913 CVE-2026-199121

Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information

Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.

Fortinet disclosed CVE-2026-26084 (advisory FG-IR-26-166), a CWE-284 improper access control flaw in the GUI of FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS, rated 8.9 CVSS v3.1. An unauthenticated remote attacker can send specially crafted HTTP requests to control NAT rules and expose sensitive information. Affected versions include FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 (plus Cloud/PaaS 5.0.4-5.0.5), fixed in 4.4.9 and 5.0.6. Fortinet researcher Adham El Karn found the flaw internally and the September 8 advisory reports no known exploitation.

GBHackersSep 9, 07:15 UTC · 7d agoVulnerability CVE-2026-26084

CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.

Web discovery (articles for new exploits & KEV entries)Sep 7, 19:42 UTC · 9d agoVulnerability 3 sources CVE-2026-505221

Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root

Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.

Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.

GBHackersSep 9, 12:28 UTC · 7d agoVulnerability1