Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
A proof-of-concept exploit for a blind SQL injection vulnerability in Payload CMS 3.72.0 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a blind SQL injection flaw in Payload CMS 3.72.0. The listing falls under the webapps category and allows reproduction of the injection. No in-the-wild exploitation or CVE identifier is stated in the listing.
CVE-2026-52307: authenticated stored XSS in 1CMS (ClassCMS) v5.6 Column Management lets attackers inject scripts via the title field.
ClassCMS 1CMS v5.6 contains an authenticated stored cross-site scripting vulnerability, CVE-2026-52307, in the Column Management component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field. No CVSS score, patch information, or exploitation evidence was provided in the disclosure.
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.
A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.
Exploit-DB published a webapps entry for a stored XSS flaw in Bludit CMS, an open-source flat-file content management system. Stored XSS allows an attacker to persist malicious scripts that execute in other users' browsers, potentially enabling session theft or unauthorized actions. The listing did not include a CVE identifier or affected version range.
NASA/JPL's AIT-GUI web console (CVSS 9.4) lacked authentication and CSRF protection, letting anyone send unauthenticated commands to spacecraft instruments; fixed in 2.5.2.
Cycode researchers found that AIT-GUI, the browser console of NASA/JPL's open-source AMMOS Instrument Toolkit, ran an HTTP server with no authentication, no session checks, and no CSRF protection on state-changing endpoints, allowing arbitrary commands to spacecraft instruments. The issue combines four weaknesses: binding to 0.0.0.0 regardless of configured host, missing authentication, missing CSRF defense, and path traversal in the /seq and /script/run endpoints. Tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, it is fixed in AIT-GUI 2.5.2. The findings came from AI-assisted code analysis confirmed with working proofs-of-concept, including a headless-browser CSRF demonstration.
A public proof-of-concept demonstrates remote code execution in Ghost CMS 6.19.0, the widely deployed open-source publishing platform.
Exploit-DB lists a remote code execution proof of concept affecting Ghost CMS version 6.19.0. Ghost is a popular open-source platform used by publishers and blogs worldwide. The listing does not cite a CVE id or report in-the-wild exploitation.
Recorded Future whitepaper warns nation-state cyber operations targeting satellites, ground stations and space supply chains will intensify during 'Space Race 2.0'.
Recorded Future's whitepaper argues that cyber operations will be decisive in the second space race, with espionage, destructive attacks, supply chain compromise and signal hijacking already affecting orbital assets and ground infrastructure. It predicts nation-states will extend cyber targeting toward deep-space ambitions such as lunar colonization and asteroid mining. The paper references the SPARTA adversarial framework and forums like Defence Space 24, and highlights US Space Command's integration of cyber and intelligence into space operations.
Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.
The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.
Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.
Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.
O-CMS 1.0.0 has an authenticated OS command injection in the ai_cli_script parameter, letting privileged attackers execute arbitrary commands.
O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in its AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and extra commands through the ai_cli_script parameter of /admin/settings/save. The attacker-controlled CLI value is then executed when the configured AI provider is tested via /admin/settings/test-ai.
A proof-of-concept exploit for remote code execution in Wolf CMS 0.8.3.1 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a remote code execution vulnerability in Wolf CMS 0.8.3.1. The listing is categorized under web applications. No exploitation in the wild or CVE identifier is stated in the listing.
Rapid7's weekly Metasploit roundup highlights newly added exploit modules, payloads, and scanners in the Metasploit Framework.
Rapid7 published its weekly Metasploit Wrap Up summarizing community contributions to the Metasploit Framework, including new exploit modules, payloads, and scanners. No article text was available; the post serves as a routine digest for practitioners tracking newly packaged modules.
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.
A proof-of-concept exploit for remote code execution in Grav CMS 2.0.7 has been published on Exploit-DB.
Exploit-DB lists a public proof-of-concept exploit for a remote code execution vulnerability in Grav CMS 2.0.7. The listing is for web applications and provides code defenders can use to reproduce the issue. No exploitation in the wild or CVE assignment is stated in the listing.
CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.
CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.
A reflected cross-site scripting flaw in Bludit CMS 3.20.0 is documented with a public proof-of-concept exploit on Exploit-DB.
Exploit-DB published exploit ID 52678 targeting Bludit CMS 3.20.0, a web application affected by reflected cross-site scripting. The listing contains a proof-of-concept but includes no CVE identifier or evidence of active exploitation.
Researchers demonstrate the first timing solution computed from Galileo's new Signal Authentication Service, protecting receivers against GNSS spoofing.
