60
February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
60
November 2025 CVE Landscape: 10 Critical Vulnerabilities Show 69% Drop from October
60
60
[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)
0day Rubbish discloses a CVSS 8.8 shell command injection in core-admin 1.0.164 via ineffective quote escaping, enabling authenticated remote code execution.
0day Rubbish Research Team publicly disclosed a systemic shell command injection (CWE-78) in core-admin 1.0.164 (build 16468). The flaw stems from ineffective quote escaping and scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The disclosure does not mention a CVE identifier or observed exploitation in the wild.
38
[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)
OP5 Monitor 9.20 remains vulnerable to CVSS 8.8 command injection because the CVE-2025-34115 fix is opt-in and ineffective.
0day Rubbish Research Team disclosed a command injection (CWE-78) in OP5 Monitor 9.20 that survives the existing CVE-2025-34115 patch, which is opt-in and described as ineffective. The issue scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Administrators who previously applied the vendor fix may still be exposed.
45
**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)
Tozed ZLT X300 5G CPE firmware 6.01.3 has an unauthenticated TR-069 command injection (CVE-2026-2035703, CVSS 9.8) enabling root code execution.
Tozed ZLT X300 5G CPE router firmware 6.01.3 contains an OS command injection (CWE-78) in the TR-069/CWMP client daemon netcwmpd, tracked as CVE-2026-2035703 with CVSS 9.8. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, and the resulting shell command executes via system_by_root() as root. An attacker operating a rogue LTE base station built from roughly $300 of SDR hardware can impersonate the carrier's Auto Configuration Server and inject arbitrary commands. The disclosure does not report any observed exploitation.
50
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.
78
July 2026 CVE Landscape
60
60
60
June 2026 CVE Landscape
60
Fortinet Warned as Three Critical FortiSandbox Bugs Come Under Attack
60
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
60
60
60
60
60
December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
60
October 2025 CVE Landscape
60
60
60
60
60
60
September 2025 CVE Landscape
60
60
60
Vulnerability landscape analysis for Q4 2024
60
55
60
60
60
Adobe Patch Tuesday fixed critical vulnerabilities in Magento, Acrobat and Reader
60
60
CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog
60
60
60
60
60