Vulnerability Detections
CVE-mapped detections for known-exploited, weaponized, and proof-of-concept vulnerabilities. Each ships ready-to-deploy KQL & SPL detection logic. Filter by vendor, product, CVSS, CWE and exploitation status.
- CVE-2026-109619 KEV
CVE-2026-109619 — PHP Stale Internal Request-State (PHP2Shell) Exploitation
Detects exploitation attempts against CVE-2026-109619, a PHP use-after-free / stale internal request-state vulnerability (dubbed 'PHP2Shell') affecting PHP Group's PHP interpreter. The flaw stems from reuse of freed/uninitialized request-state objects (CWE-416, CWE-824, CWE-755, CWE-1325) that attackers coerce into arbitrary code execution by crafting requests that trigger improper reinitialization of per-request globals, frequently in FPM/mod_php worker reuse scenarios. CISA added this to the KEV catalog on 2026-10-26 following mass in-the-wild exploitation that drops webshells on PHP-fronted web applications. This detection surfaces anomalous php-fpm/php-cgi worker crashes and restarts, child-process spawning from PHP (php spawning sh/bash/cmd), webshell-style POST request patterns, and segfault telemetry correlated with web-request bursts.
vendor: PHP Group product: PHP cwe: CWE-416, CWE-755 disclosed: Oct 26, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-115889 Public PoC PoC
Wasmtime Cranelift Bit-Packing Silent Overflow Miscompilation (CVE-2026-115889)
Detects presence and execution of vulnerable Wasmtime runtime versions affected by CVE-2026-115889, a critical (CVSS 9.9) bit-packing defect in the Cranelift compiler that causes silent integer overflow (CWE-197) and type-confusion miscompilation (CWE-843). Affected versions are Wasmtime < 36.0.19 and >= 37.0.0, < 43.0.0. A maliciously crafted WebAssembly module can trigger miscompilation that violates Wasm sandboxing guarantees, enabling memory corruption and potential sandbox escape. A public PoC exists via GHSA-897f-g5gm-fmxm. This detection surfaces vulnerable binaries, crate dependencies, and runtime process behavior indicative of guest-triggered miscompilation (crashes, SIGSEGV/SIGILL in JIT-compiled regions, and unexpected host access from Wasm workloads).
vendor: rust product: wasmtime cwe: CWE-197, CWE-843 disclosed: Oct 23, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-77366 Public PoC PoC
obsidian-tc Token Cross-Vault Authorization Bypass (CVE-2026-77366)
Detects exploitation of CVE-2026-77366, an IDOR/broken-object-level-authorization flaw (CWE-639, CWE-863) in the npm package obsidian-tc prior to version 1.3.1. A valid token issued for one configured Obsidian vault can be reused to read or write any other vault configured on the same obsidian-tc server, because the authorization layer validates only that a token is valid and not that it is scoped to the requested vault. Exploitation appears as a single token/session accessing vault identifiers it was not provisioned for, often enumerating multiple vault paths in rapid succession. Upgrade obsidian-tc to >= 1.3.1 to remediate.
vendor: npm product: obsidian-tc cwe: CWE-639, CWE-863 disclosed: Oct 23, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-110447 KEV
Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447)
Detects exploitation of CVE-2026-110447, an OS command injection vulnerability (CWE-78) in the Collabora Online built-in CODE (Collabora Online Development Edition) server. Unauthenticated or low-privileged attackers can inject shell metacharacters into document-conversion or WOPI-handling parameters processed by the CODE server (coolwsd / loolwsd), causing arbitrary OS commands to execute with the privileges of the Collabora service account. This CVE is on the CISA KEV catalog (BOD 26-04), indicating confirmed in-the-wild exploitation. Detection focuses on shell metacharacters and command-injection patterns in HTTP requests to the CODE server, anomalous child-process spawning from the coolwsd/loolwsd/forkit process tree, and outbound connections or file writes originating from the conversion sandbox.
vendor: Collabora product: Collabora Online – Built-in CODE Server cwe: CWE-78 disclosed: Oct 23, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-114625 KEV
Arista VeloCloud Orchestrator SQL Injection (CVE-2026-114625)
Detects exploitation of CVE-2026-114625, a SQL injection vulnerability (CWE-89) in the Arista VeloCloud Orchestrator (VCO) web/API interface. This CISA KEV-listed flaw allows an attacker to inject arbitrary SQL through unsanitized parameters in VCO portal/API requests, enabling authentication bypass, extraction of orchestrator credentials and edge configuration, and potential full compromise of the SD-WAN control plane. Detection focuses on SQL injection signatures (UNION SELECT, boolean/time-based payloads, SQL metacharacters, error-based probes) in HTTP requests to VCO endpoints, anomalous database errors, and post-exploitation data access patterns.
vendor: Arista product: VeloCloud Orchestrator cwe: CWE-89 disclosed: Oct 23, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-109618 KEV PoC
PHP Memory Corruption Exploitation (CVE-2026-109618 / PHP2Shell)
Detects exploitation attempts against CVE-2026-109618, a memory corruption vulnerability in PHP (PHP Group) chained in the wild as 'PHP2Shell'. The flaw stems from use-after-free (CWE-416), improper handling of exceptional conditions (CWE-755), use of a pointer after release (CWE-824), and resource lifecycle issues (CWE-1325/CWE-1419) in the PHP runtime. Successful exploitation corrupts the Zend heap and yields remote code execution in the context of the PHP worker (php-fpm / Apache mod_php), typically surfacing as post-exploitation web-shell writes, unexpected worker crashes/segfaults, and outbound connections from PHP processes. CISA added this CVE to the KEV catalog on 2026-10-21 and an ExploitDB PoC (52704) is public. This detection correlates PHP interpreter crashes/segfaults, anomalous child process spawning from PHP workers, and web-shell indicators to flag active exploitation.
vendor: PHP Group product: PHP cwe: CWE-416, CWE-755 disclosed: Oct 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-106931 KEV
EG Secure Solutions SiteGuard Server Edition OS Command Injection (CVE-2026-106931)
Detects exploitation of CVE-2026-106931, an OS command injection vulnerability (CWE-78) in EG Secure Solutions SiteGuard Server Edition. SiteGuard is a web application firewall/server security product; the flaw allows an attacker to inject arbitrary operating system commands through unsanitized input processed by the server component, resulting in remote code execution under the context of the SiteGuard/web server process. This CVE is listed in the CISA KEV catalog (BOD 26-04) indicating active in-the-wild exploitation. This detection identifies command-injection payloads in requests to the SiteGuard management/server interface and suspicious child processes spawned by the SiteGuard or web server process.
vendor: EG Secure Solutions product: SiteGuard Server Edition cwe: CWE-78 disclosed: Oct 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-110936 KEV
Siemens Software Center Uncontrolled Search Path Element Exploitation (CVE-2026-110936)
Detects exploitation of CVE-2026-110936, an uncontrolled search path element (DLL search-order hijacking) vulnerability in Siemens Software Center. An attacker who can place a malicious DLL in a directory searched before the legitimate library path can achieve code execution in the context of the Software Center process. This CVE is on the CISA KEV catalog and has been observed in ClickFix social-engineering campaigns that trick users into placing or executing attacker-staged payloads. Detection focuses on Software Center loading unsigned or unexpected DLLs from writable/user-controlled directories, suspicious child processes spawned by Software Center binaries, and new DLL file writes into the Software Center install or working directories.
vendor: Siemens product: Software Center cwe: CWE-427 disclosed: Oct 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-96652 KEV
Plex Media Server SSRF Exploitation (CVE-2026-96652)
Detects exploitation of CVE-2026-96652, a Server-Side Request Forgery (SSRF, CWE-918) vulnerability in Plex Media Server v1.43.2 and earlier. An attacker who can reach the Plex web/API surface can coerce the server into issuing attacker-controlled outbound HTTP requests, enabling access to internal services, cloud instance metadata endpoints (e.g. 169.254.169.254), and localhost-bound admin interfaces. This CVE is listed in CISA KEV (BOD 26-04), indicating active in-the-wild exploitation. This detection surfaces anomalous server-initiated outbound connections from the Plex Media Server process to internal/metadata/loopback ranges and suspicious inbound API requests containing URL-like parameters, which are the hallmark of SSRF abuse.
vendor: Plex product: Media Server cwe: CWE-918 disclosed: Oct 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-96654 KEV
Plex Media Server Encoded URI Scheme Neutralization Vulnerability (CVE-2026-96654)
Detects exploitation and exposure of CVE-2026-96654, an improper neutralization of encoded URI schemes in a web page (CWE-84) affecting Plex Media Server v1.43.2 and earlier. An attacker can embed encoded URI schemes (e.g. percent-encoded or HTML-entity-encoded javascript:/data: scheme payloads) into content served by Plex Media Server's web UI, which are decoded and rendered in a victim's browser, enabling stored/reflected XSS and client-side script execution. This CVE is listed in the CISA KEV catalog. The detection surfaces vulnerable/unpatched Plex Media Server instances, suspicious requests containing encoded scheme payloads to Plex web endpoints, and anomalous child-process or outbound activity from the Plex Media Server process.
vendor: Plex product: Media Server cwe: CWE-84 disclosed: Oct 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-96655 KEV
Plex Media Server SSRF (CVE-2026-96655)
Detects exploitation of a Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server v1.43.2 and earlier (CVE-2026-96655, CWE-918, CISA KEV). The flaw lets an attacker coerce the Plex server to issue attacker-controlled outbound HTTP(S) requests, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and loopback-bound admin interfaces. Detection focuses on the Plex Media Server process making anomalous outbound connections to internal/metadata/loopback destinations and on inbound requests to SSRF-prone Plex endpoints (e.g., image transcoder/proxy, library metadata refresh, and resources endpoints that fetch remote URLs).
vendor: Plex product: Media Server cwe: CWE-918 disclosed: Oct 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-96656 KEV
Plex Media Server External Control of File Name or Path (CVE-2026-96656)
Detects exploitation attempts against CVE-2026-96656, an external control of file name or path vulnerability (CWE-73) in Plex Media Server v1.43.2 and earlier. An attacker can manipulate file name or path parameters supplied to Plex Media Server HTTP endpoints to cause the service to read, write, or reference arbitrary files outside intended directories, enabling information disclosure or arbitrary file operations. This CVE is listed in CISA KEV, indicating confirmed in-the-wild exploitation. The detection surfaces path-traversal sequences, suspicious file/path parameters, and anomalous file access by the Plex Media Server process across network and host telemetry.
vendor: Plex product: Media Server cwe: CWE-73 disclosed: Oct 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-111057 Public PoC PoC
Mercury Unauthenticated RCE via /api/terminals Access Control Bypass (CVE-2026-111057)
Detects exploitation of CVE-2026-111057, a CVSS 10.0 unauthenticated remote code execution vulnerability in mljar Mercury (pip package) versions >= 3.0.0 and <= 3.2.3. A flawed regular expression used for access control (CWE-185) allows attackers to bypass authentication (CWE-284) on the /api/terminals endpoint, which exposes an interactive terminal/WebSocket interface. Unauthenticated attackers can open a terminal session and execute arbitrary OS commands in the context of the Mercury server process. This detection looks for anomalous HTTP/WebSocket access to /api/terminals endpoints, terminal session establishment without preceding authentication, and child-process command execution spawned from the Mercury/python/gunicorn/uvicorn process tree. Fixed in v3.2.4 (commit 8c467129037ee9df269d543ac217ffd33b97bf3f).
vendor: pip product: mercury cwe: CWE-185, CWE-284 disclosed: Oct 19, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2025-61624 KEV
Fortinet Multiple Products Path Traversal (CVE-2025-61624)
Detects exploitation attempts against CVE-2025-61624, a path traversal (CWE-22) vulnerability affecting multiple Fortinet products (including FortiOS management surfaces). Attackers leverage directory traversal sequences in HTTP request paths/parameters to read sensitive files (e.g. configuration, credential stores, session data) or access resources outside the intended web root on exposed Fortinet appliances. This vulnerability is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on traversal patterns, encoded traversal sequences, and anomalous access to sensitive paths against Fortinet management interfaces.
vendor: Fortinet product: Multiple Products cwe: CWE-22 disclosed: Oct 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-102764 KEV
BeyondTrust Remote Support Authentication Bypass by Spoofing (CVE-2026-102764)
Detects exploitation of CVE-2026-102764, an authentication bypass by spoofing vulnerability (CWE-290) in BeyondTrust Remote Support. An unauthenticated remote attacker can spoof trusted identity/session attributes to bypass authentication and gain privileged access to the Remote Support appliance. Listed in CISA KEV and tied to China-linked threat-actor exploitation. Detection focuses on anomalous authentication successes, administrative session creation from untrusted sources, and spoofed session-origin indicators against BeyondTrust Remote Support appliances.
vendor: BeyondTrust product: Remote Support cwe: CWE-290 disclosed: Oct 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-94603 Public PoC PoC
Podman Sandbox Disabled via Malicious Image Annotation (CVE-2026-94603)
Detects exploitation of CVE-2026-94603, a critical (CVSS 10.0, CWE-693 Protection Mechanism Failure) vulnerability in Podman where a crafted container image annotation can instruct `podman run` to disable nearly all sandboxing controls. Affected versions: Podman >= 4.4.0 < 5.8.8 and >= 6.0.0 < 6.1.3. A malicious image can embed annotations (e.g. run.oci.* / seccomp / apparmor / selinux keys) that cause Podman to drop seccomp profiles, AppArmor/SELinux confinement, capability bounding sets, and namespace isolation at container launch — yielding an effectively unconfined, near-host-privileged container. Detection focuses on Podman invocations pulling or running externally-sourced images followed by container processes exhibiting unconfined security context (no seccomp, unconfined AppArmor/SELinux, full capability sets, host namespace access).
vendor: go product: github.com/containers/podman, go.podman.io/podman/v6 cwe: CWE-693 disclosed: Oct 15, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-77459 Public PoC PoC
Argo CD AppProject Restriction Bypass via PreDelete/PostDelete Resource Hooks (CVE-2026-77459)
Detects exploitation of CVE-2026-77459, an improper authorization flaw (CWE-863) in Argo CD where AppProject destination-namespace and resource-kind restrictions are not enforced for PreDelete and PostDelete resource hooks. A user with permission to manage an Application scoped to a restricted AppProject can embed a hook resource (e.g. a Job, Pod, or RBAC object annotated with argocd.argoproj.io/hook: PreDelete or PostDelete) targeting a namespace or resource kind outside the AppProject allow-list. When the Application or a resource is deleted, the argocd-application-controller applies the hook with its own cluster-wide service account, bypassing the project guardrails and enabling privilege escalation and cross-tenant resource creation. Affected: Argo CD v2.10.0-2.14.21, v3.0.0-3.3.14, v3.4.0-3.4.9, v3.5.0-3.5.3, and v3.6.0-rc1. This detection surfaces hook resources applied to out-of-project namespaces/kinds by the Argo CD application controller service account around Application delete operations.
vendor: go product: github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 cwe: CWE-863 disclosed: Oct 15, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-21589 KEV
CVE-2026-21589: Atlassian Arbitrary File Access Across Multiple Products
Detects exploitation of CVE-2026-21589, a CWE-552 arbitrary file access / path traversal vulnerability impacting multiple Atlassian products (Confluence, Jira, Bitbucket, Bamboo). An unauthenticated or low-privileged external party can request files and directories outside the intended web root, exposing sensitive configuration files, credentials, and secrets. The vulnerability is on the CISA KEV catalog (disclosed 2026-10-15) and is covered by CISA BOD 26-04. This detection surfaces anomalous HTTP requests containing traversal sequences, encoded path separators, and access to sensitive filesystem paths against Atlassian application endpoints, plus resulting filesystem access by the Atlassian service account.
vendor: Atlassian product: Multiple Products cwe: CWE-552 disclosed: Oct 15, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-0322 KEV
Palo Alto Networks PAN-OS Code Injection (CVE-2026-0322)
Detects exploitation attempts and post-exploitation activity associated with CVE-2026-0322, a code injection (CWE-94) vulnerability in Palo Alto Networks PAN-OS. The flaw is listed in the CISA KEV catalog and is being actively exploited in the wild for remote code execution against PAN-OS management and GlobalProtect interfaces. Detection focuses on anomalous requests to the PAN-OS management plane, injected command/code patterns in HTTP request bodies and URIs, and unexpected child processes or outbound connections spawned by PAN-OS web/management daemons.
vendor: Palo Alto Networks product: PAN-OS cwe: CWE-94 disclosed: Oct 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-105133 KEV
Ahsay AhsayCBS Improper Authentication Exploitation (CVE-2026-105133)
Detects exploitation attempts and successful improper-authentication bypass against Ahsay AhsayCBS backup servers (CVE-2026-105133, CWE-287). This KEV-listed flaw lets unauthenticated attackers bypass authentication to the AhsayCBS web management console (default TCP 443/80, admin paths under /cbs and /obs), gaining administrative access to backup infrastructure. Detection focuses on anomalous authentication successes without valid credential flows, access to privileged admin endpoints from external sources, and post-exploitation configuration changes to the backup server.
vendor: Ahsay product: AhsayCBS cwe: CWE-287 disclosed: Oct 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-105134 KEV
Ahsay AhsayCBS Command Injection (CVE-2026-105134)
Detects exploitation of CVE-2026-105134, a command injection vulnerability in Ahsay AhsayCBS (Cloud Backup Suite) backup server. The flaw (CWE-77/CWE-78) allows an attacker to inject OS commands through unsanitized input processed by AhsayCBS web/management components, resulting in arbitrary command execution in the context of the AhsayCBS service account. The vulnerability is listed in CISA KEV (known exploited) and is subject to CISA BOD 26-04 remediation prioritization. This detection surfaces anomalous child-process spawning from AhsayCBS/Java processes, suspicious web-access patterns to AhsayCBS management endpoints, and shell/command-interpreter execution originating from the backup server tier.
vendor: Ahsay product: AhsayCBS cwe: CWE-77, CWE-78 disclosed: Oct 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-76519 KEV
Cisco Secure Email Gateway Relative Path Traversal (CVE-2026-76519)
Detects exploitation of CVE-2026-76519, a relative path traversal (CWE-23) vulnerability in the Cisco Secure Email Gateway (ESA) Advanced File Analysis / web management framework. An attacker can craft HTTP requests containing relative path traversal sequences (e.g. ../, ..%2f, ..%5c) against the ESA management or quarantine web interface to read or write files outside the intended directory, potentially leading to disclosure of configuration/credential files or file write. This CVE is listed in CISA KEV (actively exploited) and is in scope for BOD 26-04 risk-based patching prioritization. Detection focuses on traversal patterns in URIs/headers directed at ESA web listeners, anomalous file access by the ESA web service account, and outbound responses returning sensitive file content.
vendor: Cisco product: Secure Email Gateway cwe: CWE-23 disclosed: Oct 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-104935 KEV
Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)
Detects exploitation of CVE-2026-104935, an authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure. An unauthenticated remote attacker can spoof trusted authentication context to bypass access controls and obtain authenticated sessions without valid credentials. This CVE is listed in the CISA KEV catalog, indicating confirmed in-the-wild exploitation. The detection focuses on anomalous authentication events on Ivanti Connect Secure gateways: successful logins without preceding credential/MFA challenge, session establishment from untrusted or spoofed source context, admin/privileged access immediately following gateway-facing HTTP requests to authentication endpoints, and web request patterns targeting known ICS authentication handlers. Correlates VPN/gateway web proxy logs with authentication and session telemetry.
vendor: Ivanti product: Connect Secure cwe: CWE-290 disclosed: Oct 13, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-96951 KEV
Microsoft Windows Command Injection (CVE-2026-96951)
Detects exploitation of CVE-2026-96951, a command injection vulnerability (CWE-77) in Microsoft Windows that is listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation allows an attacker to inject and execute arbitrary operating-system commands via improperly neutralized special elements passed to a Windows component. This detection surfaces suspicious child-process chains, shell invocations with injected command separators/metacharacters, and anomalous process lineage consistent with active exploitation on unpatched hosts.
vendor: Microsoft product: Windows cwe: CWE-77 disclosed: Oct 13, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-61445 Public PoC PoC
PraisonAI AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVE-2026-61445)
Detects exploitation of CVE-2026-61445, a critical (CVSS 9.9) arbitrary file write and OS command execution vulnerability in the PraisonAI Python package (praisonai <= 4.6.77). The AICoder tool-call surface allows LLM-driven tool invocations to write files outside the intended working directory (CWE-22 path traversal) and to execute arbitrary shell commands (CWE-78), leading to remote code execution on the host running the agent. This detection surfaces anomalous child-process spawns from the Python interpreter hosting PraisonAI, suspicious file writes to sensitive paths, and traversal sequences in tool-call arguments.
vendor: pip product: praisonai cwe: CWE-22, CWE-78 disclosed: Oct 8, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2021-3199 KEV
ONLYOFFICE Docs Server Path Traversal (CVE-2021-3199)
Detects exploitation of a path traversal vulnerability (CWE-22) in ONLYOFFICE Docs (Document Server). An attacker can supply crafted directory-traversal sequences (e.g. ../, encoded ..%2f, ..%5c) in document conversion or download requests handled by the DocumentServer web services, allowing read/write access to files outside the intended document storage directory. Listed in the CISA KEV catalog. This detection surfaces HTTP requests to ONLYOFFICE Docs endpoints containing traversal sequences and anomalous local file access by the DocumentServer service account.
vendor: ONLYOFFICE product: Docs cwe: CWE-22 disclosed: Oct 8, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2023-22894 KEV
Strapi Cleartext Storage of Sensitive Information (CVE-2023-22894)
Detects exploitation and exposure conditions related to CVE-2023-22894, a cleartext storage of sensitive information vulnerability (CWE-312) in Strapi headless CMS. Affected Strapi deployments store sensitive information such as database connection strings, API tokens, and private metadata in a form that can be retrieved by unauthorized actors through the admin/content API, log files, or exposed configuration. This KEV-listed vulnerability is actively exploited; detection focuses on unauthorized access to Strapi configuration/content-type endpoints, anomalous retrieval of sensitive fields, and reads of plaintext secrets from Strapi filesystem/log artifacts.
vendor: Strapi product: Strapi cwe: CWE-312 disclosed: Oct 8, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-105857 Public PoC PoC
Payload CMS Form Builder Plugin Remote Code Execution (CVE-2026-105857)
Detects exploitation of CVE-2026-105857, a CVSS 10.0 remote code execution vulnerability in the @payloadcms/plugin-form-builder npm package (CWE-94 Code Injection / CWE-1321 Prototype Pollution). Affected versions are < 3.90.0 and the 4.0.0 canary line >= 4.0.0-canary.0 and < 4.0.0-canary.34. The form-builder plugin evaluates attacker-influenced input when processing dynamic form submissions and conditional/calculated field logic, allowing an unauthenticated attacker to inject and execute arbitrary code or pollute the Object prototype to achieve RCE on the Node.js server hosting the Payload CMS application. A public PoC is available via GHSA-r488-j9vj-wx3q. These detections surface the HTTP exploitation attempts against form submission endpoints, prototype-pollution payload markers (__proto__, constructor, prototype), and post-exploitation child-process / reverse-shell behavior spawned from the Node.js process.
vendor: npm product: @payloadcms/plugin-form-builder cwe: CWE-94, CWE-1321 disclosed: Oct 7, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-106102 Public PoC PoC
Quasar Framework SSR Meta Tag XSS via getHead() (CVE-2026-106102)
Detects exploitation and presence of CVE-2026-106102, a critical (CVSS 10.0) stored/reflected cross-site scripting vulnerability in the Quasar Framework (npm package 'quasar' < 2.22.0). The flaw lives in the server-side rendering (SSR) meta-tag handling of getHead(), where meta tag content is interpolated into the HTML <head> without HTML entity escaping (CWE-79 / CWE-116). An attacker who can influence meta values (page title, description, og: tags, canonical URLs, etc.) sourced from user-controllable input can inject arbitrary markup — e.g. </title><script>...</script> or event-handler attributes — that executes in every visitor's browser during SSR hydration. A public PoC exists (GHSA-pq96-jpmf-w254). This detection surfaces injection attempts against SSR routes, anomalous script/event-handler markup reflected in rendered <head> content, and the presence of vulnerable quasar versions on hosts.
vendor: npm product: quasar cwe: CWE-79, CWE-116 disclosed: Oct 7, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-93605 Public PoC PoC
vm2 Sandbox Escape via child_process (CVE-2026-93605)
Detects exploitation of a critical sandbox escape in the npm package vm2 (<= 3.12.0). vm2 is a widely-used library for running untrusted JavaScript in a sandboxed Node.js context. Due to improper enforcement of the host-process isolation boundary (CWE-693 protection mechanism failure, CWE-913 improper control of dynamically-managed code resources), an attacker who can supply code to the sandbox can escape it and reach host primitives such as the Node.js 'child_process' module, achieving arbitrary command execution on the host. This detection surfaces runtime indicators of a successful escape: Node.js processes that load vm2 spawning unexpected child processes (shells, interpreters, reconnaissance binaries), and vulnerable vm2 versions present in the environment.