Galileo's new Signal Authentication Service (SAS) on the E6-C signal directly authenticates ranging measurements, closing a gap left by OSNMA, which only protects navigation data. Researchers built a snapshot software receiver implementing a simplified SAS protocol and computed an authenticated receiver clock bias from recordings of both SAS-capable satellites, collected with a Septentrio SDR prototype. The results demonstrate feasible authenticated timing ahead of full SAS operational deployment.
A proof-of-concept cross-site scripting exploit for C-MOR video surveillance software 6.0104 appeared on Exploit-DB.
Exploit-DB published a proof-of-concept cross-site scripting (XSS) exploit against C-MOR 6.0104, an IP video surveillance platform. The listing demonstrates script injection in the web interface, but the provided text contains no CVE identifier or indication of active exploitation. Successful XSS against the surveillance console could enable session hijacking or manipulation of the monitoring interface.
Flextype CMS v1.0.0-alpha.3's stored fetch shortcode enables server-side request forgery via attacker-controlled entry fields passed to fetch().
Flextype CMS v1.0.0-alpha.3 automatically processes attacker-controlled entry fields through its shortcode parser when global shortcode processing is enabled. The built-in fetch shortcode passes attacker-controlled resources to the server-side fetch() helper without sufficient destination restrictions. This enables stored server-side request forgery initiated from saved entry content. The issue was disclosed on the Full Disclosure mailing list on September 3, 2026.
MicroHasTEE expresses TrustZone secure and non-secure firmware as one typed Haskell program, catching peripheral-ownership inconsistencies at compile time.
MicroHasTEE is a multiparty Haskell framework that models both TrustZone firmware images as participants in a single typed program, using type-level capability ledgers to track peripheral acquisition, configuration, transfer, and finalization. MicroHs compiles the shared program twice to produce separate bare-metal Secure and Non-secure firmware images. The framework rejects inconsistent resource use, post-configuration attribution changes, wrong-domain callbacks, and calls to unregistered Secure services. A door-lock case study on an STM32U5 Nucleo board produced images of 232.7 KiB and 228.4 KiB of flash with roughly 220 KiB of SRAM per domain.
CISA flags two flaws (CVE-2026-19471, CVE-2026-19472) in Rockwell Automation ArmorStart LT <=v2.001: stored XSS and web server denial-of-service.
Rockwell Automation reported two issues in the embedded web server of ArmorStart LT v2.001 and earlier. CVE-2026-19471 involves multiple stored cross-site scripting flaws (CVSS 7.3) where unsanitized input is stored server-side and executes in other users' browsers. CVE-2026-19472 is a denial-of-service issue (CVSS 7.5) triggered by a crafted HTTP PUT request that exhausts web server resources. No public exploitation has been reported to CISA.
Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.
Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.
QuantaStor 6.8.3.018 has a CVSS 8.8 command injection in its alert-mail command, exploitable via the smtpPassword field.
0day Rubbish Research Team disclosed a command injection (CWE-78) in QuantaStor 6.8.3.018's alert-mail command, reachable through the smtpPassword field. The flaw scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or evidence of active exploitation is mentioned in the disclosure.
0day Rubbish discloses a CVSS 8.8 shell command injection in core-admin 1.0.164 via ineffective quote escaping, enabling authenticated remote code execution.
0day Rubbish Research Team publicly disclosed a systemic shell command injection (CWE-78) in core-admin 1.0.164 (build 16468). The flaw stems from ineffective quote escaping and scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The disclosure does not mention a CVE identifier or observed exploitation in the wild.
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.
xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.
Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.
A stored cross-site scripting flaw in PodcastGenerator 3.2.9 is documented with a public proof-of-concept exploit on Exploit-DB.
Exploit-DB published exploit ID 52677 targeting PodcastGenerator 3.2.9, a web application affected by stored cross-site scripting. The listing provides a proof-of-concept for the flaw but includes no CVE identifier or reports of active exploitation.
Critical flaws in NASA's AIT-GUI ground control software let unauthenticated attackers send spacecraft commands and execute scripts.
NASA's AIT-GUI ground control software contains critical flaws that expose spacecraft command and script execution to unauthenticated attackers. Anyone able to reach the ground control interface could send unauthorized commands without valid credentials. The report does not indicate that the flaws have been exploited in the wild.
ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.
ExPatch researchers Denis and Aleksander Rostilov found a stored XSS flaw (CVSS 8.2) where bot inline keyboard button text was written unescaped into HTML chat exports, executing attacker JavaScript in browsers. The payload can persist in chat history for months, exfiltrate messages, metadata, and local file paths, and rewrite the page, spreading via forwarded messages without bot membership. Telegram fixed it by applying SerializeString(), first stable fixed release 7.0.1 shipped July 14, 2026, but HTML exports created with vulnerable versions remain dangerous.