ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “VulnCheck”

3 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 3Industry 1
SeverityAllcritical 2high 1medium 1low 0info 0

Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild

Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.

CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.

Cyber Security Newsupdated · 10h agofirst · 13h agoExploit / PoC in the wild 2 sourcesCVE-2026-890261

Cisco warns customers of actively exploited zero-day in email gateways

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 allows unauthenticated root command execution; CISA added it to KEV.

Cisco disclosed CVE-2026-76461, a zero-day in AsyncOS for Cisco Secure Email Gateway that was exploited before disclosure and lets unauthenticated remote attackers execute commands with root privileges on cloud and on-premises instances. CISA promptly added the flaw to its Known Exploited Vulnerabilities catalog, and Cisco has directly contacted cloud customers with indicators of compromise while deploying mitigations. Rapid7 and VulnCheck warn compromised gateways could enable silent email monitoring and internal pivoting from on-premises deployments.

CyberScoopupdated · 12h agofirst · 1d agoExploit / PoC in the wild 17 sourcesCVE-2026-76461

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek · 5d agoIndustry in the wildCVE-2026-148942