vendor: npm product: vm2 cwe: CWE-693, CWE-913 disclosed: Oct 7, 202610.0 criticalCVSS:3.1write-up soon - CVE-2026-105697 Public PoC PoC
Langflow MCP stdio Server OS Command Injection (RCE) — CVE-2026-105697
Detects exploitation of CVE-2026-105697, an OS command injection vulnerability (CWE-78) in Langflow's MCP (Model Context Protocol) stdio server configuration. Affected Langflow/langflow-base/lfx versions allow an attacker who can supply or modify an MCP stdio server configuration to specify an arbitrary command and arguments that Langflow spawns as a child process, resulting in remote code execution on the host running the Langflow server. CVSS 9.9 (critical). A public PoC exists (GHSA-w794-rj3p-xv45). Fixed in Langflow 1.10.3 (and langflow-base/lfx 0.10.3), which removes the ability to spawn an arbitrary command from MCP stdio server configuration — upgrade to the patched release to remediate. Detection focuses on the Langflow/uvicorn parent process spawning unexpected child processes (shells, interpreters, network tools) consistent with an attacker-controlled MCP stdio command, and on suspicious MCP server configuration changes via the Langflow API.
vendor: pip product: langflow, langflow-base… cwe: CWE-78 disclosed: Oct 7, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-10561 Public PoC PoC
Langflow PythonREPLComponent Unsandboxed Code Execution (CVE-2026-10561)
Detects exploitation of CVE-2026-10561, a critical (CVSS 9.9) remote code execution and privilege escalation vulnerability in Langflow versions prior to 1.10.1. The PythonREPLComponent executes user-supplied Python code without a sandbox, allowing any authenticated user to run arbitrary code with the privileges of the Langflow process. This detection looks for the Langflow server process (uvicorn/python running langflow) spawning unexpected child processes (shells, interpreters, reconnaissance binaries, reverse-shell patterns) and for suspicious API activity against the flow build/run endpoints that carry PythonREPLComponent payloads.
vendor: pip product: langflow cwe: CWE-94, CWE-95 disclosed: Oct 6, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-100721 Public PoC PoC
vm2 NodeVM Custom Resolver Path Boundary Bypass (CVE-2026-100721)
Detects exploitation and presence of CVE-2026-100721, a CVSS 10.0 authorization bypass (CWE-863) in the npm package vm2 at versions <= 3.12.1. When a NodeVM is configured with a custom module resolver, crafted require paths can bypass the configured external path boundaries, allowing sandboxed code to resolve and load modules outside the intended allowlist and escape the sandbox. This detection surfaces vulnerable vm2 installs, suspicious require() resolution patterns consistent with boundary bypass, and child-process/filesystem activity spawned from Node.js hosts running vm2.
vendor: npm product: vm2 cwe: CWE-863 disclosed: Oct 5, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92946 Public PoC PoC
vm2 NodeVM require.external Sandbox Escape to RCE (CVE-2026-92946)
Detects exploitation and presence of CVE-2026-92946, a critical (CVSS 10.0) sandbox-escape vulnerability in the vm2 JavaScript sandbox library (npm package 'vm2') at versions <= 3.11.6. When a NodeVM is configured with `require.external` enabled but without an explicit `require.root` allow-list, the sandbox fails to constrain module resolution (CWE-913: Improper Control of Dynamically-Managed Code Resources), permitting sandboxed scripts to require arbitrary host filesystem modules (e.g. 'child_process', 'fs') and achieve full remote code execution on the host. This detection surfaces vulnerable vm2 installs, suspicious child-process/filesystem activity spawned by Node.js processes hosting vm2, and PoC-style require patterns indicative of escape attempts.
vendor: npm product: vm2 cwe: CWE-913 disclosed: Oct 5, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92947 Public PoC PoC
vm2 Sandbox Escape via Shared Buffer Pool Host-Memory Disclosure (CVE-2026-92947)
Detects usage and exploitation of the vm2 npm package versions <= 3.11.6, which contain a critical sandbox escape (CVE-2026-92947, CVSS 10.0). Sandboxed guest code can read and write host-realm memory by abusing Node.js's shared internal Buffer allocation pool (Buffer.allocUnsafe / Buffer.poolSize), allowing cross-realm memory disclosure and tampering that defeats vm2's isolation (CWE-200, CWE-653, CWE-668). This detection surfaces vulnerable vm2 installs in running Node.js processes, package manifests, and lockfiles, and flags Node processes exhibiting buffer-pool-abuse telemetry consistent with the public PoC (GHSA-fcqc-726x-5wfc). Fixed in vm2 3.11.7.
vendor: npm product: vm2 cwe: CWE-200, CWE-653 disclosed: Oct 5, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92953 Public PoC PoC
vm2 TypedArray/ArrayBuffer Intrinsic Mutation Sandbox Escape (CVE-2026-92953)
Detects usage and exploitation risk of vm2 versions 3.11.0 through 3.11.7, which contain an incomplete fix for host-prototype pollution. The default VM allows sandboxed code to mutate host TypedArray and ArrayBuffer intrinsics, enabling prototype pollution that can lead to sandbox escape and arbitrary code execution on the host (CVSS 10.0). This detection surfaces vulnerable vm2 installs via package manifests and SCA telemetry, and identifies runtime behavior consistent with intrinsic mutation attempts within Node.js processes that embed vm2.
vendor: npm product: vm2 cwe: CWE-913, CWE-1321 disclosed: Oct 5, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-92955 Public PoC PoC
vm2 Sandbox Escape via NodeVM (CVE-2026-92955)
Detects exploitation and presence of CVE-2026-92955, a critical (CVSS 10.0) sandbox escape in the vm2 npm package (<= 3.11.7). vm2 is a widely-used library for running untrusted JavaScript in a NodeVM/VM sandbox. Due to improper restriction of operations within the bounds of a memory buffer / insufficient sandboxing logic (CWE-913) in the host-sandbox bridge and setup-node-sandbox code paths, an attacker able to execute JavaScript inside the sandbox can leak a reference to a host object (e.g. via the error/prototype bridge) and reach the host's `process`/`require`, achieving arbitrary code execution on the host with the privileges of the Node.js process. This detection surfaces the vulnerable package in build/runtime inventories and hunts for post-exploitation behavior: a Node.js process spawning unexpected child processes, outbound C2 from a sandbox host, and sandbox-escape payload signatures in application logs. Remediation: upgrade vm2 to 3.11.8+ (note the vm2 project is deprecated and recommends migration to isolated-vm).
vendor: npm product: vm2 cwe: CWE-913 disclosed: Oct 5, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92956 Public PoC PoC
vm2 Sandbox Escape via WebAssembly.compileStreaming Promise Species Bypass (CVE-2026-92956)
Detects exploitation and presence of CVE-2026-92956, a critical (CVSS 10.0) sandbox escape in the vm2 npm package (>= 3.10.1, <= 3.11.6). The flaw abuses WebAssembly.compileStreaming, which internally resolves a user-controllable Promise. By overriding the Promise's Symbol.species constructor, untrusted code running inside the vm2 sandbox obtains a reference to a host-realm Promise and uses it to reach the host's unproxied objects, escaping the sandbox and achieving arbitrary code execution on the Node.js host (CWE-693 Protection Mechanism Failure, CWE-913 Improper Control of Dynamically-Managed Code Resources). Because vm2 is widely embedded to execute third-party/untrusted JavaScript, this detection focuses on identifying vulnerable installed versions, suspicious sandbox-escape payload patterns, and post-escape child-process / filesystem / network activity spawned from a Node.js process hosting vm2. Fixed in vm2 3.11.7.
vendor: npm product: vm2 cwe: CWE-693, CWE-913 disclosed: Oct 5, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-88779 KEV
Citrix NetScaler Memory Buffer Restriction Exploitation (CVE-2026-88779)
Detects exploitation attempts against CVE-2026-88779, an improper restriction of operations within the bounds of a memory buffer (CWE-119) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw, reachable via SAML-related request processing on the appliance's authentication/VPN virtual servers, allows a remote attacker to trigger out-of-bounds memory operations leading to memory disclosure or remote code execution. CISA added this to the KEV catalog (BOD 26-04) after it was observed exploited in the wild as a zero-day. Detection focuses on anomalous NetScaler/Gateway access-log and web-proxy telemetry: malformed or oversized SAML POST bodies to authentication endpoints, abnormal response sizes indicating memory leakage, appliance process crashes/restarts, and post-exploitation shell or file-write activity on the NSPPE/management plane.
vendor: Citrix product: NetScaler cwe: CWE-119 disclosed: Oct 4, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-73802 Public PoC PoC
Gitea Runner Privilege Escalation via container.options Host Namespace/Capability Injection (CVE-2026-73802)
Detects exploitation of CVE-2026-73802, a CWE-269 improper privilege management flaw in gitea.com/gitea/runner (Act Runner) versions prior to 1.0.9-0.20260731160927-34bfa1915022 / v3.0.0. When privileged mode is disabled in the runner configuration, the runner still forwards attacker-controlled values from the workflow's `container.options` field (e.g. `--privileged`, `--cap-add`, `--pid=host`, `--network=host`, `--userns=host`, `--device`, volume mounts) directly to the Docker/container backend. A user who can push a workflow to a repository served by a vulnerable self-hosted runner can therefore break the intended sandbox, obtain host namespaces and elevated Linux capabilities, mount the host filesystem or Docker socket, and escalate to full host compromise (CVSS 9.9). This detection surfaces runner job containers created with host namespaces, added capabilities, privileged flags, or sensitive host mounts, and correlates them with workflow/pipeline execution context.
vendor: go product: gitea.com/gitea/runner cwe: CWE-269 disclosed: Oct 2, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-102489 KEV
Zammad Session Fixation Exploitation (CVE-2026-102489)
Detects exploitation attempts against CVE-2026-102489, a session fixation vulnerability (CWE-384) in Zammad (Zammad GmbH). An attacker can set or predict a victim's session identifier prior to authentication, and because Zammad fails to rotate the session token on successful login, the attacker-controlled session becomes authenticated once the victim logs in. This detection surfaces anomalous session-cookie behavior: session IDs supplied by the client that pre-date authentication, absence of session rotation across the login boundary, and reuse of a single session identifier across multiple distinct source IPs or user agents. CVE-2026-102489 is listed in the CISA KEV catalog (BOD 26-04) and is being actively exploited in the wild alongside the related CVE-2026-102490 local privilege escalation.
vendor: Zammad GmbH product: Zammad cwe: CWE-384 disclosed: Oct 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-102490 KEV
Zammad Improper Privilege Management Local Privilege Escalation (CVE-2026-102490)
Detects exploitation and exposure of CVE-2026-102490, an actively-exploited (CISA KEV) improper privilege management (CWE-269) vulnerability in Zammad GmbH's Zammad help desk / ticketing platform. The flaw allows a lower-privileged local or authenticated actor to escalate privileges within the Zammad application context, obtaining agent or admin-level capabilities they were not granted. This detection surfaces vulnerable Zammad deployments, anomalous privilege/role changes in Zammad audit logs, and local escalation artifacts on hosts running the Zammad service (typically Ruby/Rails under a dedicated 'zammad' service account backed by Elasticsearch and PostgreSQL).
vendor: Zammad GmbH product: Zammad cwe: CWE-269 disclosed: Oct 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-69085 Public PoC PoC
SiYuan Unauthenticated SQL Injection in searchDocs (CVE-2026-69085)
Detects exploitation of CVE-2026-69085, an unauthenticated SQL injection in SiYuan's kernel searchDocs endpoint (/api/filetree/searchDocs) reachable in publish mode. The keyword parameter is interpolated into a SQL statement without escaping, allowing statement stacking against the embedded SQLite database for cross-notebook read and write. CVSS 10.0 (CWE-89), public PoC. Detection focuses on HTTP requests to the searchDocs API carrying SQL injection and statement-stacking payloads in the keyword field, and on anomalous database writes from the SiYuan kernel.
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-89 disclosed: Oct 1, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92937 Public PoC PoC
vm2 3.11.6 Sandbox Escape to Host RCE via call/apply Indirection (CVE-2026-92937)
Detects exploitation and presence of CVE-2026-92937, a critical (CVSS 10.0) sandbox escape in the vm2 JavaScript sandboxing library version 3.11.6. The vulnerability is a bypass of the prior GHSA-m283-3h24-438v fix: an attacker-controlled script running inside the vm2 sandbox can use Promise handler call/apply indirection to reach a host-side function reference, obtain the host Error constructor/prototype chain, and escape the sandbox to execute arbitrary code on the host with the privileges of the Node.js process (CWE-94 / CWE-693). A public PoC exists (GHSA-647f-g98j-qq25). This detection surfaces both vulnerable [email protected] installations and runtime indicators of sandbox escape such as unexpected child processes spawned by Node.js services that embed vm2.
vendor: npm product: vm2 cwe: CWE-94, CWE-693 disclosed: Oct 1, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-92940 Public PoC PoC
vm2 HTTPS Credential Exposure via globalAgent (CVE-2026-92940)
Detects presence and exploitation indicators of CVE-2026-92940, a CWE-668 (Exposure of Resource to Wrong Sphere) flaw in the npm package vm2 versions >= 3.11.3 through <= 3.11.6. In affected versions, sandboxed code running inside vm2 can reach the host's https.globalAgent, exposing host HTTPS client credentials (TLS client certificates, private keys, and in-flight TLS session material) to untrusted sandboxed scripts. The CVE carries a CVSS of 10.0 with a public proof-of-concept. This detection surfaces vulnerable vm2 installs via package manifests/lockfiles, Node.js processes loading the vulnerable module, and runtime behaviors consistent with sandbox-driven access to globalAgent and outbound TLS connections. Remediation is upgrade to vm2 >= 3.11.7.
vendor: npm product: vm2 cwe: CWE-668 disclosed: Oct 1, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92941 Public PoC PoC
CVE-2026-92941: vm2 NodeVM Host TLS Trust Store Replacement
Detects exploitation and presence of CVE-2026-92941, a CVSS 10.0 improper permission assignment (CWE-732) flaw in the vm2 npm sandbox library versions 3.11.3 through 3.11.6. Sandboxed (NodeVM) code can reach host-process internals and replace the Node.js TLS trust store (NODE_EXTRA_CA_CERTS / tls.rootCertificates / secureContext), causing the host to trust attacker-controlled CAs. This enables silent man-in-the-middle of all outbound TLS from the host process. Detection focuses on inventorying affected vm2 versions in deployed Node.js applications and spotting runtime indicators: unexpected modification of CA trust files, anomalous additions of custom CA certificates by Node processes, and sandbox escape telemetry (child process spawns, outbound connections to unexpected endpoints) from processes that load vm2.
vendor: npm product: vm2 cwe: CWE-732 disclosed: Oct 1, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-92938 Public PoC PoC
vm2 Sandbox Escape via node:sqlite Native Code Execution (CVE-2026-92938)
Detects exploitation and presence of CVE-2026-92938, a critical (CVSS 9.9) sandbox escape in the vm2 JavaScript sandbox library (npm) versions >= 3.11.3 and <= 3.11.6. The vulnerability (CWE-693, Protection Mechanism Failure) allows a sandboxed plugin to break out of the vm2 isolation boundary and execute native code by abusing the Node.js experimental `node:sqlite` built-in module, which was not accounted for in vm2's host-bridge protection logic. Exploitation yields full remote code execution on the host running the sandbox. This detection surfaces vulnerable package versions in deployed/built artifacts and behavioral indicators of a sandbox escape: Node processes loading node:sqlite in contexts associated with vm2, creation of SQLite database files by sandboxed workloads, and child-process/native-module activity spawned from a vm2 host process.
vendor: npm product: vm2 cwe: CWE-693 disclosed: Oct 1, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-92939 Public PoC PoC
vm2 Native Code Execution via crypto.setEngine Sandbox Escape (CVE-2026-92939)
Detects exploitation and presence of CVE-2026-92939, a critical (CVSS 9.9, CWE-114 Process Control) sandbox escape in the vm2 npm package versions >= 3.11.3 and <= 3.11.6. The vm2 crypto builtin proxy fails to restrict the native `crypto.setEngine()` call, allowing untrusted code executing inside the vm2 sandbox to load an attacker-controlled native engine shared object (.so/.dll). Loading the native module executes attacker code outside the JavaScript sandbox with full host privileges of the Node.js process, resulting in remote code execution. A public PoC is available via GHSA-46pr-c5wc-xffx. This detection surfaces runtime indicators of the escape (Node.js processes loading unexpected native modules via OpenSSL engine loading, child process spawns from Node runtimes hosting vm2, and anomalous dlopen of untrusted shared objects) as well as software-inventory evidence of vulnerable vm2 versions. Remediate by upgrading to vm2 >= 3.11.7 or migrating off vm2 (the project is deprecated).
vendor: npm product: vm2 cwe: CWE-114 disclosed: Oct 1, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-104286 KEV
Fortinet FortiMail Path Traversal Exploitation (CVE-2026-104286)
Detects exploitation attempts against CVE-2026-104286, a path traversal vulnerability (CWE-22 / CWE-158) in Fortinet FortiMail that is actively exploited in the wild (CISA KEV). Attackers leverage directory traversal sequences and improper handling of null/escape characters in HTTP requests to the FortiMail administrative and webmail interfaces to read arbitrary files, access configuration, or achieve code execution. This detection identifies traversal payloads (../, encoded variants, null-byte truncation) in requests to FortiMail management endpoints, anomalous file access, and post-exploitation indicators.
vendor: Fortinet product: FortiMail cwe: CWE-22, CWE-158 disclosed: Oct 1, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-76504 KEV
Cisco Catalyst SD-WAN Manager Authentication Bypass via Hex Encoding (CVE-2026-76504)
Detects exploitation attempts against CVE-2026-76504, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager (formerly vManage). The flaw (CWE-177, improper handling of hex/percent-encoded characters in URL request paths) allows a remote, unauthenticated attacker to bypass web authentication checks by submitting hex-encoded variants of protected administrative endpoints, gaining access to privileged management functions. Cisco disclosed the issue as an actively-exploited zero-day and it is listed in the CISA KEV catalog. This detection focuses on web/access log evidence of encoded-path requests to authentication-protected SD-WAN Manager endpoints, anomalous authenticated sessions originating from unauthenticated requests, and post-exploitation administrative activity.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-177 disclosed: Sep 30, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-86950 KEV
Apple CoreGraphics Out-of-Bounds Write (CVE-2026-86950) — Exploitation & Unpatched Endpoint Detection
Detects exploitation attempts and unpatched-endpoint exposure for CVE-2026-86950, a CWE-787 out-of-bounds write vulnerability affecting the CoreGraphics component across multiple Apple products (iOS, iPadOS, macOS). The flaw is listed in the CISA KEV catalog (BOD 26-04 in scope) and is triggered by processing a maliciously crafted image/PDF, enabling memory corruption and potential arbitrary code execution in the context of the parsing process. Detection strategy combines (1) inventory/telemetry evidence of Apple endpoints running OS builds below the patched versions and (2) behavioral signals of image-parsing crashes, CoreGraphics/ImageIO fault telemetry, and anomalous child-process spawns from renderer/preview processes indicative of exploitation.
vendor: Apple product: Multiple Products cwe: CWE-787 disclosed: Sep 29, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-88771 KEV
Citrix NetScaler Improper Input Validation Exploitation (CVE-2026-88771)
Detects exploitation attempts and post-exploitation indicators for CVE-2026-88771, an improper input validation (memory corruption, CWE-119) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Listed in CISA KEV and covered by CISA BOD 26-04 as an actively exploited zero-day. Exploitation typically manifests as anomalous requests to NetScaler management or VPN/AAA endpoints, unexpected process crashes on the appliance (nsppe/httpd), and subsequent unauthorized session creation or webshell activity. This detection correlates suspicious HTTP request patterns against NetScaler-facing surfaces, appliance error/crash telemetry, and follow-on webshell/reverse-shell behavior.
vendor: Citrix product: NetScaler cwe: CWE-119 disclosed: Sep 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-88772 KEV
Citrix NetScaler Memory Buffer Exploitation (CVE-2026-88772)
Detects exploitation and post-exploitation activity associated with CVE-2026-88772, an improper restriction of operations within the bounds of a memory buffer (CWE-119) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Actively exploited as a zero-day (CISA KEV, BOD 26-04). Exploitation can lead to memory corruption, remote code execution, and device compromise. This detection focuses on anomalous NetScaler process behavior, malformed HTTP requests to the management/AAA VPN endpoints, unexpected shell/webshell activity on the appliance, crash artifacts (nscore/core dumps), and outbound connections from the appliance indicative of post-compromise C2.
vendor: Citrix product: NetScaler cwe: CWE-119 disclosed: Sep 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-65660 KEV
Microsoft SharePoint Code Injection (CVE-2026-65660) Exploitation
Detects exploitation of CVE-2026-65660, a code injection vulnerability (CWE-94) in Microsoft SharePoint Server that is listed in CISA KEV as actively exploited. Successful exploitation allows an attacker to inject and execute arbitrary code in the SharePoint application context, typically observed as the SharePoint IIS worker process (w3wp.exe) spawning command interpreters or writing web shells (e.g., .aspx/.ashx) into layouts/upload directories. This detection surfaces anomalous child process creation from SharePoint worker processes, suspicious file writes to SharePoint web-accessible paths, and injection indicators in SharePoint/IIS logs across multiple SIEM dialects.
vendor: Microsoft product: SharePoint cwe: CWE-94 disclosed: Sep 25, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-67279 KEV
MikroTik RouterOS Improper Behavioral Workflow Enforcement (CVE-2026-67279)
Detects exploitation and post-exploitation activity associated with CVE-2026-67279, a CISA KEV-listed improper enforcement of behavioral workflow vulnerability (CWE-841) in MikroTik RouterOS. Attackers abuse out-of-order or state-skipping requests against RouterOS management services (Winbox/8291, API/8728, www/443, SSH) to bypass authentication and configuration workflow controls, enabling device takeover, credential extraction, and pivoting. This detection surfaces anomalous RouterOS management-plane access, workflow-bypass indicators, unexpected admin/config changes, and outbound C2 from edge devices. Chained with related MikroTik flaws it allows full device compromise per September 2026 vendor advisory.
vendor: MikroTik product: RouterOS cwe: CWE-841 disclosed: Sep 25, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-87902 KEV
WordPress Core Remote File Inclusion (CVE-2026-87902) Exploitation
Detects exploitation attempts against CVE-2026-87902, a remote file inclusion (RFI) vulnerability in WordPress Core (CWE-98). Attackers supply attacker-controlled URLs or path-traversal payloads to inclusion parameters, causing the server to include and execute remote or unintended local PHP resources. This CVE is on the CISA KEV catalog with confirmed in-the-wild exploitation. The detection surfaces HTTP requests containing remote URL wrappers (http://, https://, ftp://, php://, data://), path traversal sequences to include parameters, subsequent outbound connections from the web server to attacker infrastructure, and web-shell / PHP execution artifacts written under the WordPress webroot.
vendor: WordPress product: Core cwe: CWE-98 disclosed: Sep 25, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-59167 Public PoC PoC
SunEditor <= 2.47.10 Sanitizer Bypass XSS (CVE-2026-59167)
Detects exploitation attempts and vulnerable-component presence for CVE-2026-59167, a critical (CVSS 10.0) cross-site scripting (CWE-79) vulnerability in the SunEditor npm rich-text WYSIWYG editor at versions <= 2.47.10. A flaw in SunEditor's HTML sanitizer allows attacker-controlled markup (crafted event-handler attributes, obfuscated javascript: URIs, malformed tags, and mutation-XSS payloads) to bypass filtering and execute arbitrary JavaScript in the victim's browser context. Because SunEditor content is frequently stored and re-rendered, exploitation can result in stored XSS, session/token theft, and account takeover. Detection focuses on web-request payloads carrying XSS vectors targeting SunEditor endpoints, dangerous sanitizer-bypass patterns in stored content, and inventory of vulnerable suneditor package versions in build/deploy telemetry.
vendor: npm product: suneditor cwe: CWE-79 disclosed: Sep 24, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-61732 Public PoC PoC
Decepticon ChatML Special-Token Injection via Web Crawl Output (CVE-2026-61732)
Detects exploitation of CVE-2026-61732, a critical (CVSS 10.0) prompt-injection / role-boundary forgery vulnerability in the Decepticon LLM agent framework (pip packages decepticon-core, decepticon, decepticon-sdk <= 1.1.16). Decepticon composes raw web-crawl output directly into the model's prompt context without neutralizing ChatML special-token literals (e.g. <|im_start|>, <|im_end|>, <|system|>). An attacker who controls a crawled web page can embed these literal tokens to forge new conversation turns, impersonate the system or assistant role, and override the agent's instructions (CWE-74, improper neutralization). This detection surfaces vulnerable package versions in the environment and crawl/HTTP activity whose content carries ChatML control-token literals indicative of exploitation.
vendor: pip product: decepticon-core, decepticon… cwe: CWE-74 disclosed: Sep 24, 202610.0 criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-5430 KEV
WSO2 Multiple Products Path Traversal / Signature Verification Bypass (CVE-2026-5430)
Detects exploitation attempts against CVE-2026-5430, a KEV-listed vulnerability affecting multiple WSO2 products (API Manager, Identity Server, Enterprise Integrator, and others). The advertised weakness is a path traversal (directory traversal) issue with an associated improper verification of cryptographic signature (CWE-347) that allows attackers to bypass content/signature validation and access or write files outside the intended directory via crafted request paths. Exploitation typically manifests as encoded traversal sequences (../, %2e%2e%2f, ..%252f) in URI paths, multipart file-upload endpoints, or authentication callback parameters against WSO2 management/carbon and gateway endpoints. Because CISA lists this CVE as actively exploited (KEV), any successful traversal reaching sensitive files (e.g. repository/conf, wso2carbon keystores, deployment artifacts) should be treated as a probable compromise.
vendor: WSO2 product: Multiple Products cwe: CWE-347 disclosed: Sep 24, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-71362 KEV
Adobe Commerce/Magento Incorrect Authorization Exploitation (CVE-2026-71362)
Detects exploitation attempts against CVE-2026-71362, an Incorrect Authorization (CWE-863) vulnerability in Adobe Commerce and Magento that is listed in CISA's KEV catalog. The flaw allows an attacker to bypass authorization checks and access or manipulate resources without proper privilege. This detection surfaces anomalous access to privileged admin/REST/GraphQL endpoints, authorization-bypass patterns, and post-exploitation activity such as unexpected admin account creation, config changes, and webshell drops on Magento web servers.
vendor: Adobe product: Commerce and Magento cwe: CWE-863 disclosed: Sep 24, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-57149 Public PoC PoC
plone.app.portlets TALES Injection Remote Code Execution (CVE-2026-57149)
Detects exploitation attempts against CVE-2026-57149, a critical (CVSS 9.9) remote code execution vulnerability in plone.app.portlets caused by unsafe evaluation of user-controllable TALES (Template Attribute Language Expression Syntax) expressions (CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code / 'Eval Injection'). Affected versions: 5.0.0-5.0.7, 6.0.0-6.0.3, and 7.0.0-7.0.1. An authenticated (or, depending on portlet configuration, low-privilege) actor can inject TALES/Python expressions such as python:__import__('os').system(...) or string: expressions containing path traversals into portlet assignment or portlet header/footer fields, which Zope/Plone evaluates server-side, yielding arbitrary code execution as the Zope process user. This detection surfaces suspicious portlet edit/assignment requests carrying TALES expression markers, Zope error/traceback telemetry indicating expression evaluation, and child processes spawned by the Zope/Plone (zope, zserver, python, instance) process tree. Remediate by upgrading to plone.app.portlets 5.0.8, 6.0.4, or 7.0.2.
vendor: pip product: plone.app.portlets cwe: CWE-95 disclosed: Sep 23, 20269.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-77602 Public PoC PoC
OpenC3 COSMOS Authenticated RCE via User-Writable Config Overlay (CVE-2026-77602)
Detects exploitation of CVE-2026-77602, an authenticated remote code execution vulnerability in OpenC3 COSMOS (>= 5.1.0, <= 7.2.1). COSMOS evaluates user-supplied configuration files from the writable config overlay — table definitions, command/telemetry (cmd/tlm) definitions, and script suites — as Ruby code. An authenticated user with write access to the config bucket/overlay can embed arbitrary Ruby (e.g. via instance_eval, backticks, system, or inline Ruby in config directives) that executes with the privileges of the COSMOS service when the config is parsed or a script suite is run. CWE-94 (Code Injection). CVSS 9.9, PoC public. This detection looks for suspicious writes/uploads of config overlay files containing executable Ruby primitives, COSMOS service processes spawning shells or interpreters, and anomalous child processes under the cmd-tlm-api / script-runner-api containers.
vendor: rubygems product: openc3 cwe: CWE-94 disclosed: Sep 23, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-77244 Public PoC PoC
mcp-atlassian HTTP Transport Authentication Bypass (CVE-2026-77244)
Detects exploitation and exposure of CVE-2026-77244, a critical (CVSS 10.0) authentication bypass in the mcp-atlassian MCP server. Versions < 0.22.0 use an AtlassianOpaqueTokenVerifier that accepts ANY non-empty bearer token as valid, granting unauthenticated attackers full access to the MCP server's Atlassian tools (Jira/Confluence read/write) over the HTTP transport (streamable-http / SSE). Detection focuses on anomalous or forged Authorization bearer tokens reaching the mcp-atlassian HTTP endpoint, successful tool invocations from unexpected sources, and identification of vulnerable server versions.
vendor: pip product: mcp-atlassian cwe: CWE-287, CWE-303 disclosed: Sep 22, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-85102 KEV
CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Exploitation
Detects exploitation and post-exploitation activity associated with CVE-2026-85102, an improper certificate validation vulnerability (CWE-295) affecting multiple Check Point products. The flaw allows an attacker to present forged or mismatched TLS certificates that Check Point components accept without proper validation, enabling machine-in-the-middle interception of management/VPN/gateway sessions, credential capture, and unauthorized session establishment. This CVE is listed in the CISA KEV catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on TLS anomalies (self-signed/untrusted CA chains, certificate CN/SAN mismatches, sudden fingerprint changes) toward Check Point management and gateway interfaces, anomalous administrator/VPN authentication following such TLS events, and configuration or firmware activity indicative of exploitation.
vendor: Check Point product: Multiple Products cwe: CWE-295 disclosed: Sep 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-93616 KEV
Check Point Multiple Products Path Traversal Exploitation (CVE-2026-93616)
Detects exploitation attempts against CVE-2026-93616, a path traversal vulnerability (CWE-22) affecting multiple Check Point products including Security Management Server and gateways. Listed in CISA KEV, this flaw allows unauthenticated attackers to read arbitrary files outside the intended web root by supplying directory traversal sequences (e.g. ../../) in HTTP request paths or parameters against exposed management/portal interfaces. This detection surfaces traversal patterns in Check Point access/HTTP logs, web proxy telemetry, and firewall logs, along with post-exploitation indicators such as access to sensitive configuration and credential files.
vendor: Check Point product: Multiple Products cwe: CWE-22 disclosed: Sep 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-93952 KEV
Arista VeloCloud Orchestrator Improper Input Validation (CVE-2026-93952)
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-93952, an improper input validation vulnerability (CWE-20) in Arista VeloCloud Orchestrator (VCO). Listed in CISA KEV. The flaw permits attacker-supplied input to bypass validation on VCO management/API endpoints, enabling remote code execution or unauthorized command execution against the orchestrator. Detection focuses on anomalous requests to VCO API/admin paths, malformed input payloads reaching orchestrator endpoints, unexpected process spawning from the VCO web/application tier, and outbound connections from the orchestrator host.
vendor: Arista product: VeloCloud Orchestrator cwe: CWE-20 disclosed: Sep 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-94127 KEV
F5 BIG-IP APM Heap-based Buffer Overflow (CVE-2026-94127)
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-94127, a heap-based buffer overflow (CWE-122) in the F5 BIG-IP Access Policy Manager (APM). The flaw allows a remote attacker to corrupt heap memory in the APM/TMM processing path, potentially achieving remote code execution or crashing the traffic management microkernel (TMM). Listed in CISA KEV with active exploitation. This detection surfaces anomalous APM authentication endpoint traffic, TMM crashes/restarts, unexpected process spawns from BIG-IP service accounts, and outbound connections from the appliance that indicate successful memory-corruption exploitation.
vendor: F5 product: BIG-IP APM cwe: CWE-122 disclosed: Sep 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-7273 KEV
CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Exploitation
Detects exploitation attempts and indicators of CVE-2026-7273, a stack-based buffer overflow (CWE-121) in Zyxel GS1900 Series managed switches. The vulnerability, added to CISA's KEV catalog, allows a remote attacker to trigger memory corruption in the web management interface of affected GS1900 switches, potentially leading to denial of service or remote code execution and full device compromise. This detection surfaces anomalous HTTP requests to the switch management plane containing oversized parameters, malformed multipart/form bodies, and post-exploitation indicators such as unexpected reboots, configuration changes, and management-plane access from untrusted networks. Because network switches rarely emit rich endpoint telemetry, detection leans on network flow, web proxy, firewall, and syslog data from the device itself.
vendor: Zyxel product: GS1900 Series Switches cwe: CWE-121 disclosed: Sep 21, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2025-53837 Public PoC PoC
CVE-2025-53837: XWiki Rendering XML Eval Injection (Groovy/RCE)
Detects exploitation of CVE-2025-53837, a CWE-95 Eval Injection vulnerability in the org.xwiki.rendering:xwiki-rendering-xml Maven artifact (XWiki Rendering) affecting versions before 14.10.2. Untrusted XML rendering input containing script macros or embedded code (e.g. Groovy) is passed to an evaluation context, allowing an attacker who can submit wiki/rendering content to achieve remote code execution on the XWiki server. This detection surfaces suspicious rendering requests carrying script/macro payloads, anomalous child-process spawning from the XWiki JVM, and outbound callbacks following content submission.
vendor: maven product: org.xwiki.rendering:xwiki-rendering-xml cwe: CWE-95 disclosed: Sep 18, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-61682 Public PoC PoC
kcp front-proxy X-Remote-* Identity Header Injection Impersonation (CVE-2026-61682)
Detects exploitation of CVE-2026-61682, a critical (CVSS 9.9) authentication bypass in kcp (github.com/kcp-dev/kcp) front-proxy. The front-proxy fails to strip inbound X-Remote-* identity headers (X-Remote-User, X-Remote-Group, X-Remote-Extra-*) from client requests before forwarding them to backend shard API servers. Because backend shards trust these headers as authenticated identity from the front-proxy, any authenticated client can inject arbitrary groups and warrants — including system:masters — to impersonate a cluster admin in any workspace. This detection surfaces HTTP requests to the kcp front-proxy that carry client-supplied X-Remote-* headers, along with resulting privileged API actions attributable to injected group membership. Affected: kcp < 0.31.4 and >= 0.32.0, < 0.32.2. Fixed in 0.31.4 and 0.32.2.
vendor: go product: github.com/kcp-dev/kcp cwe: CWE-290, CWE-302 disclosed: Sep 18, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-45140 Public PoC PoC
Chamilo LMS CStudio Unauthenticated Upload RCE (CVE-2026-45140)
Detects exploitation of CVE-2026-45140, an unauthenticated remote code execution flaw in Chamilo LMS (<= 2.0.0) via the CStudio content upload flow. The vulnerability chains path traversal (CWE-22), code injection (CWE-94), and unrestricted file upload (CWE-434) to write and execute attacker-controlled PHP on the server without authentication. Detection focuses on anonymous POST requests to CStudio/document upload endpoints, subsequent GET requests to attacker-written scripts under web-accessible upload/course paths, and web-server process spawning shells or interpreters.
vendor: composer product: chamilo/chamilo-lms cwe: CWE-22, CWE-94 disclosed: Sep 17, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2025-59953 Public PoC PoC
LMDeploy Pickle Deserialization RCE via zmq_rpc.call_and_response() (CVE-2025-59953)
Detects exploitation of CVE-2025-59953, a critical (CVSS 9.8) unsafe Python pickle deserialization remote code execution vulnerability in InternLM's LMDeploy. The ZeroMQ RPC layer (zmq_rpc.call_and_response()) deserializes attacker-controlled messages with Python's pickle module, allowing an unauthenticated attacker who can reach the internal ZMQ RPC sockets to execute arbitrary code via a malicious pickle payload (CWE-502). Affected versions are >= 0.9.1 and < 0.10.2; fixed in 0.10.2. This detection surfaces suspicious child processes spawned by the LMDeploy Python service, anomalous inbound connections to LMDeploy ZMQ RPC ports, and pickle __reduce__ gadget indicators in traffic/logs.
vendor: pip product: lmdeploy cwe: CWE-502 disclosed: Sep 16, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-61560 Public PoC PoC
@zereight/mcp-gitlab Unauthenticated Path Traversal Arbitrary File Read (CVE-2026-61560)
Detects exploitation of CVE-2026-61560, an unauthenticated path traversal (CWE-22) in the @zereight/mcp-gitlab (gitlab-mcp) MCP server prior to v2.1.27. The `upload_markdown` tool fails to sanitize file paths, allowing an attacker to read arbitrary files from the host via directory traversal sequences. This is commonly abused to exfiltrate GitLab Personal Access Tokens (PATs), MCP configuration files, and environment secrets stored on disk, leading to full GitLab account takeover. CVSS 9.8; public PoC available. Detection focuses on traversal patterns (`../`, encoded variants, absolute sensitive paths) hitting the MCP server's HTTP/stdio interface, process reads of sensitive files by the node/mcp-gitlab process, and outbound token exfiltration.
vendor: npm product: @zereight/mcp-gitlab cwe: CWE-22 disclosed: Sep 16, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-58704 KEV
Google Pixel Modem Improper Authorization (CVE-2026-58704)
Detects exploitation indicators and vulnerable-device exposure for CVE-2026-58704, a KEV-listed improper authorization (CWE-693) flaw in the Google Pixel baseband/modem stack disclosed in the September 2026 Android/Pixel security bulletin. The weakness allows a protection mechanism to be bypassed so that operations requiring authorization are performed without it, enabling privilege escalation or unauthorized access to modem/telephony resources on affected Pixel devices. This detection surfaces Pixel devices whose reported security patch level predates the 2026-09-01 fix via MDM/UEM and endpoint telemetry, and hunts for anomalous modem crashes, unexpected radio interface manager (RILD) behavior, and post-exploitation privilege changes indicative of active exploitation.
vendor: Google product: Pixel cwe: CWE-693 disclosed: Sep 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-76460 KEV
Cisco ISE Incorrect Use of Privileged APIs (CVE-2026-76460)
Detects exploitation attempts and indicators associated with CVE-2026-76460, a KEV-listed vulnerability in Cisco Identity Services Engine (ISE) stemming from incorrect use of privileged APIs (CWE-648). An attacker can invoke privileged internal API functions through improperly authorized code paths, potentially leading to privilege escalation, configuration tampering, or command execution on the ISE appliance. This detection surfaces anomalous access to ISE administrative/internal API endpoints, unexpected privileged operations initiated from low-privilege or unauthenticated sessions, and post-exploitation configuration changes visible in ISE application, admin audit, and API access logs.
vendor: Cisco product: Identity Services Engine cwe: CWE-648 disclosed: Sep 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-87886 KEV
Acronis Backup Incorrect Default Permissions Exploitation (CVE-2026-87886)
Detects exploitation of CVE-2026-87886, a KEV-listed incorrect default permissions vulnerability (CWE-276) in Acronis Backup, notably affecting the Acronis cPanel Backup plugin. Overly permissive default file/directory permissions on Acronis Backup installation directories, backup archives, agent binaries, and configuration files allow low-privilege local users to read sensitive backup data or modify agent components to achieve privilege escalation or code execution. This detection surfaces suspicious permission states, world-writable/world-readable Acronis paths, unauthorized access to backup archives by non-privileged accounts, and tampering with Acronis agent binaries and config.
vendor: Acronis product: Backup cwe: CWE-276 disclosed: Sep 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-59178 Public PoC PoC
ESPHome Device Builder Dashboard Authentication Bypass (CVE-2026-59178)
Detects exploitation and exposure of CVE-2026-59178, a missing-authentication vulnerability (CWE-306) in ESPHome Device Builder versions prior to 1.0.12. An upgrade renamed the dashboard authentication environment variables; deployments still setting the old variable names silently start with authentication disabled, exposing the ESPHome dashboard (default port 6052) to unauthenticated access. Unauthenticated actors can then reach device configuration, OTA firmware compilation/flashing, and secrets management. This detection surfaces unauthenticated dashboard access, sensitive dashboard/API endpoint hits without prior authentication, and OTA/compile actions originating from unauthenticated sessions.
vendor: pip product: esphome-device-builder cwe: CWE-306 disclosed: Sep 14, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-76461 KEV
Cisco Secure Email Gateway SQL Injection (CVE-2026-76461)
Detects exploitation attempts against CVE-2026-76461, a SQL injection vulnerability (CWE-89) in Cisco Secure Email Gateway (ESA). An unauthenticated or authenticated attacker can inject crafted SQL into web management or API request parameters, enabling data exfiltration, authentication bypass, or manipulation of the underlying database. This CVE is listed in the CISA KEV catalog (BOD 26-04). Detection focuses on SQL injection signatures in HTTP requests to the ESA management interface and API endpoints, anomalous database errors, and suspicious query patterns in web and syslog telemetry.
vendor: Cisco product: Secure Email Gateway cwe: CWE-89 disclosed: Sep 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-59971 Public PoC PoC
MySQL MCP Server SSE Transport Missing Origin/Host Validation - Unauthenticated SQL Execution (CVE-2026-59971)
Detects exploitation of CVE-2026-59971, a CVSS 10.0 flaw in the mysql-mcp-server (pip) package versions < 0.4.2. The SSE (Server-Sent Events) HTTP transport fails to validate the Origin and Host headers (CWE-306 Missing Authentication, CWE-346 Origin Validation Error), allowing an attacker to reach the MCP JSON-RPC endpoint and invoke database tools without authentication. This enables unauthenticated SQL execution either via direct network exposure of the SSE listener or via DNS rebinding attacks against a locally-bound server from a victim's browser. Detection focuses on requests to MCP SSE/message endpoints (commonly /sse and /messages) carrying missing, external, or mismatched Origin/Host headers, followed by MCP tool-invocation JSON-RPC calls (tools/call with execute_sql) and subsequent anomalous MySQL query activity.
vendor: pip product: mysql-mcp-server cwe: CWE-306, CWE-346 disclosed: Sep 11, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-42016 KEV
JFrog Artifactory Incorrect Authorization Exploitation (CVE-2026-42016)
Detects exploitation of CVE-2026-42016, an incorrect authorization (CWE-863) vulnerability in JFrog Artifactory that allows an authenticated or low-privileged actor to bypass access controls and reach repositories, artifacts, or administrative APIs they are not entitled to. This CVE is on the CISA KEV catalog (BOD 26-04). Detection focuses on anomalous access to protected Artifactory REST API paths (e.g. /artifactory/api/security, /access/api, admin and repository-config endpoints) returning success (2xx) for principals or from sources that should be denied, unusual privilege-relevant actions, and authorization-decision anomalies in access.log / request.log.
vendor: JFrog product: Artifactory cwe: CWE-863 disclosed: Sep 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-42018 KEV
JFrog Artifactory Improper Authentication (CVE-2026-42018)
Detects exploitation attempts against CVE-2026-42018, an improper authentication (CWE-287) vulnerability in JFrog Artifactory that allows attackers to bypass authentication controls and access protected repository resources, administrative endpoints, or artifacts without valid credentials. This CVE is listed in the CISA KEV catalog, indicating active in-the-wild exploitation. The detection surfaces anomalous authentication bypass patterns including access to privileged Artifactory REST API endpoints (/api/security, /api/system, admin repository operations) without corresponding successful authentication events, requests bearing forged or malformed authorization headers, and unauthenticated retrieval of protected artifacts.
vendor: JFrog product: Artifactory cwe: CWE-287 disclosed: Sep 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-84869 KEV
ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869)
Detects exploitation of CVE-2026-84869, a KEV-listed improper privilege management (CWE-269) and missing authorization (CWE-862) vulnerability in ConnectWise ScreenConnect. Attackers abuse insufficient authorization checks on administrative/management endpoints to escalate privileges, create rogue administrative users, modify session-group permissions, or invoke privileged operations (remote command execution, extension upload) without proper authorization. Detection focuses on anomalous ScreenConnect web/service activity: unauthenticated or low-privilege access to admin API paths, privilege/role changes, new administrator provisioning, and remote command dispatch from the ScreenConnect service host.
vendor: ConnectWise product: ScreenConnect cwe: CWE-269, CWE-862 disclosed: Sep 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-85706 KEV
GitLab Path Traversal Arbitrary File Read (CVE-2026-85706)
Detects exploitation attempts and successful arbitrary file reads against GitLab Community Edition and Enterprise Edition via a path traversal vulnerability (CVE-2026-85706, CWE-35). Attackers abuse encoded or literal traversal sequences in GitLab HTTP request paths and parameters to read files outside the intended web root — including /etc/passwd, GitLab secrets (gitlab-secrets.json, secrets.yml), the database configuration, and SSH keys. The flaw is listed on the CISA KEV catalog and is being actively exploited in the wild; GitLab has urged immediate patching to 19.3.2 (and equivalent 19.2.x / 19.1.x patch releases). Detection focuses on traversal patterns in GitLab Workhorse/Rails access logs, anomalous file access by the git/gitlab-www service account, and outbound responses containing sensitive file content.
vendor: GitLab product: Community Edition and Enterprise Edition cwe: CWE-35 disclosed: Sep 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-67277 KEV
MikroTik RouterOS Missing Authentication for Critical Function (CVE-2026-67277)
Detects exploitation of CVE-2026-67277, a missing-authentication-for-critical-function vulnerability (CWE-306) in MikroTik RouterOS. The flaw allows an unauthenticated remote attacker to invoke privileged RouterOS management functions — over the Winbox (TCP 8291), WWW/API (TCP 80/443/8728/8729) or SSH/Telnet management channels — without providing valid credentials, enabling configuration changes, credential harvesting, backdoor account creation and firmware/config exfiltration. This CVE is on the CISA KEV catalog (BOD 26-04). This detection surfaces unauthenticated access to management functions, anomalous configuration/user changes originating from external addresses, and indicators of post-exploitation persistence on RouterOS devices by correlating RouterOS syslog/API telemetry with network flow logs.
vendor: MikroTik product: RouterOS cwe: CWE-306 disclosed: Sep 10, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-86060 KEV
MikroTik RouterOS Argument Delimiter Injection (CVE-2026-86060)
Detects exploitation and post-exploitation activity related to CVE-2026-86060, an Improper Neutralization of Argument Delimiters (CWE-88) vulnerability in MikroTik RouterOS. Attacker-controlled input containing embedded argument delimiters (spaces, dashes, control characters) is passed unsanitized into RouterOS command execution, allowing injection of additional command arguments and unauthorized command execution. Listed in CISA KEV (BOD 26-04). Detection focuses on anomalous administrative command invocation, suspicious login/API activity against RouterOS management interfaces (Winbox/API/SSH/WWW), and injected argument patterns in device syslog exported to the SIEM.
vendor: MikroTik product: RouterOS cwe: CWE-88 disclosed: Sep 10, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2025-25249 KEV
Fortinet FortiWeb Heap-Based Buffer Overflow Exploitation (CVE-2025-25249)
Detects exploitation attempts and indicators of compromise associated with CVE-2025-25249, a heap-based buffer overflow (CWE-122 / CWE-787 out-of-bounds write) affecting multiple Fortinet products. Listed in the CISA KEV catalog, this vulnerability can be triggered by malformed HTTP/HTTPS requests to affected Fortinet management or proxy interfaces, potentially leading to memory corruption, denial of service, or remote code execution. This detection surfaces anomalous requests, crash/restart telemetry, and post-exploitation activity on affected Fortinet appliances.
vendor: Fortinet product: Multiple Products cwe: CWE-122, CWE-787 disclosed: Sep 9, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-19490 KEV
Citrix NetScaler Authentication Bypass via Alternate Path (CVE-2026-19490)
Detects exploitation attempts against CVE-2026-19490, a CISA KEV-listed authentication bypass (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway. An attacker reaches authenticated-equivalent functionality through an alternate path or channel, bypassing primary authentication controls on the management interface (NSIP) or the Gateway/AAA virtual servers. Detection focuses on anomalous access to authenticated endpoints without a preceding successful authentication event, suspicious requests to alternate/undocumented paths, and post-exploitation session/config manipulation on NetScaler appliances. Affected products: Citrix NetScaler ADC and NetScaler Gateway (see CTX696939 for fixed builds).
vendor: Citrix product: NetScaler cwe: CWE-288 disclosed: Sep 9, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-20079 KEV
Cisco Secure FMC Authentication Bypass via Alternate Path (CVE-2026-20079)
Detects exploitation of CVE-2026-20079, a KEV-listed authentication bypass (CWE-288) in Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management. An unauthenticated remote attacker can reach protected FMC administrative functions using an alternate path or channel, bypassing authentication. Detection focuses on anomalous access to FMC administrative/API endpoints, authentication events that succeed without a corresponding credential validation, and post-exploitation activity such as new admin users, policy changes, and configuration exports observed in FMC syslog/audit and web-server telemetry.
vendor: Cisco product: Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management cwe: CWE-288 disclosed: Sep 9, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-87491 KEV
Google Chromium V8 Out-of-Bounds Write (CVE-2026-87491) — Exploitation & Unpatched Exposure
Detects exploitation indicators and unpatched exposure for CVE-2026-87491, a KEV-listed out-of-bounds write (CWE-787) in Google Chromium's V8 JavaScript engine. Successful exploitation of this memory-corruption zero-day allows arbitrary code execution in the renderer process, typically chained with a sandbox escape for full host compromise. Because no CVSS or fixed-version list was published in the correlated intel, detection focuses on observable exploitation behavior: Chrome/Chromium renderer processes crashing or spawning anomalous child processes, browser processes performing unusual code execution or network activity, and endpoint software inventory reporting Chromium builds older than the emergency Stable channel update released 2026-09-09. Maps to drive-by/exploitation-for-client-execution activity.
vendor: Google product: Chromium V8 cwe: CWE-787 disclosed: Sep 9, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-85061 Public PoC PoC
MapLibre GL JS DOM.sanitize() XSS Sanitizer Bypass (CVE-2026-85061)
Detects exploitation and presence of CVE-2026-85061, a critical (CVSS 10.0) cross-site scripting (CWE-79) sanitizer bypass in the maplibre-gl npm package (<= 6.4.0). MapLibre's DOM.sanitize() iterates over an element's live NamedNodeMap while removing attributes; because removal mutates the live collection during iteration, indices shift and dangerous attributes such as onload/onerror/href=javascript: are skipped and survive sanitization. Untrusted map content (GeoJSON feature properties, popup HTML, marker/legend content) rendered through the sanitizer can therefore inject executable script into the DOM. This detection surfaces vulnerable maplibre-gl versions in build/deploy telemetry and runtime indicators of XSS payloads delivered via map popups (event-handler attributes, javascript: URIs, and CSP violation reports referencing maplibre bundles).
vendor: npm product: maplibre-gl cwe: CWE-79 disclosed: Sep 8, 202610.0 criticalCWE-79 / XSS sanitizer bypasswrite-up soon - CVE-2026-73294 Public PoC PoC
Semaphore UI OS Command Injection (CVE-2026-73294)
Detects exploitation of CVE-2026-73294, an OS command injection vulnerability (CWE-78/CWE-88) in Semaphore UI (github.com/semaphoreui/semaphore), the open-source Ansible/Terraform/OpenTofu web UI. Versions prior to 0.0.0-20260704181911-7e8a9434bd81 (fixed in v2.18.17 and v2.19.5-beta2) allow an authenticated attacker to inject shell metacharacters into fields that are passed unsanitized to command-line invocations (task/template arguments, inventory or environment values), resulting in arbitrary command execution on the Semaphore host or its runners. CVSS 9.9 with a public PoC (GHSA-xp7j-h7jc-4w8p). Detection focuses on the semaphore process spawning unexpected shell/child processes and on request payloads containing command-injection metacharacters.
vendor: go product: github.com/semaphoreui/semaphore cwe: CWE-78, CWE-88 disclosed: Sep 8, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-62815 Public PoC PoC
Microsoft MsQuic (MsQuic.OpenSSL/Schannel) Use-After-Free RCE — CVE-2026-62815
Detects exploitation attempts and vulnerable deployments of Microsoft's MsQuic library (the Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel NuGet packages) affected by CVE-2026-62815, a CWE-416 use-after-free permitting unauthenticated remote code execution over QUIC/UDP. Affected versions are >= 2.5.3 and < 2.5.10, and all versions < 2.4.19. A fix is available: the vulnerability is patched in msquic 2.4.19 and 2.5.10 (per PRs #6217/#6219/#6220 and commits 583e7d5, 9ff06b7, e0f55b5), which correct the freed connection/stream object reuse in QUIC handshake/connection handling. The vulnerability is triggered by crafted QUIC handshake/connection traffic that causes a freed connection or stream object to be reused; exploitation typically manifests as anomalous QUIC (UDP/443) traffic to msquic-linked processes, crashes/restarts of QUIC-enabled services, and spawning of child processes from QUIC server binaries. This detection surfaces vulnerable package/binary presence, abnormal crash telemetry of msquic-linked services, and suspicious post-exploitation child-process activity. Remediation is to upgrade to msquic 2.4.19 or 2.5.10 (or later). Exploit status: public PoC available (GHSA-92f5-vc22-8j33).
vendor: nuget product: Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel cwe: CWE-416 disclosed: Sep 8, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-75650 KEV
Adobe Commerce/Magento Template Engine SSTI (CVE-2026-75650)
Detects exploitation of CVE-2026-75650, a KEV-listed server-side template injection (CWE-1336) in Adobe Commerce and Magento arising from improper neutralization of special elements used in the template engine. Attackers inject template directives (e.g. {{...}}, {%...%}) into fields processed by the storefront/admin template engine to achieve code execution, PHP object instantiation, or filesystem/config disclosure. Detection focuses on template directive syntax in HTTP request bodies/parameters to Magento endpoints, anomalous PHP process spawning from the web server, and unexpected writes to Magento var/ and pub/media directories.
vendor: Adobe product: Commerce and Magento cwe: CWE-1336 disclosed: Sep 8, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-81963 KEV
Microsoft Windows Link Following Privilege Escalation (CVE-2026-81963)
Detects exploitation attempts against CVE-2026-81963, a Microsoft Windows link following (symbolic link / junction / hardlink) vulnerability (CWE-59, CWE-284) that allows a local attacker to redirect privileged file operations to attacker-controlled targets, resulting in privilege escalation. This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection focuses on the behavioral indicators of link-following abuse: creation of NTFS junctions/reparse points and object-manager symbolic links in user-writable directories, followed by privileged processes writing or deleting through those links. Because affected version data is not published in the intel, this detection is behavior-based rather than version-based and should be paired with patch-status verification.
vendor: Microsoft product: Windows cwe: CWE-59, CWE-284 disclosed: Sep 8, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-85880 KEV
CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Exploitation
Detects exploitation attempts and post-exploitation activity associated with CVE-2026-85880, a heap-based buffer overflow (CWE-122) with use of uninitialized resource (CWE-908) in Microsoft Windows. Listed in the CISA KEV catalog (disclosed 2026-09-08), this vulnerability is actively exploited to achieve memory corruption leading to elevation of privilege or remote code execution. Detection focuses on process crash telemetry (WER/faulting module), anomalous child processes spawned from Windows components, suspicious memory operations, and privilege-escalation indicators following a crash, since no public PoC or specific affected-version list is available and exploitation manifests primarily as crash-then-execute behavior.
vendor: Microsoft product: Windows cwe: CWE-122, CWE-908 disclosed: Sep 8, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-86218 KEV
N-able N-central Pre-Authentication Static Code Injection RCE (CVE-2026-86218)
Detects exploitation of CVE-2026-86218, a pre-authentication remote code execution vulnerability in N-able N-central caused by static code injection (CWE-96) where attacker-controlled input is evaluated as code by the N-central server. Listed in CISA KEV. This detection looks for anomalous unauthenticated requests to N-central web endpoints followed by child-process spawns from the N-central application/Apache/Java service accounts, injected payload markers in HTTP request bodies, and web-server processes launching shells or interpreters — the hallmarks of code-injection RCE against an Internet-exposed RMM server.
vendor: N-able product: N-central cwe: CWE-96 disclosed: Sep 8, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-85046 KEV
Google Chromium V8 Type Confusion (CVE-2026-85046) — Vulnerable Browser & Exploitation Activity
Detects the presence of vulnerable Google Chromium/Chrome (V8 JavaScript engine) versions affected by CVE-2026-85046, a type confusion vulnerability (CWE-843) in V8, and associated post-exploitation behaviors. This flaw is exploited in the wild (CISA KEV) and can lead to arbitrary code execution / renderer sandbox escape chains when a victim visits a malicious page. Detection combines vulnerable-version inventory signals with browser-spawned suspicious child process activity, unexpected renderer crashes, and anomalous outbound connections characteristic of V8 type-confusion exploitation.
vendor: Google product: Chromium V8 cwe: CWE-843 disclosed: Sep 4, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-69083 Public PoC PoC
SiYuan fullTextSearchAssetContent Unauthenticated SQL Injection and REGEXP Injection (CVE-2026-69083)
Detects exploitation of CVE-2026-69083, a CVSS 10.0 unauthenticated SQL injection and REGEXP injection in SiYuan's kernel (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260721004815-cf42dd5680c8. In publish (reader) mode the fullTextSearchAssetContent handler passes attacker-controlled input into raw SQL against a read-write asset-content SQLite database (method 2) and into an unescaped REGEXP operator (method 3). Because publish mode requires no authentication, an anonymous reader can execute arbitrary SQL and DoS/inject via crafted REGEXP patterns. Detection focuses on anomalous requests to the asset content full-text search API endpoint containing SQL/REGEXP injection markers, error responses indicating query manipulation, and SiYuan kernel process/DB access anomalies.
vendor: go product: github.com/siyuan-note/siyuan/kernel disclosed: Sep 3, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-69084 Public PoC PoC
SiYuan Unauthenticated Arbitrary SQL Execution via searchEmbedBlock (CVE-2026-69084)
Detects exploitation of CVE-2026-69084, an unauthenticated arbitrary SQL execution vulnerability in SiYuan note-taking software's kernel when running in publish (reader) mode. The searchEmbedBlock API endpoint passes an attacker-controlled SQL statement to a read-write database handle without authentication or sandboxing, allowing a remote unauthenticated reader to execute arbitrary raw SQL — including cross-notebook reads and writes (INSERT/UPDATE/DELETE) — against the underlying SQLite database. CVSS 10.0. A public PoC exists. This detection surfaces anomalous HTTP requests to the embed-block search API carrying raw SQL keywords, write statements, or SQL-injection markers, and correlates them with unauthenticated access patterns in publish mode. Affected: github.com/siyuan-note/siyuan/kernel < 0.0.0-20260721002947-23a17d44b5f3.
vendor: go product: github.com/siyuan-note/siyuan/kernel disclosed: Sep 3, 202610.0 criticalunspecifiedwrite-up soon - CVE-2026-72811 Public PoC PoC
SiYuan Backlink/Mention Search SQL Injection (CVE-2026-72811)
Detects exploitation of CVE-2026-72811, a critical (CVSS 10.0) SQL injection in the SiYuan note-taking kernel (github.com/siyuan-note/siyuan/kernel) affecting versions before 0.0.0-20260723004839-1a5b3431d5ab. In publish mode, the backlink/mention search feature builds SQL against a read-write SQLite handle using unescaped client keyword input (first-order) and unescaped stored document titles (second-order). An attacker can break out of the SQL string literal to read, modify, or destroy arbitrary data. Exploitation appears as anomalous backlink/mention search HTTP requests (e.g. /api/ref/getBacklink2, /api/search/*) carrying SQL metacharacters, or as errors/anomalous query patterns in kernel logs. A PoC is public via GHSA-q2vg-7qgx-x5fc.
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-89 disclosed: Sep 3, 202610.0 criticalN/Awrite-up soon - CVE-2026-72920 Public PoC PoC
SeaweedFS Unauthenticated Filer IAM gRPC S3 Admin Takeover (CVE-2026-72920)
Detects exploitation of CVE-2026-72920, a missing-authentication flaw (CWE-306) in SeaweedFS where the filer's IAM gRPC service exposes S3 identity/credential management without authentication. An unauthenticated attacker can invoke IAM gRPC RPCs (e.g. CreateIdentity/ConfigureS3/UpdateS3Credentials) against the filer's gRPC port to mint S3 admin credentials, add access keys, or alter bucket policies — yielding full administrative control of the object store. Detection focuses on anomalous gRPC calls to the SeaweedFS filer IAM service, sudden creation of new S3 identities/access keys, and follow-on S3 admin actions from untrusted sources. Affected: github.com/seaweedfs/seaweedfs versions before 0.0.0-20260512171108-5e8f99f40a8a (release 4.24).
vendor: go product: github.com/seaweedfs/seaweedfs cwe: CWE-306 disclosed: Sep 2, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48710 KEV
Starlette HTTP Request/Response Smuggling (CVE-2026-48710) Exploitation
Detects exploitation attempts against CVE-2026-48710, an HTTP Request/Response Smuggling vulnerability (CWE-444) in Kludex Starlette, the ASGI framework underpinning FastAPI and many Python web services. Ambiguous or conflicting message-framing headers (both Content-Length and Transfer-Encoding, duplicated Content-Length, obsolete line folding, or malformed Transfer-Encoding values) allow an attacker to desynchronize the interpretation of request boundaries between an upstream proxy/load balancer and the Starlette backend. This enables request smuggling for cache poisoning, security-control bypass, credential/session hijacking, and request queue poisoning. The vulnerability is listed in CISA KEV (BOD 26-04) as known-exploited. This detection surfaces smuggling-indicative header anomalies and framing discrepancies in web/proxy telemetry reaching Starlette/ASGI endpoints.
vendor: Kludex product: Starlette cwe: CWE-444 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-49869 KEV
Kestra OSS OS Command Injection (CVE-2026-49869)
Detects exploitation of CVE-2026-49869, an OS command injection vulnerability in Kestra OSS (the open-source workflow orchestration platform). The flaw (CWE-78, with contributing CWE-184 incomplete blocklist, CWE-287 improper authentication, and CWE-918 SSRF) allows an attacker to inject arbitrary operating-system commands through a Kestra flow or task input that is passed to a shell without proper sanitization. Because Kestra executes flows on worker/executor nodes, successful injection yields remote code execution as the Kestra service account, often reachable pre-authentication. This detection is on the CISA KEV list, indicating confirmed in-the-wild exploitation. The rules identify anomalous child processes spawned by the Kestra JVM, shell metacharacters in flow/task API submissions, and outbound SSRF-style callbacks originating from Kestra hosts.
vendor: Kestra product: Kestra OSS cwe: CWE-78, CWE-184 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-59822 KEV
BerriAI LiteLLM Improper Authentication (CVE-2026-59822)
Detects exploitation of CVE-2026-59822, a KEV-listed improper authentication / missing authentication vulnerability (CWE-287, CWE-306) in BerriAI LiteLLM. Affected deployments allow unauthenticated or improperly authenticated access to the LiteLLM proxy/admin API, enabling attackers to reach privileged endpoints (model management, key generation, config, and completion routing) without valid credentials. Detection focuses on anomalous access to LiteLLM proxy endpoints — successful requests to sensitive paths lacking Authorization/master-key headers, key-generation and admin actions from unexpected sources, and access patterns to /key/generate, /user/new, /model/new, /config/update and completion endpoints without prior authentication.
vendor: BerriAI product: LiteLLM cwe: CWE-287, CWE-306 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-82329 KEV
JFrog Artifactory Improper Authentication Admin Token Forgery (CVE-2026-82329)
Detects exploitation of CVE-2026-82329, a critical improper authentication (CWE-287) vulnerability in JFrog Artifactory that allows unauthenticated attackers to forge administrative access tokens and bypass authentication. Actively exploited in the wild (CISA KEV). This detection surfaces suspicious access-token creation, unauthenticated administrative API calls, and anomalous privileged actions against Artifactory endpoints (e.g. /access/api/v1/tokens, /artifactory/api/security). Attackers leveraging this flaw can forge admin JWT/access tokens to pull, push, poison, or exfiltrate artifacts from repositories, enabling downstream supply-chain compromise.
vendor: JFrog product: Artifactory cwe: CWE-287 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-83548 KEV
SonicWall SMA1000 Server-Side Request Forgery Exploitation (CVE-2026-83548)
Detects exploitation of CVE-2026-83548, a Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA1000 appliances. Unauthenticated attackers can coerce the appliance into issuing crafted HTTP/network requests to attacker-chosen internal or external destinations, enabling internal reconnaissance, metadata-service theft, and pivoting behind the perimeter. Listed in CISA KEV; actively exploited in the wild. This detection surfaces anomalous outbound/internal-bound requests originating from the SMA1000 management appliance, suspicious request patterns against the appliance's management/RAC endpoints, and the appliance reaching cloud metadata endpoints or internal RFC1918 hosts it should never contact.
vendor: SonicWall product: SMA1000 Appliances cwe: CWE-918, CWE-441 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-83549 KEV
SonicWall SMA1000 OS Command Injection (CVE-2026-83549)
Detects exploitation of CVE-2026-83549, an OS command injection vulnerability (CWE-78) in SonicWall SMA1000 Appliances. This CISA KEV-listed flaw allows a remote attacker to inject and execute arbitrary operating-system commands via the appliance's management/web interface, typically by embedding shell metacharacters in request parameters. Detection focuses on anomalous child processes spawned by SMA1000 web/management daemons, suspicious command-injection patterns in appliance access logs, and outbound connections initiated by the appliance following inbound web requests.
vendor: SonicWall product: SMA1000 Appliances cwe: CWE-78 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-9586 KEV
Sangoma Switchvox SQL Injection Exploitation (CVE-2026-9586)
Detects exploitation attempts and successful exploitation of CVE-2026-9586, a SQL injection vulnerability (CWE-89) in Sangoma Switchvox IP-PBX appliances. The flaw allows unauthenticated attackers to inject SQL through the Switchvox web administration/API interface, and is being actively exploited in the wild (CISA KEV) to deploy reverse shells. Detection focuses on SQLi payload patterns in HTTP requests to Switchvox web endpoints, anomalous database query errors, and post-exploitation reverse-shell/outbound-connection behavior originating from the appliance.
vendor: Sangoma product: Switchvox cwe: CWE-89 disclosed: Sep 2, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-81578 KEV
PaperCut NG/MF Missing Authentication for Critical Function Exploitation (CVE-2026-81578)
Detects exploitation of CVE-2026-81578, a missing-authentication-for-critical-function vulnerability (CWE-306) in PaperCut NG/MF print management software. Unauthenticated attackers reach a privileged administrative function without valid credentials, enabling configuration change, script execution, or remote code execution on the PaperCut Application Server. This CVE is listed in the CISA KEV catalog (added following the 27 Aug 2026 PaperCut security bulletin and CISA BOD 26-04), indicating confirmed in-the-wild abuse. The detection focuses on anomalous unauthenticated access to PaperCut admin/API endpoints, PaperCut server processes spawning command shells, and outbound activity from the print server, since PaperCut has historically been abused to deploy ransomware and remote-access tooling.
vendor: PaperCut product: NG/MF cwe: CWE-306 disclosed: Aug 31, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-82078 KEV
PaperCut NG/MF Unsafe Reflection RCE (CVE-2026-82078)
Detects exploitation attempts and successful exploitation of CVE-2026-82078, an unsafe reflection (CWE-470) vulnerability in PaperCut NG/MF print management software. The flaw allows an attacker to instantiate or invoke arbitrary Java classes by controlling reflection targets through user-supplied input to the PaperCut web application, leading to remote code execution. Added to the CISA KEV catalog on 2026-08-31 following active exploitation. This detection identifies suspicious requests to PaperCut web endpoints containing reflection/class-loading indicators, anomalous child processes spawned by the PaperCut application server (pc-app / java), and post-exploitation activity such as script/command execution originating from the PaperCut service account.
vendor: PaperCut product: NG/MF cwe: CWE-470 disclosed: Aug 31, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-55565 Public PoC PoC
Yamcs StreamSQL LIKE Pattern Janino Code Injection (CVE-2026-55565)
Detects exploitation of CVE-2026-55565, an authenticated remote code execution vulnerability in Yamcs (org.yamcs:yamcs-core) mission control software. StreamSQL queries containing a `LIKE` operator have their pattern string compiled into Java bytecode by the Janino compiler via `LikeExpression`. Because the pattern is not escaped before being embedded in generated Java source, an authenticated user who can issue StreamSQL (e.g. via the HTTP API `/api/archive/.../streamql`, WebSocket StreamSQL subscriptions, or the Yamcs web console SQL console) can inject arbitrary Java code that executes on the Yamcs server with the privileges of the Yamcs JVM process. This detection identifies StreamSQL `LIKE` clauses carrying Java code artifacts, anomalous child processes spawned from the Yamcs Java process, and suspicious HTTP requests to StreamSQL endpoints. Affected: >= 5.13.0 <= 5.13.1 and <= 5.12.7. Fixed in 5.12.8 and 5.13.2 (CVSS 9.9, CWE-94, PoC public).
vendor: maven product: org.yamcs:yamcs-core cwe: CWE-94 disclosed: Aug 28, 20269.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-55634 Public PoC PoC
Pimcore DataObject Class-Definition Field Name RCE (CVE-2026-55634)
Detects exploitation attempts against CVE-2026-55634, a critical (CVSS 9.9) remote code execution vulnerability in Pimcore. The DataObject class-definition editor fails to sanitize user-supplied field names, allowing an authenticated attacker with class-definition edit privileges to inject SQL (CWE-89) and PHP code (CWE-94) that is later executed when the generated DataObject class/listing PHP files are written and included. Affected: pimcore/pimcore <= 12.3.9 and 2026.1.0 through 2026.1.5. Fixed in 2026.1.6 (and the 12.x backport). Detection focuses on suspicious class-definition save requests, anomalous PHP file writes under the Pimcore var/classes directory, and web-shell-like child processes spawned from the PHP-FPM/webserver worker.
vendor: composer product: pimcore/pimcore cwe: CWE-89, CWE-94 disclosed: Aug 28, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-55559 Public PoC PoC
Yamcs createInstance instance-template YAML Injection RCE (CVE-2026-55559)
Detects exploitation of CVE-2026-55559, a critical (CVSS 9.8) remote code execution vulnerability in Yamcs (org.yamcs:yamcs-core). The createInstance API endpoint accepts instance-template arguments that are unsafely interpolated into instance configuration YAML, allowing an authenticated attacker to inject arbitrary YAML. Because Yamcs uses SnakeYAML-style deserialization, the injected YAML can instantiate arbitrary Java types (CWE-94/CWE-470/CWE-1336), leading to code execution in the Yamcs JVM. Affected versions: <= 5.12.7 and >= 5.13.0 <= 5.13.1; fixed in 5.12.8 and 5.13.2. This detection surfaces suspicious POST requests to the createInstance endpoint carrying YAML tag markers (e.g. '!!'), template argument injection patterns, and post-exploitation child processes spawned by the Yamcs Java process.
vendor: maven product: org.yamcs:yamcs-core cwe: CWE-94, CWE-470 disclosed: Aug 28, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-37004 Public PoC PoC
LiteLLM SSTI RCE via /prompts/test Endpoint (CVE-2026-37004)
Detects exploitation attempts against CVE-2026-37004, a server-side template injection (SSTI) vulnerability in LiteLLM's /prompts/test endpoint in versions prior to 1.83.7. The endpoint renders user-supplied prompt templates through Jinja2 without sandboxing, allowing an authenticated (or, in default deployments, unauthenticated) attacker to inject template expressions that reach Python object internals and achieve remote code execution. Detection focuses on HTTP POST requests to /prompts/test containing Jinja2 SSTI payload primitives (e.g. {{7*7}}, __class__, __mro__, __subclasses__, __globals__, __builtins__, cycler, lipsum, self.__init__), followed by anomalous child process spawns from the LiteLLM/Python proxy process.
vendor: pip product: litellm cwe: CWE-1336 disclosed: Aug 27, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2023-49105 KEV
ownCloud WebDAV API Authentication Bypass via Pre-Signed URLs (CVE-2023-49105)
Detects exploitation of CVE-2023-49105, an improper authentication vulnerability in ownCloud's WebDAV API. Pre-signed URLs are accepted even when no signing key is configured for the owner, allowing an unauthenticated attacker to access, modify or delete any file of any user via crafted requests containing OC-Signature parameters. This CVE is on the CISA KEV list. Detection focuses on unauthenticated WebDAV requests carrying pre-signed URL parameters (OC-Signature, OC-Credential, OC-Expires) and anomalous access patterns against the remote.php/dav or remote.php/webdav endpoints.
vendor: ownCloud product: ownCloud cwe: CWE-287 disclosed: Aug 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-53362 KEV
CVE-2026-53362: Linux Kernel Unspecified Vulnerability (KEV) Exploitation Indicators
Detects host-level indicators consistent with exploitation of CVE-2026-53362, an unspecified Linux Kernel vulnerability listed on the CISA KEV catalog (BOD 26-04). Because the upstream fix spans multiple stable kernel commits and no public PoC or precise affected-version range is available, this detection focuses on behavioral signals of local kernel exploitation: unexpected privilege escalation to UID 0, kernel oops/BUG/taint messages coinciding with unprivileged process activity, suspicious loading of kernel modules, and abnormal syscall/capability abuse. Alerts are exposure-and-behavior signals, not proof of the specific bug; correlate with kernel version and patch state.
vendor: Linux product: Kernel disclosed: Aug 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-66384 KEV
CVE-2026-66384: JFrog Artifactory Path Traversal (CWE-22) Exploitation
Detects exploitation attempts against CVE-2026-66384, an improper limitation of a pathname to a restricted directory (path traversal, CWE-22) vulnerability in JFrog Artifactory. This CISA KEV-listed flaw allows an attacker to supply crafted pathnames — typically via repository artifact download/upload APIs or the UI — to escape the intended repository storage root and read or write arbitrary files on the Artifactory host (e.g. Artifactory config, database credentials, master.key, or OS files). Detection focuses on traversal sequences (../, encoded variants, absolute paths, null bytes) in HTTP request paths and query parameters directed at Artifactory endpoints (/artifactory/api/, /ui/, /access/), anomalous access to files outside repository roots, and requests targeting sensitive system paths.
vendor: JFrog product: Artifactory cwe: CWE-22 disclosed: Aug 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-54569 Public PoC PoC
senaite.core Eval Injection and Missing Authorization Exploitation (CVE-2026-54569)
Detects exploitation of CVE-2026-54569, a critical (CVSS 9.8) eval injection (CWE-95) and missing authorization (CWE-862) vulnerability in senaite.core versions >= 2.0.0 through <= 2.6.0. senaite.core is a Python/Plone-based Laboratory Information Management System (LIMS). The flaw allows unauthenticated or under-privileged attackers to reach endpoints that pass attacker-controlled input into Python eval()/expression evaluation, enabling remote code execution in the context of the Zope/Plone application server. Detection focuses on suspicious HTTP requests to senaite endpoints containing Python expression payloads (e.g. __import__, os.system, subprocess) and on anomalous child processes spawned by the Zope/senaite Python process, which is the primary post-exploitation signal.
vendor: pip product: senaite.core cwe: CWE-95, CWE-862 disclosed: Aug 26, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-65905 Public PoC PoC
Apache Tomcat DIGEST Authenticator Capture-Replay Authentication Bypass (CVE-2026-65905)
Detects exploitation attempts and vulnerable configurations related to CVE-2026-65905, an authentication bypass by capture-replay in Apache Tomcat's DIGEST authenticator. Due to improper nonce/nonce-count validation (CWE-294), a network attacker who can capture a valid HTTP DIGEST Authorization header can replay it to authenticate as the victim, bypassing authentication (CVSS 9.8). Detection focuses on repeated DIGEST Authorization headers reusing identical nonce/cnonce/response values, anomalous nonce-count (nc) reuse or non-monotonic nc sequences, and successful authenticated access following replayed credentials against Tomcat instances. Affected: Tomcat 11.0.0-M1<11.0.25, 10.1.0-M1<10.1.58, 9.0.0.M1<9.0.121, 8.5.0<=8.5.100, 7.0.30<=7.0.109.
vendor: maven product: org.apache.tomcat:tomcat, org.apache.tomcat.embed:tomcat-embed-core… cwe: CWE-294 disclosed: Aug 26, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2019-1068 KEV
CVE-2019-1068: Microsoft SQL Server Remote Code Execution
Detects exploitation attempts and indicators of CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server. The flaw allows an attacker who can submit specially crafted queries to trigger memory corruption in the SQL Server database engine, potentially leading to arbitrary code execution in the context of the SQL Server service account. This detection focuses on anomalous SQL Server process behavior (child processes spawned from sqlservr.exe), suspicious xp_cmdshell / OLE automation usage, malformed query patterns, and failed/unpatched-instance indicators. CVE-2019-1068 is listed on the CISA Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: SQL Server disclosed: Aug 26, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2021-23758 KEV
Ajax.NET Professional Insecure Deserialization (CVE-2021-23758)
Detects exploitation and exposure of CVE-2021-23758, a CWE-502 deserialization of untrusted data vulnerability in Ajax.NET Professional (AjaxPro). The AjaxPro framework converts JSON/type-hinted payloads posted to its endpoints (typically /ajaxpro/*.ashx) into .NET objects. When a request supplies attacker-controlled type information, the deserializer can be coerced into instantiating dangerous types (e.g. via the __type hint), enabling remote code execution on the IIS/ASP.NET worker process. This CVE is listed in the CISA KEV catalog. This detection surfaces suspicious POSTs to AjaxPro handlers containing type-manipulation markers, subsequent child-process spawns from w3wp.exe, and anomalous outbound activity indicative of successful gadget-chain execution.
vendor: Ajax.NET Professional product: Ajax.NET Professional cwe: CWE-502 disclosed: Aug 26, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2022-0995 KEV
CVE-2022-0995 - Linux Kernel watch_queue Out-of-Bounds Write Privilege Escalation
Detects exploitation and presence of CVE-2022-0995, a heap out-of-bounds write vulnerability in the Linux kernel's watch_queue event notification subsystem (kernel/watch_queue.c). The flaw stems from watch_queue_set_filter() failing to correctly bound the number of filter types (nr_filter) against the underlying bitmap, allowing an unprivileged local user to write past the end of a heap allocation. Successful exploitation corrupts kernel heap memory and leads to local privilege escalation to root. This CVE is listed in CISA KEV. Detection focuses on process telemetry indicating watch_queue exploitation primitives (keyctl/pipe watch_queue usage from unusual processes), kernel oops/panic signatures, and post-exploitation privilege escalation behavior.
vendor: Linux product: Kernel cwe: CWE-787 disclosed: Aug 26, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-8452 KEV
CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-8452, an improper restriction of operations within the bounds of a memory buffer (CWE-119) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. This CVE is listed in the CISA KEV catalog, indicating confirmed in-the-wild exploitation. The flaw allows attackers to overflow a memory buffer via crafted requests to exposed NetScaler management or gateway (VPN/AAA) endpoints, potentially leading to memory disclosure, denial of service, or remote code execution. Detection focuses on anomalous requests to NetScaler endpoints, abnormal appliance process behavior (nsppe/nsaaad crashes, shell spawns), and outbound connections from the appliance indicative of webshell or reverse-shell deployment.
vendor: Citrix product: NetScaler ADC and NetScaler Gateway cwe: CWE-119 disclosed: Aug 26, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-45018 Public PoC PoC
Chainlit MCP stdio Transport Command Injection (CVE-2026-45018)
Detects exploitation of CVE-2026-45018, an unauthenticated remote code execution vulnerability in Chainlit (>= 2.4.0rc0, <= 2.11.1) caused by OS command injection (CWE-78) in the Model Context Protocol (MCP) stdio transport. When a Chainlit application configures an MCP stdio server, attacker-controlled input is passed to a shell command line and executed without sanitization, allowing arbitrary command execution as the Chainlit service account. This detection surfaces suspicious child processes spawned by the Python/Chainlit/uvicorn process tree, shell metacharacter injection through MCP command parameters, and anomalous outbound activity following MCP session establishment. Remediate by upgrading to Chainlit 2.12.0 or later.
vendor: pip product: chainlit cwe: CWE-78 disclosed: Aug 25, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-55546 Public PoC PoC
qwed-mcp Unsafe SymPy parse_expr() Remote Code Execution (CVE-2026-55546)
Detects exploitation of CVE-2026-55546, a critical (CVSS 9.8) code-injection vulnerability (CWE-94) in the qwed-mcp Python package (< 0.2.1). qwed-mcp is a Model Context Protocol (MCP) server exposing math tools that pass user-supplied expression strings directly to SymPy's parse_expr() without restricting the evaluation namespace or transformations. Because parse_expr() will evaluate Python-callable constructs, an attacker can craft a math expression that invokes arbitrary Python (e.g. via __import__, object attribute traversal, or eval-reachable builtins), achieving remote code execution in the process hosting the MCP server. This detection surfaces the MCP server process spawning unexpected child processes (shell/interpreter/network tools), suspicious inbound tool-call payloads containing Python injection primitives, and installation of vulnerable package versions.
vendor: pip product: qwed-mcp cwe: CWE-94 disclosed: Aug 25, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-60004 KEV PoC
Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004) Exploitation
Detects exploitation of CVE-2026-60004, a code injection / remote code execution vulnerability (CWE-94) in Gitea. Attackers abuse the diffpatch feature to install malicious server-side git hooks, causing the Gitea server to execute arbitrary code within its application context. The flaw affects Gitea >= 1.17.0 and < 1.27.1 and carries a CVSS of 9.8 (critical). A public proof-of-concept exists and the CVE is listed in the CISA Known Exploited Vulnerabilities catalog (BOD 26-04 scope). Detection focuses on anomalous child processes spawned by the Gitea server binary, suspicious web requests to Gitea endpoints containing injection payloads, and Gitea process activity indicating server-side code execution via injected hooks.
vendor: Gitea product: Gitea cwe: CWE-94 disclosed: Aug 25, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-53710 Public PoC PoC
mcp-contextforge-gateway RestrictedPython Sandbox Bypass via getattr (CVE-2026-53710)
Detects exploitation of CVE-2026-53710, a RestrictedPython sandbox bypass in IBM's mcp-contextforge-gateway (MCP Context Forge) affecting versions <= 1.0.1. The python_sandbox_server exposes a RestrictedPython-based execution environment that fails to safely restrict the getattr builtin (CWE-693 protection mechanism failure / CWE-94 code injection). An attacker who can submit Python code to the sandbox can use getattr to traverse from allowed objects to dangerous attributes (e.g. __class__, __bases__, __subclasses__, __globals__, __builtins__) and reach os/subprocess primitives, achieving arbitrary code execution on the gateway host (CVSS 10.0). This detection surfaces sandbox-escape gadget strings in submitted payloads, anomalous child processes spawned by the gateway/python_sandbox_server, and outbound activity from the sandbox process. Fixed in v1.0.2 (commit 63a2900e).
vendor: pip product: mcp-contextforge-gateway cwe: CWE-94, CWE-693 disclosed: Aug 24, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-71300 Public PoC PoC
Apache Camel-Atmosphere-Websocket WebSocket Dispatch Header Injection (CVE-2026-71300)
Detects exploitation attempts and vulnerable deployments of Apache Camel camel-atmosphere-websocket affected by CVE-2026-71300 (CVSS 9.8, CWE-20). The camel-atmosphere-websocket producer selected its target WebSocket peers using Exchange header values whose header names fell OUTSIDE the filtered Camel header namespace. Because these attacker-controllable HTTP/message headers were not stripped by the Camel header filter strategy, a remote attacker able to influence inbound headers can inject dispatch-control headers (e.g. sendToAll / connection-key style targeting) and redirect, broadcast, or spoof WebSocket messages to arbitrary connected peers. This detection surfaces HTTP requests carrying anomalous WebSocket dispatch headers, Camel routes logging unfiltered header propagation, and the presence of affected artifact versions (>= 4.0.0 < 4.14.9, >= 4.15.0 < 4.18.4, >= 4.19.0 < 4.22.0). A fix is now available: the maintainers apply the Camel header filter strategy to the atmosphere-websocket producer's peer-selection headers in releases 4.14.9, 4.18.4, and 4.22.0; upgrade to one of these fixed versions to remediate.
vendor: maven product: org.apache.camel:camel-atmosphere-websocket cwe: CWE-20 disclosed: Aug 24, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21962 KEV
Oracle HTTP Server / WebLogic Proxy Plug-in Improper Access Control (CVE-2026-21962)
Detects exploitation attempts and successful exploitation of CVE-2026-21962, an improper access control (CWE-284) vulnerability in the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (mod_wl / mod_weblogic). The flaw allows unauthenticated remote attackers to bypass intended access restrictions on proxied WebLogic back-ends, reaching administrative consoles, internal management endpoints, and paths that should be filtered by the reverse proxy. CISA added this CVE to the KEV catalog on 2026-08-24. Detection focuses on anomalous proxied requests to sensitive WebLogic paths (/console, /wls-wsat, /management, /em), access-control bypass patterns such as path traversal, double-encoding, and semicolon/URL-normalization tricks against the proxy, and web-server access logs where the proxy forwarded requests it should have denied.
vendor: Oracle product: HTTP Server and Oracle Weblogic Server Proxy Plug-in cwe: CWE-284 disclosed: Aug 24, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-61539 Public PoC PoC
Xinference RCE via Unsafe eval() in Llama3 Tool-Call Parsing (CVE-2026-61539)
Detects exploitation of CVE-2026-61539, a critical (CVSS 10.0) remote code execution vulnerability in Xorbits Xinference <= 2.5.0. The Llama3 tool-call parser passes attacker-controllable model output through Python's unsafe eval(), allowing arbitrary code execution on the inference host. An attacker who can influence a served Llama3 model's tool-call output (e.g., via crafted prompts to the /v1/chat/completions endpoint with tools enabled) can trigger eval() on malicious payloads. This detection identifies exploitation attempts via HTTP requests to Xinference chat endpoints containing eval-triggering patterns, anomalous child process spawns from the Xinference Python worker, and outbound connections from the inference process. Fixed in v2.7.0.
vendor: pip product: xinference cwe: CWE-95 disclosed: Aug 21, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-76904 Public PoC PoC
GeoTools Unauthenticated SQL Injection in jsonArrayContains Against PostGIS (CVE-2026-76904)
Detects exploitation of CVE-2026-76904, an unauthenticated SQL injection in the GeoTools gt-jdbc-postgis module's jsonArrayContains filter function. Affected versions embed unsanitized attribute/value arguments directly into PostgreSQL SQL when a WFS/OGC filter uses jsonArrayContains against a PostGIS layer, allowing an unauthenticated attacker to inject arbitrary SQL (stacked/UNION/boolean-blind) via crafted OGC Filter, CQL, or WFS GetFeature requests. This detection identifies SQLi payloads in OGC/WFS request parameters, anomalous PostgreSQL query patterns originating from the GeoServer/GeoTools application user, and error-based injection signatures.
vendor: maven product: org.geotools.jdbc:gt-jdbc-postgis cwe: CWE-89 disclosed: Aug 21, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-73570 KEV
Zimbra Collaboration Suite (ZCS) OS Command Injection (CVE-2026-73570)
Detects exploitation of CVE-2026-73570, a KEV-listed OS command injection vulnerability in Synacor Zimbra Collaboration Suite (ZCS). Attackers inject shell metacharacters into ZCS input (notably the SNMP-adjacent handling reported in active exploitation) to execute arbitrary OS commands as the 'zimbra' service account. Detection focuses on Zimbra service processes (mailboxd/java, zmconfigd, snmp handlers) spawning unexpected shell or reconnaissance child processes, and on web/proxy access to Zimbra endpoints correlated with anomalous command execution. Fixed in Zimbra 10.1.20 per vendor advisory.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-78 disclosed: Aug 21, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-72529 KEV
TrueConf Server Missing Authentication for Critical Function (CVE-2026-72529)
Detects exploitation attempts against CVE-2026-72529, a missing-authentication-for-critical-function vulnerability (CWE-306) in TrueConf Server. Unauthenticated attackers can invoke privileged administrative or management functions without supplying credentials, potentially enabling configuration changes, account takeover, or full server compromise. This CVE is listed in CISA's KEV catalog, indicating confirmed in-the-wild exploitation. The detections identify unauthenticated access to sensitive TrueConf Server administrative endpoints (web management console, API, and configuration interfaces) and anomalous privileged actions performed without a preceding authentication event.
vendor: TrueConf product: Server cwe: CWE-306 disclosed: Aug 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-72530 KEV
TrueConf Server Code Injection (CVE-2026-72530)
Detects exploitation of CVE-2026-72530, a code injection vulnerability (CWE-94) in TrueConf Server that allows an attacker to break out of the isolated environment and execute arbitrary code on the host. The flaw is listed in CISA KEV, indicating active in-the-wild exploitation. Detection focuses on the TrueConf Server service processes (e.g., trueconf, mcu, web components) spawning unexpected child processes such as shells, script interpreters, or reconnaissance/LOLBin utilities — a strong indicator that injected code is being executed by the server process rather than legitimate conferencing workloads.
vendor: TrueConf product: Server cwe: CWE-94 disclosed: Aug 20, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-55107 Public PoC PoC
kobako Sandbox Escape to Host RCE (CVE-2026-55107)
Detects exploitation of CVE-2026-55107, a critical (CVSS 10.0) sandbox escape in the kobako Ruby gem (versions >= 0.1.0, <= 0.9.0). kobako is intended to safely evaluate untrusted guest Ruby expressions, but its guest object forwards unknown methods through method_missing directly into public_send on any bound Service object. An attacker who can supply a guest expression can therefore invoke arbitrary public methods on host-side Service objects — chaining to send, instance_variable_get, or Service methods that reach system/eval — achieving host remote code execution. Detection focuses on the runtime side effects of an escape: Ruby/Rack worker processes (running kobako-backed evaluation) spawning shells, interpreters, reconnaissance binaries, or network tools; unexpected child processes of puma/unicorn/rails; and process-command-lines that reveal method_missing/public_send abuse patterns. Because the vulnerability lives inside a normally-sandboxed eval path, ANY OS command execution originating from the evaluating worker is high-signal.
vendor: rubygems product: kobako cwe: CWE-94, CWE-470 disclosed: Aug 18, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-54133 Public PoC PoC
CVE-2026-54133 — jmespath.php CompilerRuntime Code Injection via Unescaped Function Names
Detects exploitation and presence of CVE-2026-54133, a CVSS 9.8 code injection (CWE-94) vulnerability in mtdowling/jmespath.php prior to version 2.9.1. The library's CompilerRuntime writes compiled PHP expression code to disk and includes it. Function names supplied within a JMESPath expression are not properly escaped/sanitized before being emitted into the generated PHP source, allowing an attacker who controls the JMESPath expression (or a function name within it) to inject arbitrary PHP that is then written to the compiler cache directory and executed via include. Detection focuses on suspicious writes to the jmespath compiler cache directory (typically system temp with jmespath_* filenames), anomalous PHP process behavior downstream of JMESPath usage, and web requests carrying JMESPath-like injection payloads.
vendor: composer product: mtdowling/jmespath.php cwe: CWE-20, CWE-94 disclosed: Aug 18, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-55209 Public PoC PoC
resdata < 6.2.9 Memory-Corruption Vulnerabilities (CVE-2026-55209)
Detects the presence, installation, and potential exploitation of CVE-2026-55209 in the 'resdata' Python package (Equinor resdata, formerly libecl bindings) versions prior to 6.2.9. The vulnerability is a cluster of memory-safety defects — a classic buffer overflow (CWE-120), out-of-bounds read (CWE-125), improper validation of array index (CWE-129) and NULL pointer dereference (CWE-476) — triggered when resdata parses malformed reservoir-simulation binary files (Eclipse-format GRID/EGRID/INIT/UNRST/SMSPEC files). An attacker who supplies a crafted simulation file to a workflow using a vulnerable resdata build can cause a crash (DoS) or, via the heap/stack buffer overflow, potentially achieve code execution. CVSS 9.8, public PoC. This detection surfaces vulnerable installs across the environment and process/crash telemetry consistent with exploitation attempts against Python processes importing resdata.
vendor: pip product: resdata cwe: CWE-120, CWE-125 disclosed: Aug 18, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-55211 Public PoC PoC
CVE-2026-55211: surfio Out-of-Bounds Read (CWE-125)
Detects exploitation and exposure of CVE-2026-55211, an out-of-bounds read (CWE-125) in the Python 'surfio' package (Equinor) affecting versions < 0.0.19. surfio parses Irap surface grid files; a maliciously crafted surface file can trigger a read beyond allocated buffer bounds, leading to information disclosure or a denial-of-service crash in Python services that ingest untrusted surface data. With CVSS 9.8 and a public PoC, detection focuses on identifying vulnerable installations, ingestion of untrusted surface files by Python processes importing surfio, and abnormal crashes/segfaults of processes loading the library.
vendor: pip product: surfio cwe: CWE-125 disclosed: Aug 18, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-33824 KEV
CVE-2026-33824 — Microsoft IKE Service Extensions Double Free Exploitation
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-33824, a double free (CWE-415) vulnerability in the Microsoft Internet Key Exchange (IKE) Service Extensions (IKEEXT service, ikeext.dll). Successful exploitation via crafted ISAKMP/IKE (UDP 500/4500) traffic can corrupt heap memory and lead to remote code execution or denial of service in the context of the IKEEXT service (LocalSystem). This CVE is on the CISA KEV catalog. Detection focuses on IKEEXT service crashes, anomalous inbound IKE/ISAKMP traffic patterns, WFP/IPsec error bursts, and suspicious child processes or memory-corruption crash telemetry from svchost hosting the IKEEXT service.
vendor: Microsoft product: Internet Key Exchange (IKE) Service Extensions cwe: CWE-415 disclosed: Aug 18, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-55040 KEV
Microsoft SharePoint Weak Authentication Exploitation (CVE-2026-55040)
Detects exploitation of CVE-2026-55040, a weak authentication vulnerability (CWE-1390) in Microsoft SharePoint that allows attackers to bypass or abuse insufficient authentication controls to gain unauthorized access to SharePoint content and administrative surfaces. This CVE is listed in the CISA KEV catalog with active in-the-wild exploitation observed as of August 2026. Detection focuses on anomalous authentication patterns against SharePoint (_layouts, _api, _vti_bin endpoints), unauthenticated or under-authenticated access to protected resources, suspicious ToolPane/ViewState activity, and post-exploitation web shell or process spawning from the SharePoint w3wp.exe worker process.
vendor: Microsoft product: SharePoint cwe: CWE-1390 disclosed: Aug 18, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-59310 KEV
Broadcom VMware vCenter Path Traversal (CVE-2026-59310)
Detects exploitation of CVE-2026-59310, a path traversal (CWE-22) vulnerability in Broadcom VMware vCenter Server that allows unauthenticated attackers to read arbitrary files outside the intended web root by supplying crafted traversal sequences (../, encoded variants, or absolute path smuggling) in HTTP request paths and parameters. Added to the CISA KEV catalog on 2026-08-18 with active in-the-wild exploitation attributed to a suspected China-nexus actor. Detection focuses on traversal patterns in vCenter/vSphere Client HTTP requests, unexpected access to sensitive files (e.g. /etc/passwd, vpxd.cfg, SSO/STS signing keys), and anomalous file reads by the vCenter web/appliance service accounts.
vendor: Broadcom product: VMware vCenter cwe: CWE-22 disclosed: Aug 18, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-65400 KEV
CVE-2026-65400 — Apple macOS Screen Sharing Improper Authentication Exploitation
Detects exploitation attempts and successful abuse of CVE-2026-65400, an improper authentication vulnerability (CWE-287) in Apple macOS Screen Sharing / Remote Management. An unauthenticated remote attacker can bypass authentication on the Screen Sharing (VNC/ARD) service to gain interactive access to a macOS host. This CVE is on the CISA KEV catalog (BOD 26-04). Detection focuses on anomalous inbound Screen Sharing / ARD connections, screensharingd authentication events, unexpected launches of remote-management daemons, and connections from macOS hosts running vulnerable, unpatched builds.
vendor: Apple product: macOS cwe: CWE-287 disclosed: Aug 18, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-47686 Public PoC PoC
VM2 Sandbox Escape via Missing Error.cause Sanitization (CVE-2026-47686)
Detects exploitation and presence of CVE-2026-47686, a critical (CVSS 9.9) sandbox escape in the vm2 npm library (versions <= 3.11.5). The vm2 sandbox fails to sanitize the Error.cause property, allowing attacker-controlled code executing inside the sandbox to walk the prototype chain of the host-provided cause object and reach host primitives (constructor.constructor), yielding arbitrary code execution on the host Node.js process. Because vm2 is frequently used to evaluate untrusted user-supplied JavaScript (serverless functions, template engines, online code runners), a successful escape results in full RCE with the privileges of the Node.js service. This detection surfaces both vulnerable-version presence (via package inventory / installed vm2 metadata) and runtime exploitation behavior (Node.js processes spawning shells, unexpected child process creation, network egress originating from a vm2-hosting service).
vendor: npm product: vm2 cwe: CWE-693 disclosed: Aug 17, 20269.9 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-47698 Public PoC PoC
vm2 Sandbox Breakout via Dangerous Host Proto Mutators (CVE-2026-47698)
Detects exploitation and presence of CVE-2026-47698, a critical (CVSS 9.8) sandbox escape in the vm2 Node.js library (versions <= 3.11.5). vm2 fails to fully isolate host prototype mutator methods, allowing untrusted JavaScript executed inside the sandbox to reach host objects (via __proto__ / prototype chain and dangerous proto mutators such as Object.defineProperty, Reflect, Error stack getters) and obtain a reference to the host 'process' object, leading to arbitrary code execution on the host. This detection surfaces vulnerable vm2 installs, sandbox-escape indicators in application logs, and post-exploitation child-process/command execution spawned from Node.js processes that embed vm2.
vendor: npm product: vm2 cwe: CWE-913 disclosed: Aug 17, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-64849 KEV PoC
MLflow Server-Side Request Forgery (CVE-2026-64849)
Detects exploitation of CVE-2026-64849, a critical (CVSS 9.3) unauthenticated server-side request forgery (SSRF) vulnerability in MLflow versions prior to 3.15.0. The flaw lives in MLflow's webhook delivery path: the `_validate_webhook_url` allowlist/denylist check is bypassable via unvalidated HTTP redirects and DNS rebinding, so an attacker who can register or trigger a webhook can coerce the server into issuing arbitrary HTTP/HTTPS requests. The same class of unvalidated server-side URI dereference also affects user-controlled artifact locations, model registry source paths, and proxied artifact endpoints. On cloud-hosted deployments this is commonly abused to reach the instance metadata service (IMDS, 169.254.169.254) and exfiltrate IAM credentials, or to perform full-read SSRF against internal services. A public proof-of-concept exists (exploit status: poc-public). This detection surfaces MLflow server processes and web/proxy logs where inbound requests carry attacker-controlled URIs pointing at internal, loopback, link-local, or metadata addresses, webhook registrations targeting such hosts, and outbound requests from the MLflow host to metadata/internal ranges — including redirect-driven and DNS-rebinding pivots.
vendor: MLflow, pip product: MLflow, mlflow cwe: CWE-918 disclosed: Aug 17, 20269.3 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Lwrite-up soon - CVE-2026-55584 Public PoC PoC
phpSysInfo PSI_ALLOWED IP Allowlist Bypass via Spoofed Forwarding Headers (CVE-2026-55584)
Detects exploitation of CVE-2026-55584, an authentication/authorization bypass (CWE-290) in phpSysInfo <= 3.4.5. The PSI_ALLOWED IP allowlist trusts client-supplied X-Forwarded-For, Client-IP, and related forwarding headers when deriving the requestor IP. An attacker can inject a spoofed header value matching an allowlisted address to bypass the IP restriction and access the phpSysInfo interface and its JSON/XML system information endpoints (index.php?json, xml.php) that expose host, network, sensor, and mount details. Detection focuses on inbound HTTP requests to phpSysInfo endpoints carrying suspicious or spoofed forwarding headers, particularly private/loopback allowlist values arriving from external source IPs. Fixed in v3.4.6.
vendor: composer product: phpsysinfo/phpsysinfo cwe: CWE-290 disclosed: Aug 17, 20267.5 highCVSS vector not yet publishedwrite-up soon - CVE-2025-62593 KEV
Ray Dashboard Code Injection via CSRF (CVE-2025-62593)
Detects exploitation of CVE-2025-62593, a code injection vulnerability in the Ray-Project Ray distributed compute framework. The Ray Dashboard/Jobs API accepts job submissions that execute arbitrary code on cluster nodes; combined with cross-site request forgery (CWE-352) and unsafe code injection (CWE-94), an attacker can force job submissions that run attacker-controlled Python/shell code as the Ray worker or head-node user. This detection surfaces anomalous Ray Job Submission API calls, unexpected child processes spawned from Ray worker/raylet processes, and network callbacks originating from Ray nodes. CVE-2025-62593 is listed in the CISA KEV catalog.
vendor: Ray-Project product: Ray cwe: CWE-94, CWE-352 disclosed: Aug 17, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-61447 Public PoC PoC
PraisonAI CodeAgent Unsandboxed LLM Code Execution & Secret Exfiltration (CVE-2026-61447)
Detects exploitation of CVE-2026-61447, a CVSS 10.0 flaw in the PraisonAI praisonaiagents Python package (<= 1.6.77) where CodeAgent executes LLM-generated Python code without any sandboxing. An attacker who can influence agent prompts can coerce the LLM into emitting arbitrary Python that runs in the host process context, enabling remote code execution and wholesale exfiltration of environment variables (API keys, cloud credentials, DB secrets). This detection surfaces vulnerable package versions, the Python interpreter spawning suspicious child processes or network connections from an agent runtime, and telemetry consistent with environment-secret harvesting (os.environ dumps, reads of .env, outbound exfil).
vendor: pip product: praisonaiagents cwe: CWE-94, CWE-200 disclosed: Aug 11, 202610.0 criticalCVSS 10.0write-up soon - CVE-2026-20349 KEV
Cisco ASA/FTD VPN Web Services Heap Inspection DoS (CVE-2026-20349)
Detects exploitation attempts and impact indicators for CVE-2026-20349, a heap inspection vulnerability (CWE-244) in the VPN web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). An unauthenticated remote attacker can send crafted HTTPS requests to the SSL VPN/WebVPN interface to exhaust heap memory and force a device reload, causing denial of service. This CVE is on the CISA KEV list. Detection focuses on ASA/FTD syslog reload/traceback events, WebVPN service crashes, and anomalous volumes of unauthenticated SSL VPN handshake activity against the management/VPN interface.
vendor: Cisco product: Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) cwe: CWE-244 disclosed: Aug 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-68820 KEV
CVE-2026-68820: Windows Ancillary Function Driver for WinSock (afd.sys) Use-After-Free Privilege Escalation
Detects exploitation activity targeting CVE-2026-68820, a use-after-free (CWE-416) vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys). This kernel-mode driver flaw allows a local attacker to elevate privileges to SYSTEM by corrupting kernel memory through crafted socket IOCTL sequences. The CVE is on the CISA KEV catalog (active in-the-wild exploitation). Detection focuses on the post-exploitation footprint: unusual child processes or token manipulation originating from low-integrity processes, abnormal afd.sys / socket driver interactions, kernel crash (BSOD 0x139/0xC2) signals from failed exploit attempts, and privilege-escalation behavioral chains, since the memory-corruption primitive itself is not directly logged.
vendor: Microsoft product: Windows Ancillary Function Driver for WinSock cwe: CWE-416 disclosed: Aug 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-72898 KEV
Metabase SQL Injection Exploitation (CVE-2026-72898)
Detects exploitation attempts and successful exploitation of CVE-2026-72898, a SQL injection vulnerability (CWE-89) in Metabase. Attackers inject malicious SQL through crafted parameters in Metabase query/API endpoints, enabling unauthorized data access, credential theft from the application database, and potential remote code execution via database features. This CVE is on the CISA KEV catalog (BOD 26-04), indicating confirmed in-the-wild exploitation. Detection focuses on anomalous SQL syntax in HTTP request parameters to Metabase endpoints, error-based/blind injection patterns, and unusual database query behavior originating from the Metabase service account.
vendor: Metabase product: Metabase cwe: CWE-89 disclosed: Aug 11, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-28672 Public PoC PoC
Apache Ranger Command Injection (CVE-2026-28672)
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-28672, a critical (CVSS 9.8) OS command injection vulnerability (CWE-77) in Apache Ranger versions >= 0.6.0 and <= 2.8.0. An attacker able to reach the Ranger Admin service or its policy/condition evaluation surface can inject shell metacharacters that are passed to an OS command execution context, achieving remote code execution as the Ranger service account. Detection focuses on the Ranger Admin/Java process (ranger-admin, EmbeddedServer) spawning shell interpreters or command-injection payload patterns in Ranger HTTP request logs.
vendor: maven product: org.apache.ranger:ranger cwe: CWE-77 disclosed: Aug 10, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-63223 Public PoC PoC
CVE-2026-63223: CodeIgniter4 File Upload Extension Validation Bypass (is_image / mime_in)
Detects exploitation of CVE-2026-63223, a critical (CVSS 9.8, CWE-434) unrestricted file upload vulnerability in the CodeIgniter4 framework (codeigniter4/framework < 4.7.4). The `is_image` and `mime_in` validation rules trust the client-supplied MIME type and file extension rather than authoritatively inspecting file content, allowing an attacker to bypass upload restrictions by crafting a request whose declared Content-Type/extension passes validation while the underlying content is executable (e.g. a PHP webshell disguised as an image). Successful exploitation typically results in webshell deployment and remote code execution. This detection surfaces suspicious uploads reaching CodeIgniter upload endpoints followed by writes of executable script files into web-accessible directories and subsequent execution.
vendor: composer product: codeigniter4/framework cwe: CWE-434 disclosed: Aug 7, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-8037 KEV
Progress LoadMaster Command Injection (CVE-2026-8037)
Detects exploitation attempts and successful command injection against Progress LoadMaster load balancers via CVE-2026-8037. The vulnerability (CWE-77) allows an unauthenticated remote attacker to inject arbitrary OS commands through the LoadMaster management interface (WUI/API), leading to remote code execution as the underlying service account. This detection surfaces anomalous management-interface requests containing shell metacharacters, unexpected child processes spawned by LoadMaster web/API services, and outbound connections initiated by the appliance following suspicious API access. CVE-2026-8037 is listed in CISA KEV and is being actively exploited in the wild (BOD 26-04 applies).
vendor: Progress product: LoadMaster cwe: CWE-77 disclosed: Aug 7, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-63077 KEV
JetBrains TeamCity Unauthenticated Deserialization of Untrusted Data (CVE-2026-63077)
Detects exploitation attempts against JetBrains TeamCity server targeting CWE-502 (Deserialization of Untrusted Data), CVE-2026-63077. This vulnerability is listed in CISA KEV and allows an unauthenticated or low-privileged attacker to submit crafted serialized objects to TeamCity server endpoints, resulting in remote code execution under the context of the TeamCity server process. Detection focuses on anomalous TeamCity server process spawning (java.exe/java spawning cmd/powershell/sh), suspicious agent-push/plugin upload artifacts, malformed or oversized serialized payloads in HTTP requests to TeamCity API/agent endpoints, and post-exploitation indicators such as new admin token creation, new build agent registration from unexpected hosts, or writes to the TeamCity plugins directory outside of normal deployment windows.
vendor: JetBrains product: TeamCity cwe: CWE-502 disclosed: Aug 5, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-18556 KEV
N-able N-central Authentication Bypass via Alternate Path or Channel (CVE-2026-18556)
Detects exploitation attempts of CVE-2026-18556, an authentication bypass using an alternate path or channel (CWE-288) affecting N-able N-central. The vulnerability allows an attacker to reach protected N-central functionality or APIs through an alternate path that does not enforce the same authentication controls as the primary login flow, enabling unauthorized administrative access to the RMM platform. This CVE is listed in CISA KEV as actively exploited. Detections focus on anomalous authentication patterns, direct access to administrative or agent-management endpoints without a preceding authenticated session, unexpected session/token creation, and post-exploitation activity such as new admin account creation or agent deployment from the N-central server.
vendor: N-able product: N-central cwe: CWE-288 disclosed: Aug 4, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-34486 KEV
Apache Tomcat Missing Encryption of Sensitive Data (CVE-2026-34486)
Detects potential exploitation or exposure conditions related to CVE-2026-34486, an Apache Tomcat vulnerability (CWE-311: Missing Encryption of Sensitive Data) allowing sensitive data such as credentials, session identifiers, or configuration secrets to be transmitted or stored without adequate encryption. Actively exploited and listed in CISA KEV; associated with CISA BOD 26-04 prioritized remediation guidance. Detection focuses on plaintext transmission of Tomcat-managed credentials/session tokens over unencrypted channels, anomalous access to Tomcat configuration files (server.xml, context.xml, tomcat-users.xml, web.xml) containing sensitive data, and network indicators of cleartext protocol usage to Tomcat listener ports.
vendor: Apache product: Tomcat cwe: CWE-311 disclosed: Aug 4, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-9198 KEV
IBM Langflow Code Injection Exploitation (CVE-2026-9198)
Detects exploitation attempts against IBM Langflow instances vulnerable to CVE-2026-9198, a code injection vulnerability (CWE-94) that allows unauthenticated or authenticated attackers to execute arbitrary code via crafted requests to Langflow's component/flow execution API. This vulnerability is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on anomalous process execution spawned by the Langflow application, suspicious payloads to Langflow API endpoints, and post-exploitation indicators such as reverse shells, credential harvesting, or outbound C2 connections originating from Langflow hosts.
vendor: IBM product: Langflow cwe: CWE-94 disclosed: Aug 4, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-69240 Public PoC PoC
Sequelize SQL Injection via Oracle Dialect (CVE-2026-69240)
Detects exploitation and presence of CVE-2026-69240, a critical SQL injection vulnerability (CWE-89, CVSS 9.8) in the Sequelize ORM (npm package 'sequelize') affecting versions < 6.37.4 when using the Oracle database dialect. Improper neutralization of special elements in queries allows an attacker to inject arbitrary SQL through crafted input reaching Sequelize query-building methods, leading to unauthorized data access, modification, or authentication bypass against the backing Oracle database. A public proof-of-concept exists (GHSA-v8fg-2rw7-q452). This detection surfaces both vulnerable-version indicators (installed package metadata, package.json/lockfile entries) and runtime SQL injection attack patterns against Node.js applications using Sequelize with Oracle.
vendor: npm product: sequelize cwe: CWE-89 disclosed: Aug 3, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-18577 KEV
N-able N-central Authentication Bypass via Alternate Path/Channel (CVE-2026-18577)
Detects exploitation attempts and successful exploitation of CVE-2026-18577, an authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affecting N-able N-central RMM/MSP management platform. This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited in the wild to gain unauthorized administrative access to N-central instances, which manage endpoints across MSP customer environments. Successful exploitation can lead to full takeover of the RMM console and downstream compromise of all managed endpoints. Vendor released N-central 2026.3 Hotfix 1 as mitigation on 2026-08-02.
vendor: N-able product: N-central cwe: CWE-288 disclosed: Aug 3, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-52887 Public PoC PoC
NocoBase myInAppChannels:list SQL Injection to PostgreSQL Superuser RCE (CVE-2026-52887)
CVE-2026-52887 is a critical (CVSS 10.0) SQL injection vulnerability in the @nocobase/plugin-notification-in-app-message plugin's /api/myInAppChannels:list endpoint filter parameter, affecting NocoBase versions <= 2.0.60. An unauthenticated or low-privileged attacker can inject arbitrary SQL through the filter query parameter, which is passed insufficiently sanitized into the underlying Sequelize/PostgreSQL query builder. Because NocoBase's database connection frequently runs with elevated (superuser) PostgreSQL privileges to support its dynamic schema/collection features, successful injection can be escalated via COPY ... TO/FROM PROGRAM or dblink/plpythonu extensions to achieve full remote code execution on the database host. Patched in v2.0.61 (PR #9630, commit 68d64e3).
vendor: npm product: @nocobase/plugin-notification-in-app-message cwe: CWE-89 disclosed: Jul 31, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-52855 Public PoC PoC
Pterodactyl Wings Egg Configuration-File Templating Node Secret Exposure (CVE-2026-52855)
Detects exploitation of CVE-2026-52855, a critical (CVSS 9.9) information disclosure vulnerability in Pterodactyl Wings prior to 1.12.3. The Wings daemon's egg configuration-file templating engine fails to properly scope variable substitution, allowing a malicious or crafted egg/server configuration to reference and render node-level secrets (e.g., the Wings daemon token, SFTP credentials, Docker/panel authentication secrets) into server-accessible configuration files. An attacker with the ability to create or modify an egg (via panel admin compromise, supply-chain egg import, or a malicious server owner in multi-tenant environments) can exfiltrate node configuration secrets, leading to full node takeover. Detection focuses on Wings daemon logs showing configuration-file template rendering events that reference sensitive node config keys, unexpected egg install/import activity, and outbound access to rendered server config files containing daemon secrets.
vendor: go product: github.com/pterodactyl/wings cwe: CWE-200, CWE-522 disclosed: Jul 31, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-67429 Public PoC PoC
Flyto2 Core Arbitrary File Write via image.download Path Traversal (CVE-2026-67429)
Detects exploitation of CVE-2026-67429, a critical (CVSS 10.0) arbitrary file write vulnerability in Flyto2 Core (pip package flyto-core) versions prior to 2.26.7. The image.download module and other file-writing modules fail to sanitize user-supplied filenames/paths (CWE-22 path traversal, CWE-73 external control of file name or path), allowing an unauthenticated or low-privileged attacker to write arbitrary files anywhere on the filesystem reachable by the flyto-core process. This can be leveraged to overwrite application code, cron files, SSH authorized_keys, systemd unit files, or web-accessible directories to achieve remote code execution. Detection focuses on identifying path traversal sequences and absolute/unexpected path targets passed to flyto-core's image.download and related file-writing endpoints, as well as downstream evidence such as newly written files in sensitive directories immediately following flyto-core process activity.
vendor: pip product: flyto-core cwe: CWE-22, CWE-73 disclosed: Jul 30, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54735 Public PoC PoC
Prebid Server SSRF via Request Forgery (CVE-2026-54735)
Detects exploitation of CVE-2026-54735, a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in prebid/prebid-server affecting versions < 4.4.0, <= 3.30.0, <= 2.32.0, and <= 0.275.0. The flaw (CWE-918) allows an attacker to craft bid request or adapter/URL parameters that cause the prebid-server host to issue outbound requests to attacker-controlled or internal/cloud-metadata endpoints, potentially exfiltrating host environment data (cloud metadata credentials, internal service responses). Detection focuses on anomalous outbound HTTP requests originating from prebid-server processes/containers to internal RFC1918 ranges, loopback, link-local cloud metadata IPs (169.254.169.254), or unexpected external hosts triggered by bid/adapter request handling.
vendor: go product: github.com/prebid/prebid-server/v4, github.com/prebid/prebid-server/v3… cwe: CWE-918 disclosed: Jul 29, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54680 Public PoC PoC
Kube-logging Logging Operator Fluentd Configuration Injection RCE (CVE-2026-54680)
Detects exploitation of CVE-2026-54680, a critical (CVSS 9.9) configuration injection vulnerability in kube-logging logging-operator (versions prior to the 0.0.0-20260608145523-cf437d7f1e05 pseudo-version / 6.6.0 release) that allows an attacker with the ability to influence Fluentd/Fluent Bit configuration inputs (e.g. via Flow/ClusterFlow/Output CRDs, log forwarding pipelines, or unsanitized log fields reflected into config templates) to inject arbitrary Fluentd configuration directives. This injection can lead to remote code execution via Fluentd's exec plugin, ruby code blocks, or file-based output writes, potentially compromising the logging-operator pod and any Kubernetes service account/token it holds, enabling lateral movement and cluster compromise.
vendor: go product: github.com/kube-logging/logging-operator cwe: CWE-74, CWE-77 disclosed: Jul 29, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-20316 KEV
Cisco Secure Firewall Management Center Hard-coded Credential Exploitation (CVE-2026-20316)
Detects exploitation attempts and successful authentication against Cisco Secure Firewall Management Center (FMC) using an undocumented, hard-coded static credential (CVE-2026-20316, CWE-259). This flaw is listed in CISA KEV and has been exploited in zero-day attacks per Cisco and public reporting. Detection focuses on FMC authentication logs, management-interface access from unexpected sources, and post-authentication administrative actions consistent with abuse of a built-in account.
vendor: Cisco product: Secure Firewall Management Center (FMC) cwe: CWE-259 disclosed: Jul 29, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-54658 Public PoC PoC
CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping
@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability (CWE-89) in their parameter escaping logic, allowing an attacker who controls query parameter input to inject arbitrary ClickHouse SQL. Successful exploitation permits unauthorized data disclosure, modification, or execution of arbitrary SQL statements against the backing ClickHouse database. CVSS 9.8. A public PoC/advisory exists (GHSA-6wcc-39rp-hh9p). Detections target anomalous ClickHouse query patterns (union-based, stacked queries, system table access, sleep/benchmark-based blind injection) originating from application service accounts using the hypequery client, as well as npm dependency footprint indicating vulnerable package versions.
vendor: npm product: @hypequery/clickhouse cwe: CWE-89 disclosed: Jul 28, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2025-68686 KEV
Fortinet FortiOS Sensitive Information Exposure (CVE-2025-68686)
CVE-2025-68686 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability (CWE-200) in Fortinet FortiOS, added to CISA's Known Exploited Vulnerabilities catalog. Unauthorized actors may be able to access sensitive information exposed by affected FortiOS instances, potentially including configuration data, credentials, session tokens, or internal system details that could facilitate further compromise. This detection focuses on identifying anomalous access to FortiOS management interfaces, unusual API/CLI enumeration behavior, and downstream indicators of information disclosure abuse such as suspicious authentication following reconnaissance against exposed FortiOS endpoints.
vendor: Fortinet product: FortiOS cwe: CWE-200 disclosed: Jul 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-16812 KEV
Arista VeloCloud Orchestrator On-Prem OS Command Injection (CVE-2026-16812)
Detects exploitation attempts and post-exploitation indicators of CVE-2026-16812, an OS command injection vulnerability (CWE-78) in Arista VeloCloud Orchestrator On-Prem, actively exploited in the wild and listed on CISA KEV. Attackers send crafted HTTP requests to the Orchestrator management application that result in arbitrary OS command execution on the underlying host, typically leading to shell spawning, reverse shell callbacks, credential harvesting, or webshell deployment.
vendor: Arista product: VeloCloud Orchestrator cwe: CWE-78 disclosed: Jul 27, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-59940 Public PoC PoC
seroval fromJSON Prototype/Type Confusion Insecure Deserialization (CVE-2026-59940)
Detects exploitation attempts and post-exploitation indicators of CVE-2026-59940, a critical (CVSS 9.8) insecure deserialization vulnerability in the npm 'seroval' library (<= 1.5.2). seroval.fromJSON() suffers from a Promise resolver type confusion (CWE-843) that allows an attacker who controls serialized input to trigger invocation of attacker-controlled methods/objects during deserialization (CWE-502), leading to arbitrary code execution in Node.js server processes or browser contexts that deserialize untrusted seroval payloads (e.g., via solid-js/start, tRPC-like RSC transports, or other frameworks using seroval for server-to-client data hydration). Detection focuses on anomalous Node.js child process spawning, unexpected outbound network connections, and web application error/crash signatures correlated with requests carrying serialized seroval payloads (identifiable by characteristic JSON structures such as tagged arrays with $R, $Map, $Set, or Promise resolver markers) targeting endpoints that perform server-side rendering or RPC deserialization.
vendor: npm product: seroval cwe: CWE-502, CWE-843 disclosed: Jul 24, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-62379 Public PoC PoC
OpenAM Unauthenticated RCE via Class.forName in AuthXMLUtils.createCustomCallback (CVE-2026-62379)
OpenAM (org.openidentityplatform.openam:openam-core) versions <= 16.1.1 are vulnerable to unauthenticated remote code execution. The XML-based authentication callback handler AuthXMLUtils.createCustomCallback passes attacker-controlled class names from the authentication request XML directly into Class.forName() and subsequently instantiates the resolved class, allowing an unauthenticated attacker to load and instantiate arbitrary classes on the classpath (CWE-470 Unsafe Reflection) leading to RCE, and reflecting CWE-94 Code Injection. Exploitation requires no authentication and only network access to the OpenAM authentication XML endpoint. A public PoC/advisory exists (GHSA-wg5r-wc3x-39vc). Fixed in OpenAM 16.1.2.
vendor: maven product: org.openidentityplatform.openam:openam-core cwe: CWE-94, CWE-470 disclosed: Jul 24, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-16232 KEV
Check Point SmartConsole Improper Authentication (CVE-2026-16232)
Detects exploitation attempts and indicators of the CVE-2026-16232 Improper Authentication vulnerability (CWE-287) in Check Point SmartConsole management client/server communications, added to CISA KEV. Attackers exploiting this flaw can bypass authentication checks to gain unauthorized access to SmartConsole management sessions, potentially allowing manipulation of security policy, log access, or lateral movement into the management plane.
vendor: Check Point product: SmartConsole cwe: CWE-287 disclosed: Jul 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-50522 KEV
Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522)
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
vendor: Microsoft product: SharePoint cwe: CWE-502 disclosed: Jul 22, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-20896 Public PoC PoC
Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896)
The official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to * by default. Because Gitea's reverse-proxy authentication feature trusts the X-WEBAUTH-USER header from any source claiming to be a trusted proxy, an unauthenticated attacker with direct network access to the Gitea HTTP listener (bypassing any intended reverse proxy) can set this header to impersonate any username, including admin accounts, and obtain a fully authenticated session without credentials. Affects code.gitea.io/gitea < 1.26.3. This detection identifies HTTP requests to Gitea that carry X-WEBAUTH-USER (or similar reverse-proxy auth headers) originating from IP addresses outside the expected reverse-proxy/load-balancer CIDR, as well as anomalous successful authentications tied to reverse-proxy auth with no corresponding upstream proxy log entry.
vendor: go product: code.gitea.io/gitea cwe: CWE-284 disclosed: Jul 21, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-22874 Public PoC PoC
Gitea Incomplete SSRF Allow-list Bypass in Webhooks and Migrations (CVE-2026-22874)
Detects exploitation attempts against CVE-2026-22874, an incomplete SSRF protection in Gitea's webhook and repository-migration allow-list default filter (CWE-918). Gitea versions < 1.26.3 failed to fully validate outbound targets for webhook deliveries and remote migrations, allowing an authenticated (or in some misconfigurations, low-privileged) attacker to coerce the Gitea server into making requests to internal/private hosts, loopback, link-local metadata endpoints (e.g. 169.254.169.254), or otherwise-restricted network services. Detection focuses on Gitea server-originated outbound HTTP requests to internal/metadata/loopback destinations, suspicious webhook/migration configuration referencing private targets, and Gitea process network connections that deviate from expected git/API traffic.
vendor: go product: code.gitea.io/gitea cwe: CWE-918 disclosed: Jul 21, 20269.6 criticalCVSS vector not yet publishedwrite-up soon - CVE-2021-27137 KEV
DD-WRT Stack-Based Buffer Overflow Exploitation Attempt (CVE-2021-27137)
Detects exploitation attempts against a stack-based buffer overflow vulnerability (CWE-121) in DD-WRT firmware. The flaw allows an attacker with network access to the DD-WRT web management interface to trigger a stack overflow via crafted HTTP requests, potentially leading to remote code execution or denial of service on the router/embedded device. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Detection focuses on abnormal HTTP requests to DD-WRT management interfaces (oversized parameters, malformed CGI requests), unexpected crash/restart of httpd or DD-WRT management processes, and post-exploitation network behavior originating from embedded/IoT network segments.
vendor: DD-WRT product: DD-WRT cwe: CWE-121 disclosed: Jul 21, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-60137 KEV
WordPress Core SQL Injection Exploitation (CVE-2026-60137)
Detects exploitation attempts and successful exploitation of CVE-2026-60137, a SQL injection vulnerability (CWE-89) in WordPress Core affecting unauthenticated or authenticated request handling. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild. Exploitation typically manifests as anomalous SQL syntax in HTTP request parameters targeting WordPress endpoints (wp-admin, wp-json REST API, xmlrpc.php, plugin/theme AJAX handlers), followed by unusual database error responses, data exfiltration patterns, or subsequent webshell/backdoor deployment. WordPress 7.0.2 remediates this issue; unpatched sites remain at critical risk per CISA BOD 26-04 prioritization guidance.
vendor: WordPress product: Core cwe: CWE-89 disclosed: Jul 21, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-63030 KEV
WordPress Core Interpretation Conflict Vulnerability (CVE-2026-63030)
WordPress Core contains an interpretation conflict vulnerability (CWE-436) fixed in WordPress 7.0.2, in which differing parsing/interpretation behavior between components of the request-handling pipeline (e.g., PHP, web server, and WordPress core routing/sanitization layers) allows an attacker to smuggle or disguise malicious input so it is treated differently downstream than upstream validation expected. This class of flaw is commonly abused to bypass input filtering, achieve request smuggling-style effects against reverse proxies/CDNs fronting WordPress, or slip malicious payloads (e.g., leading to file write, privilege escalation, or authentication bypass) past security controls that assume a single canonical interpretation of the request. The vulnerability is listed in CISA KEV, indicating confirmed active exploitation in the wild, and is subject to CISA BOD 26-04 remediation timelines for federal and high-risk entities. No CVSS score has been published at time of writing; PoC details are not publicly available, but active exploitation implies working exploit code exists among threat actors. Detection focuses on anomalous WordPress core request patterns consistent with interpretation-conflict abuse: malformed/duplicate headers, ambiguous content-length/transfer-encoding combinations, unusual URL encoding or path traversal-like sequences hitting wp-admin/wp-login/wp-json endpoints, and post-exploitation indicators such as new admin users, unexpected plugin/theme file writes, or webshell drops shortly after anomalous requests.
vendor: WordPress product: Core cwe: CWE-436 disclosed: Jul 21, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-55579 Public PoC PoC
Pheditor Hardcoded Default Administrator Credential Exploitation (CVE-2026-55579)
Detects authentication and post-authentication activity consistent with exploitation of CVE-2026-55579, a hardcoded default password ('admin') in Pheditor (composer package pheditor/pheditor) versions >= 2.0.1 and < 2.0.6. The vulnerability (CWE-798) allows any unauthenticated attacker with network access to the application to log in using the well-known default credential and achieve full application compromise, since the application does not force a password change on first login. Detection logic focuses on successful logins using the literal 'admin' credential pair, rapid login attempts against the default account, and suspicious follow-on activity (admin panel access, plugin/file upload, config changes) shortly after such a login.
vendor: composer product: pheditor/pheditor cwe: CWE-798 disclosed: Jul 16, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-25089 KEV
Fortinet FortiSandbox OS Command Injection (CVE-2026-25089)
Detects potential exploitation of CVE-2026-25089, an OS command injection vulnerability (CWE-78) in Fortinet FortiSandbox that allows an authenticated or remote attacker to execute arbitrary commands on the underlying operating system via crafted input to a vulnerable API/web endpoint. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is subject to BOD 26-04 prioritized remediation timelines. Detection focuses on anomalous shell/process execution spawned from FortiSandbox web/management processes, suspicious HTTP requests containing shell metacharacters against FortiSandbox management interfaces, and post-exploitation command execution artifacts.
vendor: Fortinet product: FortiSandbox cwe: CWE-78 disclosed: Jul 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-39808 KEV
Fortinet FortiSandbox OS Command Injection (CVE-2026-39808)
Detects potential exploitation of CVE-2026-39808, an OS command injection vulnerability (CWE-78) in Fortinet FortiSandbox that allows an authenticated or unauthenticated attacker to execute arbitrary OS commands via crafted requests to the FortiSandbox management interface. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on anomalous shell/command execution patterns originating from FortiSandbox processes, suspicious HTTP requests to the management interface containing shell metacharacters, and unexpected child processes spawned by FortiSandbox web/API services observed via syslog, proxy, or EDR telemetry on adjacent/monitoring hosts.
vendor: Fortinet product: FortiSandbox cwe: CWE-78 disclosed: Jul 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-58644 KEV
Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644)
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Successful exploitation typically results in remote code execution via crafted serialized payloads submitted to vulnerable SharePoint endpoints (e.g. ViewState, application pages, or REST/SOAP endpoints), often followed by w3wp.exe spawning abnormal child processes, webshell drops into SharePoint application directories, and LSASS/credential access activity.
vendor: Microsoft product: SharePoint cwe: CWE-502 disclosed: Jul 16, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2023-4346 KEV
KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout (CVE-2023-4346)
Detects potential exploitation of CVE-2023-4346, an overly restrictive account lockout mechanism (CWE-645) in the KNX Association's KNX Protocol Connection Authorization Option 1 used in KNX building automation / ICS environments. The flaw allows an attacker to repeatedly attempt authorization against a KNX secure connection without being effectively locked out, enabling brute-force guessing of the connection authorization key/password used to gate access to building automation devices (HVAC, lighting, access control, alarm systems). This CVE is listed in CISA KEV and is subject to BOD 26-04 prioritized remediation timelines. Detection relies on identifying repeated failed KNX/IP secure authorization attempts from a single source against a KNX interface/gateway, or repeated connection requests bypassing expected lockout thresholds, observed via network telemetry, firewall/IDS logs, or KNXnet/IP gateway logs.
vendor: KNX Association product: KNX Protocol Connection Authorization Option 1 cwe: CWE-645 disclosed: Jul 15, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-46817 KEV
Oracle E-Business Suite Improper Privilege Management Exploitation (CVE-2026-46817)
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite (CWE-269, CWE-287, CWE-306) that allows unauthenticated or low-privileged actors to escalate privileges or bypass authentication controls on EBS application and concurrent manager components. This vulnerability is listed in CISA KEV and is subject to BOD 26-04 remediation timelines. Detection focuses on anomalous authentication bypass patterns, privilege escalation to APPS/SYSADMIN roles, unexpected concurrent manager job submissions, and suspicious HTTP requests to EBS servlet endpoints associated with known exploitation chains.
vendor: Oracle product: E-Business Suite cwe: CWE-269, CWE-287 disclosed: Jul 15, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-45262 Public PoC PoC
FacturaScripts REST API Authenticated SQL Injection via Where::sqlColumn Parenthesis Bypass (CVE-2026-45262)
FacturaScripts prior to and including version 2026.1 contains an authenticated SQL injection vulnerability in the REST API 'filter' parameter. The Where::sqlColumn method fails to properly sanitize column/operator tokens when parentheses are used to bypass filter validation, allowing an authenticated low-privileged API user (with a valid API key) to inject arbitrary SQL via crafted filter[field][operator] query string parameters. Given CVSS 9.9 and CWE-918 (SSRF) alongside CWE-89, exploitation may extend beyond data exfiltration into internal request forgery via database-level functions (e.g., LOAD_FILE, or DB-driver network calls), enabling full compromise of the underlying MySQL/MariaDB/PostgreSQL instance and lateral movement into internal network segments reachable from the database host.
vendor: composer product: facturascripts/facturascripts cwe: CWE-89, CWE-918 disclosed: Jul 14, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54052 Public PoC PoC
n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052)
Detects exploitation of CVE-2026-54052, an authorization bypass (CWE-639/CWE-862) in n8n-mcp <= 2.56.0 HTTP multi-tenant deployments allowing cross-tenant access to workflow version backups. Attackers manipulate tenant/workflow identifiers in backup retrieval requests to read another tenant's stored workflow versions, which may contain embedded credentials, API keys, and webhook secrets.
vendor: npm product: n8n-mcp cwe: CWE-639, CWE-862 disclosed: Jul 14, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-15409 KEV
SonicWall SMA1000 Server-Side Request Forgery Exploitation (CVE-2026-15409)
Detects exploitation attempts and successful compromise indicators for CVE-2026-15409, a Server-Side Request Forgery (CWE-918) vulnerability in SonicWall SMA1000 Appliances. The vulnerability allows an unauthenticated or low-privileged attacker to coerce the SMA1000 appliance into issuing arbitrary HTTP/HTTPS requests to internal-only or cloud metadata endpoints, potentially disclosing credentials, tokens, or internal network topology, and enabling pivoting into segmented networks. This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is subject to CISA BOD 26-04 prioritized remediation timelines. Detection focuses on outbound requests originating from the SMA1000 management/proxy processes to loopback addresses, RFC1918 ranges the appliance should not otherwise reach, cloud metadata IPs (169.254.169.254), and anomalous internal service ports, correlated with SMA1000 web/application logs.
vendor: SonicWall product: SMA1000 Appliances cwe: CWE-918 disclosed: Jul 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-15410 KEV
SonicWall SMA1000 Code Injection Exploitation (CVE-2026-15410)
Detects exploitation attempts against SonicWall SMA1000 appliances leveraging an OS/code injection vulnerability (CWE-94) that allows an authenticated or unauthenticated remote attacker to execute arbitrary code on the appliance. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on SMA1000 web management/AMC interface access, anomalous process spawning from SMA1000 web/application service accounts, and post-exploitation artifacts such as webshells, reverse shells, or configuration tampering.
vendor: SonicWall product: SMA1000 Appliances cwe: CWE-94 disclosed: Jul 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-56155 KEV
Microsoft AD FS Insufficient Access Control Granularity Exploitation (CVE-2026-56155)
Detects exploitation activity targeting CVE-2026-56155, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Active Directory Federation Services (AD FS). Actively exploited (CISA KEV). The flaw allows an authenticated actor with limited privileges to obtain access to federated resources or claims beyond their intended scope due to coarse-grained authorization decisions in the AD FS relying party trust / claims pipeline, potentially enabling federation token issuance for unauthorized applications or privilege escalation across trusted relying parties. Detection focuses on anomalous AD FS token issuance patterns, unexpected relying party trust access, claims rule modification, and AD FS admin/service account activity outside baseline behavior.
vendor: Microsoft product: Active Directory Federation Services cwe: CWE-1220 disclosed: Jul 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-56164 KEV
Microsoft SharePoint Server Missing Authentication for Critical Function (CVE-2026-56164)
Detects exploitation attempts against CVE-2026-56164, a Missing Authentication for Critical Function vulnerability (CWE-306) in Microsoft SharePoint Server that allows unauthenticated attackers to invoke sensitive server-side functionality without prior credentials. This flaw is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed in-the-wild exploitation. Attackers typically abuse this by sending crafted HTTP requests directly to internal SharePoint API/service endpoints that fail to enforce authentication checks, potentially leading to remote code execution, data exfiltration, or the deployment of webshells (consistent with prior SharePoint ToolShell-style campaigns). This detection focuses on identifying anonymous or unauthenticated access to sensitive SharePoint endpoints, unusual IIS worker process child processes, and webshell-drop indicators following unauthenticated requests.
vendor: Microsoft product: SharePoint Server cwe: CWE-306 disclosed: Jul 14, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-45579 Public PoC PoC
DIRAC RequestManager eval() Remote Code Execution (CVE-2026-45579)
Detects exploitation attempts and successful compromise of DIRAC's RequestManager component via CVE-2026-45579, a CWE-95 (Eval Injection) vulnerability where untrusted RPC input passed to RequestManager is evaluated via Python's eval() function, resulting in unauthenticated or low-privilege remote code execution. Affected DIRAC (pip package) versions are >=6,<8.0.79, >=8.1.0a1,<9.0.22, and >=9.1.0,<9.1.10. A public PoC exists (GHSA-9jpv-c7p4-997x). Detection focuses on anomalous eval-triggering payloads sent to DIRAC RequestManager RPC/DISET endpoints, resulting child process spawns from DIRAC service processes, and post-exploitation artifacts consistent with grid/HPC computing infrastructure compromise.
vendor: pip product: DIRAC cwe: CWE-95 disclosed: Jul 13, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-61667 Public PoC PoC
DIRAC FileCatalog DatasetManager SQL Injection to RCE (CVE-2026-61667)
Detects exploitation attempts against DIRAC's FileCatalog DatasetManager component, where a SQL injection vulnerability (CWE-89) can be chained with unsafe eval() usage (CWE-95) to achieve remote code execution. Affects DIRAC versions >=6,<8.0.79; >=8.1.0a1,<9.0.22; >=9.1.0,<9.1.10. A public PoC exists (GHSA-m4m7-4cw8-62j6). Detection focuses on anomalous SQL error signatures, injection payload patterns in DatasetManager RPC calls, and subsequent process spawning from the DIRAC service process indicative of successful eval()-based code execution.
vendor: pip product: DIRAC cwe: CWE-89, CWE-95 disclosed: Jul 13, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54159 Public PoC PoC
PrestaShop ps_facetedsearch PHP Object Injection Leading to Unauthenticated RCE (CVE-2026-54159)
CVE-2026-54159 is a critical (CVSS 10.0) PHP Object Injection vulnerability (CWE-74) in the PrestaShop ps_facetedsearch module (versions >=3.0.0, <4.0.4). The module caches faceted-search filter state using unsafe PHP deserialization of user-controllable input, allowing an unauthenticated attacker to submit a crafted serialized payload that instantiates gadget-chain objects, ultimately leading to arbitrary PHP code execution on the storefront web server. Exploitation requires no authentication and no user interaction, and a public PoC exists (GHSA-m5f5-28qr-9g9r).
vendor: composer product: prestashop/ps_facetedsearch cwe: CWE-74 disclosed: Jul 10, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-50551 Public PoC PoC
SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551)
Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-79 disclosed: Jul 10, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54067 Public PoC PoC
SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067)
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-79, CWE-1188 disclosed: Jul 10, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54158 Public PoC PoC
SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158)
SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-79, CWE-1188 disclosed: Jul 10, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-61459 Public PoC PoC
mcp-server-kubernetes Argument Injection Exposing Cluster Credentials (CVE-2026-61459)
Detects exploitation of CVE-2026-61459, an argument injection vulnerability (CWE-88) in the mcp-server-kubernetes MCP server prior to version 3.9.0. Attacker-controlled input passed through the server's structured kubectl tools is not properly separated from kubectl command-line arguments, allowing injection of additional flags (e.g. --kubeconfig, --token, --server, or exec/run overrides) that can leak Kubernetes cluster credentials or execute arbitrary kubectl operations. Because the MCP server typically runs with a service account or admin kubeconfig, successful exploitation can expose the full cluster credential set. This detection looks for kubectl process executions with injected/anomalous argument patterns originating from the MCP server process, and for suspicious credential-exposing kubectl invocations.
vendor: pip product: mcp-server-kubernetes cwe: CWE-88 disclosed: Jul 10, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48939 KEV
iCagenda Unrestricted File Upload Exploitation (CVE-2026-48939)
Detects exploitation attempts against CVE-2026-48939, an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the iCagenda Joomla component. Attackers abuse insufficient file-type validation in iCagenda's upload handlers (event image/attachment upload endpoints) to upload web shells or other executable content, achieving remote code execution on the underlying web server. This CVE is listed in CISA KEV, indicating confirmed active exploitation and mandated remediation under BOD 26-04.
vendor: iCagenda product: iCagenda cwe: CWE-434 disclosed: Jul 10, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-56291 KEV
Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291)
Detects exploitation attempts against CVE-2026-56291, an unrestricted upload of file with dangerous type vulnerability (CWE-434) in Balbooa Forms for Joomla. This vulnerability is listed in CISA KEV, indicating confirmed active exploitation. Attackers abuse the forms file upload functionality to upload web shells or other malicious executable content (PHP, PHTML, PHAR, etc.) bypassing extension/type restrictions, leading to remote code execution on the underlying web server.
vendor: Balbooa product: Forms cwe: CWE-434 disclosed: Jul 10, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-52778 Public PoC PoC
YesWiki Formula Calculator Unsafe eval() Remote Code Execution (CVE-2026-52778)
YesWiki prior to 4.6.6 exposes an unsafe PHP eval() call in its Formula Calculator feature (BazaR calculated field logic). An unauthenticated or low-privileged attacker can craft a malicious formula expression that is passed directly into eval(), resulting in arbitrary PHP code execution on the underlying web server, or a crafted expression that triggers resource exhaustion / infinite loops causing denial of service. Successful exploitation grants the attacker the privileges of the web server process, enabling webshell deployment, credential theft, and lateral movement.
vendor: composer product: yeswiki/yeswiki cwe: CWE-94, CWE-1333 disclosed: Jul 9, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-52831 Public PoC PoC
Nuclio Cron Trigger Header/Body Command Injection (CVE-2026-52831)
Detects exploitation of CVE-2026-52831, a critical (CVSS 10.0) command injection vulnerability in Nuclio's cron trigger handling. Unsanitized event headers and body content are injected into a CronJob-generated shell command, enabling unauthenticated attackers to achieve persistent remote code execution inside Nuclio function containers and, from there, the underlying Kubernetes node. Detection focuses on shell metacharacter injection in Nuclio dashboard/trigger logs, anomalous child processes spawned from nuclio-handler/processor binaries, and suspicious CronJob-launched shell activity in Kubernetes.
vendor: go product: github.com/nuclio/nuclio cwe: CWE-78 disclosed: Jul 8, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-53513 Public PoC PoC
CVE-2026-53513: @better-auth/sso Provider Registration SSRF via Unvalidated OIDC Endpoints
Detects exploitation of CVE-2026-53513, a server-side request forgery (SSRF) vulnerability in the @better-auth/sso npm package (>= 0.1.0, < 1.6.11). The SSO provider registration flow accepts attacker-controlled OIDC endpoint URLs (issuer, authorization, token, userinfo, JWKS, and OIDC discovery URLs) without validating the host, scheme, or resolved IP. When the server performs OIDC discovery or token/userinfo requests against these unvalidated endpoints, an attacker can coerce the application server into making requests to internal/metadata services (e.g. cloud IMDS at 169.254.169.254, localhost, RFC1918 ranges), enabling credential theft and internal reconnaissance. This detection surfaces provider-registration and OIDC callback activity where the application server originates outbound HTTP requests to internal, link-local, or metadata IP ranges shortly after an SSO provider registration or discovery event.
vendor: npm product: @better-auth/sso cwe: CWE-20, CWE-345 disclosed: Jul 7, 20269.6 criticalCVSS:3.1write-up soon - CVE-2026-48282 KEV
CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation
Detects exploitation attempts targeting CVE-2026-48282, a path traversal vulnerability (CWE-22) in Adobe ColdFusion. Active exploitation confirmed by CISA KEV listing. Attackers may use directory traversal sequences in HTTP requests to read sensitive files outside the web root, including configuration files containing credentials, or to achieve remote code execution via file write primitives.
vendor: Adobe product: ColdFusion cwe: CWE-22 disclosed: Jul 7, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-48908 KEV
CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted File Upload
Detects exploitation of CVE-2026-48908, an unrestricted file upload vulnerability (CWE-434) in JoomShaper SP Page Builder for Joomla. Attackers can upload files with dangerous types (e.g., PHP webshells) through the page builder interface, leading to remote code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: JoomShaper product: SP Page Builder cwe: CWE-434 disclosed: Jul 7, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-56290 KEV
CVE-2026-56290: Joomlack Page Builder Improper Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-56290, an improper access control vulnerability (CWE-284) in Joomlack Page Builder for Joomla. This KEV-listed vulnerability allows unauthorized access to restricted Page Builder functionality, potentially enabling content manipulation, privilege escalation, or unauthorized administrative actions on affected Joomla installations.
vendor: Joomlack product: Page Builder cwe: CWE-284 disclosed: Jul 7, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-54769 Public PoC PoC
CVE-2026-54769: Langroid TableChatAgent Sandbox Escape via eval() RCE
Detects exploitation of CVE-2026-54769, a critical sandbox escape vulnerability in Langroid's TableChatAgent component (versions <= 0.65.1). The incomplete eval() mitigation allows attackers to craft malicious inputs that escape the intended sandbox and achieve remote code execution on the host system. CVSS 10.0 with public PoC available.
vendor: pip product: langroid cwe: CWE-94 disclosed: Jul 6, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-55500 Public PoC PoC
9router (npm) Unprotected Database Import/Export Leading to Credential Theft and Database Takeover (CVE-2026-55500)
CVE-2026-55500 affects the 9router npm package (<= 0.4.71), which exposes an unauthenticated/improperly-protected database import/export interface. Attackers can invoke this exposed functionality to exfiltrate the entire application database — including credentials, session tokens, and configuration secrets — or import a malicious database to achieve full application takeover. CVSS 9.9, CWE-200 (Exposure of Sensitive Information). A public PoC/advisory exists (GHSA-qvfm-67h2-2qfx). Detections focus on anomalous HTTP requests to database export/import endpoints, bulk data egress, unauthenticated administrative API access, and post-exploitation credential misuse.
vendor: npm product: 9router cwe: CWE-200 disclosed: Jul 6, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48204 Public PoC PoC
Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204)
Detects exploitation attempts against CVE-2026-48204, a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. Affected versions (>=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0) fail to filter caller-supplied gridfs.* HTTP/Camel exchange headers before applying them to GridFS producer operations, allowing an attacker to override the intended GridFS operation (e.g. force a delete/listAll/findOne instead of the intended write) and inject NoSQL query operators into MongoDB GridFS filter queries. This can lead to unauthorized data disclosure, deletion of stored files, or NoSQL injection against the backing MongoDB metadata collection. A public PoC/advisory exists (GHSA-f7g3-2cg6-f5hj).
vendor: maven product: org.apache.camel:camel-mongodb-gridfs cwe: CWE-20 disclosed: Jul 6, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-52889 Public PoC PoC
Formie Hidden Field Default Server-Side Template Injection (CVE-2026-52889)
Detects exploitation attempts against CVE-2026-52889, a Server-Side Template Injection (SSTI, CWE-1336) vulnerability in the Formie plugin (verbb/formie) for Craft CMS. The vulnerability exists in how Formie processes 'default value' expressions for Hidden form fields, allowing an unauthenticated or low-privileged attacker to inject Twig template syntax that is evaluated server-side, potentially leading to remote code execution. Affects verbb/formie < 3.1.27. Detection focuses on Twig/Craft template injection payload patterns in form submission requests, anomalous POST bodies to Formie submission endpoints, and resulting web shell / RCE indicators (process spawning from PHP-FPM/Craft, outbound connections, file writes to web root).
vendor: composer product: verbb/formie cwe: CWE-1336 disclosed: Jul 6, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-53913 Public PoC PoC
Apache Camel camel-keycloak KeycloakSecurityPolicy Authentication Bypass (CVE-2026-53913)
Apache Camel's camel-keycloak component contains a KeycloakSecurityPolicy that improperly handles authentication (CWE-287), resulting in missing authentication for a critical function and a fail-open condition. Affected versions >=4.15.0 <4.18.3 and >=4.19.0 <4.21.0 allow requests to bypass Keycloak-enforced authentication checks on Camel routes, permitting unauthenticated access to protected endpoints/routes. CVSS 9.8, PoC public via GHSA-qvc3-6q9x-95pj.
vendor: maven product: org.apache.camel:camel-keycloak cwe: CWE-287 disclosed: Jul 6, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-9558 Public PoC PoC
Mautic Server-Side Template Injection (SSTI) in Theme Templates
Detects exploitation of CVE-2026-9558, a critical (CVSS 9.9) Server-Side Template Injection vulnerability in Mautic's theme template engine (CWE-1336, Twig-based SSTI). An authenticated or in some deployments unauthenticated attacker can inject malicious Twig template syntax through theme customization, email/landing page builder, or theme upload/import functionality, achieving remote code execution on the underlying PHP host. Affects mautic/core versions >=1.3.0 <4.4.13, >=5.0.0 <5.2.11, >=6.0.0 <6.0.9, and >=7.0.0 <7.1.2. A public PoC/advisory exists (GHSA-9fx4-7cmj-47vg).
vendor: composer product: mautic/core cwe: CWE-1336 disclosed: Jul 2, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-9559 Public PoC PoC
Mautic Campaign Import Path Traversal (CVE-2026-9559)
Detects exploitation attempts against CVE-2026-9559, a critical path traversal vulnerability (CVSS 9.9) in Mautic core's Campaign Import feature affecting versions >=7.0.0, <7.1.2. An unauthenticated or low-privileged attacker can craft a malicious campaign import file (CSV/ZIP) containing path traversal sequences (../) or archive entries that write files outside the intended import directory, potentially achieving arbitrary file write and remote code execution via webshell placement. A public PoC exists (GHSA-6r9h-4h75-7q4x). This detection identifies suspicious campaign import requests, path traversal payloads in multipart uploads, unexpected file writes outside Mautic's media/import directories, and subsequent webshell execution.
vendor: composer product: mautic/core cwe: CWE-22, CWE-73 disclosed: Jul 2, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-49352 Public PoC PoC
9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352)
Detects exploitation attempts against 9router (npm package) versions 0.2.21 through 0.4.41, which ship a hardcoded default fallback JWT signing secret (CWE-798). When an operator fails to override the default secret, an attacker can forge arbitrary JWTs (including admin/privileged claims) and bypass authentication entirely. Detection focuses on identifying JWTs signed with the known-public default secret, anomalous authentication success patterns following token forgery, and process/network indicators consistent with public PoC exploitation against 9router deployments.
vendor: npm product: 9router cwe: CWE-798 disclosed: Jul 2, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-50027 Public PoC PoC
MCP Memory Service Unauthenticated Document API Access (CVE-2026-50027)
Detects exploitation of CVE-2026-50027, a missing authentication vulnerability (CWE-306) in mcp-memory-service versions prior to 10.67.1 that allows unauthenticated attackers to read, write, and delete stored memory documents via exposed API endpoints. Successful exploitation grants full unauthenticated access to sensitive memory/document contents, enabling data exfiltration, tampering, or destruction of stored AI agent memory state.
vendor: pip product: mcp-memory-service cwe: CWE-306 disclosed: Jul 2, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54617 Public PoC PoC
LaunchServer FileServerHandler Unauthenticated Path Traversal (CVE-2026-54617)
Detects exploitation attempts against pro.gravit.launcher:launchserver-api's FileServerHandler, which is vulnerable to an unauthenticated path traversal (CWE-22) allowing arbitrary file read (CWE-200) and disclosure of sensitive data such as credentials or keys (CWE-522) in versions <= 5.7.11. Attackers send crafted HTTP requests containing traversal sequences (../, encoded variants, absolute paths) to the LaunchServer file-serving endpoint to read files outside the intended web root, including server configs, private keys, and auth databases.
vendor: maven product: pro.gravit.launcher:launchserver-api cwe: CWE-22, CWE-200 disclosed: Jul 2, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-44935 Public PoC PoC
Rancher Fleet Cross-Namespace Secret Disclosure via Unvalidated valuesFrom in Helm Deployer (CVE-2026-44935)
Detects exploitation of CVE-2026-44935, a critical (CVSS 9.9) vulnerability in Rancher Fleet's Helm Deployer where unvalidated `valuesFrom` references allow a low-privileged user with GitRepo/Bundle creation rights in one namespace to reference and exfiltrate Secret or ConfigMap contents from arbitrary other namespaces, including cluster-admin credentials, cloud provider keys, and Fleet agent tokens. Exploitation involves crafting a GitOps Bundle or GitRepo resource whose Helm `valuesFrom` fields point at a Secret/ConfigMap name in a namespace the attacker does not own; the Fleet controller resolves the reference without namespace/RBAC validation and renders the secret data into Helm values, which are then visible via `helm get values`, Bundle status, or logs. Affected versions: Fleet >= 0.15.0 < 0.15.2, >= 0.14.0 < 0.14.6, >= 0.13.0 < 0.13.11, >= 0.12.0 < 0.12.15. A public PoC/advisory is available; no changes to affected/patched version status have been reported since initial disclosure.
vendor: go product: github.com/rancher/fleet cwe: CWE-863 disclosed: Jul 1, 20269.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-45659 KEV
CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE
Detects exploitation of CVE-2026-45659, a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server. Successful exploitation allows remote code execution by sending crafted serialized .NET objects to SharePoint web endpoints. This CVE is listed in CISA KEV indicating active exploitation in the wild.
vendor: Microsoft product: SharePoint Server cwe: CWE-502 disclosed: Jul 1, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-50545 Public PoC PoC
CVE-2026-50545: Fission Environment CRD PodSpec Injection
Detects exploitation of CVE-2026-50545, a critical vulnerability in Fission serverless framework (<= 1.23.0) where an attacker with permissions to create or modify Fission Environment custom resources can inject arbitrary PodSpec fields, enabling node escape and full Kubernetes cluster takeover. The vulnerability stems from insufficient validation of user-supplied PodSpec in the Environment CRD, allowing privilege escalation via hostPID, hostNetwork, privileged containers, or volume mounts to sensitive node paths.
vendor: go product: github.com/fission/fission cwe: CWE-269, CWE-284 disclosed: Jun 30, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-50563 Public PoC PoC
Fission Container Executor PodSpec Injection - Node Escape Attempt
Detects exploitation of CVE-2026-50563, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0). The container executor allows unauthenticated or low-privileged users to inject arbitrary PodSpec fields into function pods, enabling container escape to the underlying Kubernetes node. Attackers can inject hostPID, hostNetwork, privileged containers, hostPath volume mounts, or custom service accounts to achieve full node compromise.
vendor: go product: github.com/fission/fission cwe: CWE-269, CWE-284 disclosed: Jun 30, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-50564 Public PoC PoC
Fission Environment CRD PodSpec Passthrough Node Escape (CVE-2026-50564)
Fission (<=1.23.0) allows the Environment Custom Resource podspec passthrough (poolspec.container / poolspec.podspec) to inject arbitrary Kubernetes PodSpec fields including hostPID, hostNetwork, hostIPC, and privileged securityContext into builder/executor pods created by the fission-builder and fission-router controllers. Any principal able to create or update Environment CRDs (which in many multi-tenant Fission deployments includes low-privileged function developers) can escalate to full node compromise by scheduling a privileged, host-namespace-sharing pod, then pivoting to the underlying kubelet, container runtime socket, or other pods on the node. CVSS 9.9.
vendor: go product: github.com/fission/fission cwe: CWE-269, CWE-284 disclosed: Jun 30, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-50566 Public PoC PoC
Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566)
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
vendor: go product: github.com/fission/fission cwe: CWE-250, CWE-269 disclosed: Jun 30, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48558 KEV
CVE-2026-48558 — SimpleHelp Authentication Bypass (CWE-347)
Detects exploitation of CVE-2026-48558, an authentication bypass vulnerability in SimpleHelp remote support software caused by improper verification of cryptographic signatures (CWE-347). This KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls. SimpleHelp is commonly used by MSPs and IT support teams, making it a high-value target for initial access and lateral movement.
vendor: SimpleHelp product: SimpleHelp cwe: CWE-347 disclosed: Jun 29, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-49257 Public PoC PoC
CVE-2026-49257: mcp-pinot Unauthenticated Tool Invocation via Default oauth_enabled=False
Detects exploitation of CVE-2026-49257, a critical authentication bypass in mcp-pinot-server (<=3.0.1). The server defaults to oauth_enabled=False and binds to 0.0.0.0, allowing any network-adjacent or internet-facing attacker to invoke MCP tools without authentication. CVSS 10.0 with public PoC available.
vendor: pip product: mcp-pinot-server cwe: CWE-306 disclosed: Jun 26, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48749 Public PoC PoC
CVE-2026-48749: Incus Arbitrary File Read/Write via rootfs Symlink in Malicious Image
Detects exploitation of CVE-2026-48749, a critical vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. Attackers can craft a malicious container image with symlinks in the rootfs/ directory that resolve to host filesystem paths, enabling arbitrary file read and write on the underlying host. This constitutes a container escape primitive and may lead to full host compromise. CVSS 9.9 with public PoC available.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48750 Public PoC PoC
Incus exec-output Symlink Arbitrary File Write on Host (CVE-2026-48750)
CVE-2026-48750 is a critical arbitrary file write vulnerability (CVSS 9.9) in Incus container/VM manager (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. A crafted container image can place a symlink at the exec-output path, causing incusd to write attacker-controlled content to arbitrary locations on the host filesystem. This enables container escape leading to full host compromise. A public PoC is available.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48751 Public PoC PoC
CVE-2026-48751: Incus Restricted Project Bypass Leading to Arbitrary Command Execution
Detects exploitation of CVE-2026-48751, a critical missing authorization vulnerability (CWE-862) in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. An attacker with access to a restricted Incus project can bypass project restrictions to execute arbitrary commands on the host system, achieving container escape with a CVSS score of 9.9. A public proof-of-concept is available.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-862 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48752 Public PoC PoC
Incus Arbitrary File Read/Write via Malicious Image Template Symlink
CVE-2026-48752 is a critical vulnerability (CVSS 9.9) in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. A malicious container image can include a crafted symlink within the templates/ directory that, when processed by incusd during image import or container creation, allows an attacker to read or write arbitrary files on the host filesystem. This constitutes a container escape primitive with host takeover potential. A public proof-of-concept exists.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48753 Public PoC PoC
CVE-2026-48753: Incus S3 Multipart Upload Path Traversal Arbitrary File Write
Detects exploitation of CVE-2026-48753, a critical path traversal vulnerability (CVSS 9.9) in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.1.0. An attacker can write arbitrary files on the host by crafting malicious S3 multipart upload requests containing path traversal sequences in the object key, potentially leading to container escape, privilege escalation, or persistent backdoor installation.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48755 Public PoC PoC
Incus Argument Injection in Backup Compression Algorithm (CVE-2026-48755)
CVE-2026-48755 is a critical argument injection vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. The backup compression algorithm parameter is not properly validated, allowing an attacker with API access to inject arbitrary arguments into the compression utility invocation. This can lead to Arbitrary File Write (AFW) and Arbitrary Command Execution (ACE) on the host system running incusd, potentially escaping the container management boundary and compromising the underlying hypervisor or host.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-20 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48769 Public PoC PoC
CVE-2026-48769: Incus Arbitrary File Write via Trusted Image Hash
CVE-2026-48769 is a critical arbitrary file write vulnerability (CVSS 9.9) in Incus container/VM manager versions prior to 7.2.0. The vulnerability exists in the incusd daemon due to improper validation of image hashes from trusted sources, allowing an attacker to write arbitrary files on the client system. A malicious or compromised image server trusted by the Incus client can serve a crafted image that causes incusd to write attacker-controlled content to arbitrary filesystem paths, potentially leading to privilege escalation, persistence, or full system compromise.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-20 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-49252 Public PoC PoC
Deepstream Server Prototype Pollution (CVE-2026-49252)
CVE-2026-49252 is a critical prototype pollution vulnerability (CVSS 9.9) in @deepstream/server versions prior to 10.0.5. An attacker can manipulate JavaScript object prototypes via crafted deepstream messages, potentially leading to remote code execution, privilege escalation, or denial of service. A public proof-of-concept is available.
vendor: npm product: @deepstream/server cwe: CWE-1321 disclosed: Jun 26, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-46595 Public PoC PoC
CVE-2026-46595: golang.org/x/crypto/ssh VerifiedPublicKeyCallback Authentication Bypass
Detects exploitation of CVE-2026-46595, a critical authentication bypass vulnerability (CVSS 10.0) in golang.org/x/crypto/ssh versions prior to 0.52.0. When VerifiedPublicKeyCallback is used, SSH server implementations fail to enforce permission checks, allowing attackers to authenticate without proper authorization. This is a regression/variant of CVE-2024-45337 and carries a public PoC. Red Hat continues to issue errata across RHEL-derived ecosystems (RHSA-2026:23262, RHSA-2026:23264, RHSA-2026:26546, RHSA-2026:26547, RHSA-2026:30650, RHSA-2026:30651, RHSA-2026:33531, RHSA-2026:33524, RHSA-2026:36648, RHSA-2026:36207, RHSA-2026:36820, RHSA-2026:36808, RHSA-2026:36797, RHSA-2026:36796, RHSA-2026:36651, RHSA-2026:37387, RHSA-2026:37275, RHSA-2026:40118), indicating sustained, broad distribution-level patching activity as downstream vendors work through their release trains.
vendor: go product: golang.org/x/crypto/ssh cwe: CWE-863 disclosed: Jun 25, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-55166 Public PoC PoC
CVE-2026-55166: Lemur ACME SSRF and IDOR Leading to AWS IAM/PKI Compromise
Detects exploitation of CVE-2026-55166 in Netflix Lemur (versions < 1.9.2), which combines an ACME protocol Server-Side Request Forgery (CWE-918) with a creator-equality Insecure Direct Object Reference (CWE-639/CWE-285). Successful exploitation allows an attacker to pivot from certificate management to AWS IAM credential theft and PKI infrastructure compromise. PoC is publicly available. Fixed in Lemur 1.9.2 — organizations should upgrade immediately.
vendor: pip product: lemur cwe: CWE-285, CWE-639 disclosed: Jun 25, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-12569 KEV
CVE-2026-12569 - PTC Windchill and FlexPLM Improper Input Validation / Unsafe Deserialization
Detects exploitation attempts targeting CVE-2026-12569, an improper input validation and unsafe deserialization vulnerability (CWE-20, CWE-502) in PTC Windchill and FlexPLM. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Attackers may leverage this to achieve remote code execution via crafted serialized objects or malformed input submitted to Windchill/FlexPLM HTTP endpoints.
vendor: PTC product: Windchill and FlexPLM cwe: CWE-20, CWE-502 disclosed: Jun 25, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-20230 KEV
Cisco Unified Communications Manager SSRF Exploitation Detected
Detects exploitation attempts of CVE-2026-20230, a Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Communications Manager (CUCM). An unauthenticated remote attacker may craft malicious HTTP requests to the CUCM web interface to cause the server to initiate requests to arbitrary internal or external destinations, potentially enabling internal network reconnaissance, credential theft via metadata services, or pivoting to internal resources.
vendor: Cisco product: Unified Communications Manager cwe: CWE-918 disclosed: Jun 25, 20268.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:Nwrite-up soon - CVE-2026-34908 KEV
CVE-2026-34908 — Ubiquiti UniFi OS Improper Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-34908, an improper access control vulnerability (CWE-284) in Ubiquiti UniFi OS. This vulnerability is listed on the CISA Known Exploited Vulnerabilities catalog and allows attackers to bypass access controls on UniFi OS devices. Detection focuses on unauthorized API access, anomalous management plane requests, and lateral movement patterns consistent with UniFi controller compromise.
vendor: Ubiquiti product: UniFi OS cwe: CWE-284 disclosed: Jun 23, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-34909 KEV
Ubiquiti UniFi OS Path Traversal Exploitation Attempt
Detects exploitation attempts targeting CVE-2026-34909, a path traversal vulnerability (CWE-22) in Ubiquiti UniFi OS. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to traverse directory boundaries to access sensitive files or execute unauthorized actions on UniFi network management devices.
vendor: Ubiquiti product: UniFi OS cwe: CWE-22 disclosed: Jun 23, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-34910 KEV
Ubiquiti UniFi OS Improper Input Validation Vulnerability (CVE-2026-34910)
Detects exploitation attempts targeting CVE-2026-34910, an improper input validation vulnerability in Ubiquiti UniFi OS. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog and allows attackers to send malformed or unexpected input to UniFi OS network management interfaces, potentially leading to unauthorized access, command execution, or device compromise. UniFi OS powers a wide range of Ubiquiti network devices including Dream Machines, Cloud Keys, and network switches used in enterprise and SMB environments.
vendor: Ubiquiti product: UniFi OS cwe: CWE-20 disclosed: Jun 23, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-52813 Public PoC PoC
Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks
CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.
vendor: go product: gogs.io/gogs cwe: CWE-23 disclosed: Jun 23, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54350 Public PoC PoC
Budibase Anonymous NoSQL Operator Injection via Published-App Query Templates
CVE-2026-54350 is a critical (CVSS 10.0) NoSQL operator injection vulnerability in @budibase/server versions prior to 3.39.12. Unauthenticated attackers can inject MongoDB-style operators (e.g., $gt, $where, $regex) into published-app query templates, bypassing authentication and data access controls. Successful exploitation can lead to full database exfiltration, authentication bypass, and remote code execution via $where clauses. A public PoC is available.
vendor: npm product: @budibase/server cwe: CWE-89, CWE-943 disclosed: Jun 23, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-52806 Public PoC PoC
CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge
Detects exploitation of CVE-2026-52806, a critical command injection vulnerability (CWE-77) in Gogs versions prior to 0.14.3. An attacker can inject arbitrary shell commands via the git rebase --exec argument during pull request merge operations, leading to remote code execution on the Gogs server. A public PoC is available.
vendor: go product: gogs.io/gogs cwe: CWE-77 disclosed: Jun 23, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2025-67038 KEV
CVE-2025-67038 Lantronix EDS5000 Code Injection Exploitation
Detects exploitation attempts targeting CVE-2025-67038, a code injection vulnerability (CWE-78/CWE-94) in Lantronix EDS5000 series device servers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to inject OS commands or code through the device management interface. The EDS5000 series includes EDS5008, EDS5016, and EDS5032 models commonly deployed as serial-to-network device servers in industrial and enterprise environments.
vendor: Lantronix product: EDS5000 cwe: CWE-78, CWE-94 disclosed: Jun 23, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-58048 Public PoC PoC
CVE-2025-58048: Paymenter Remote Code Execution via Unrestricted File Upload
Detects exploitation of CVE-2025-58048, a critical unrestricted file upload vulnerability (CWE-434) in Paymenter versions prior to 1.2.11. Attackers can upload malicious files (e.g., PHP webshells) through publicly accessible upload endpoints, achieving remote code execution on the server. CVSS 9.9 with public PoC available.
vendor: composer product: paymenter/paymenter cwe: CWE-434 disclosed: Jun 22, 20269.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-44179 Public PoC PoC
CVE-2026-44179: XWiki Pro Macros RCE via Excerpt-Include Macro
Detects exploitation of CVE-2026-44179, a critical remote code execution vulnerability in com.xwiki.pro:xwiki-pro-macros versions >= 1.13 and < 1.14.5. The vulnerability (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code) allows unauthenticated or low-privileged attackers to execute arbitrary code on the server by injecting malicious Groovy/Velocity script expressions into XWiki page titles or content that are subsequently processed by the excerpt-include macro. A public proof-of-concept is available.
vendor: maven product: com.xwiki.pro:xwiki-pro-macros cwe: CWE-95 disclosed: Jun 22, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-33646 Public PoC PoC
CVE-2026-33646: Mise Arbitrary Code Execution via Tera Template Injection in .tool-versions
Detects exploitation of CVE-2026-33646, a critical trust bypass vulnerability in mise (formerly rtx) versions prior to 2026.3.10. Attackers can embed Tera template directives inside .tool-versions files to achieve arbitrary code execution when mise processes the file, bypassing trust checks. CVSS 9.6. PoC public.
vendor: rust product: mise disclosed: Jun 22, 20269.6 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54782 Public PoC PoC
CoreWCF SAML Token Signature Validation Authentication Bypass (CVE-2026-54782)
CVE-2026-54782 is a critical (CVSS 10.0) authentication bypass vulnerability in CoreWCF.Primitives affecting SAML 1.1 and 2.0 token signature validation. An unauthenticated attacker can craft a SAML assertion with an invalid or missing signature that CoreWCF accepts as valid, bypassing all authentication controls on WCF service endpoints. Affects CoreWCF.Primitives < 1.8.1 and >= 1.9.0, < 1.9.1. A public PoC exists.
vendor: nuget product: CoreWCF.Primitives cwe: CWE-290, CWE-347 disclosed: Jun 19, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54051 Public PoC PoC
CVE-2026-54051: network-ai npm Package OS Command Injection
Detects exploitation of CVE-2026-54051, a critical OS command injection vulnerability (CWE-78) in the npm package 'network-ai' versions prior to 5.9.1. Improper neutralization of special elements allows attackers to inject arbitrary OS commands through the package's API, potentially leading to full system compromise. A public PoC is available.
vendor: npm product: network-ai cwe: CWE-78 disclosed: Jun 19, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-55255 KEV PoC
Langflow IDOR: Unauthorized Access to Another User's Flow via /api/v1/responses
CVE-2026-55255 is a critical IDOR (Insecure Direct Object Reference) vulnerability in Langflow versions prior to 1.9.1, now confirmed actively exploited in the wild and listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. An authenticated attacker can enumerate and access another user's flow data by manipulating object identifiers in requests to the /api/v1/responses endpoint. With a CVSS score of 9.9, this vulnerability allows horizontal privilege escalation between users, potentially exposing sensitive AI flow configurations, credentials embedded in flows, and proprietary automation logic. Organizations running Langflow must treat patching as urgent given KEV status and active exploitation.
vendor: pip product: langflow cwe: CWE-639 disclosed: Jun 19, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-0755 Public PoC PoC
CVE-2026-0755: gemini-mcp-tool OS Command Injection and File Exfiltration via Prompt Quoting
CVE-2026-0755 is a critical OS command injection vulnerability (CWE-78) in the npm package gemini-mcp-tool versions >= 1.1.2 and < 1.1.6. Attackers can craft malicious prompts containing unescaped shell metacharacters or @file directives to achieve arbitrary OS command execution and local file exfiltration on systems running the affected MCP tool. The vulnerability arises from insufficient sanitization of user-supplied prompt strings before they are passed to underlying shell execution contexts. A public proof-of-concept exists. CVSS score is 9.8 (Critical).
vendor: npm product: gemini-mcp-tool cwe: CWE-78 disclosed: Jun 18, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-20253 KEV
CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function
Detects exploitation attempts targeting CVE-2026-20253, a missing authentication vulnerability (CWE-306) in Splunk Enterprise. This KEV-listed vulnerability allows unauthenticated access to critical Splunk functions. Attackers may leverage this to execute searches, exfiltrate data, or manipulate Splunk configurations without valid credentials.
vendor: Splunk product: Enterprise cwe: CWE-306 disclosed: Jun 18, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-47103 Public PoC PoC
python-statemachine SCXML <data expr> Eval Injection (CVE-2026-47103)
CVE-2026-47103 is a critical eval injection vulnerability (CWE-95) in python-statemachine versions >= 3.0.0 and < 3.2.0. When processing SCXML documents, the library evaluates expressions in <data expr=...> elements using Python's eval(), allowing an attacker who can supply or influence SCXML input to execute arbitrary Python code in the context of the application process. A public PoC is available and exploitation requires no authentication when SCXML is parsed from user-controlled input. CVSS score 9.8.
vendor: pip product: python-statemachine cwe: CWE-95 disclosed: Jun 18, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-32966 Public PoC PoC
Apache DolphinScheduler DataSource API Missing Authorization - Arbitrary Metadata Disclosure (CVE-2026-32966)
Apache DolphinScheduler versions before 3.4.2 contain a missing authorization check in the DataSource API endpoint. An unauthenticated or low-privileged attacker can query data source metadata including connection strings, credentials, hostnames, and database names without appropriate access controls. CVSS 9.8 critical. Public PoC available.
vendor: maven product: org.apache.dolphinscheduler:dolphinscheduler-api cwe: CWE-863 disclosed: Jun 17, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-48907 KEV
Widget Factory Joomla Content Editor Improper Access Control (CVE-2026-48907)
Detects exploitation of CVE-2026-48907, an improper access control vulnerability (CWE-284) in the Joomla Content Editor (JCE) plugin by Widget Factory. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass access controls, potentially enabling unauthorized file uploads, remote code execution, or administrative actions within Joomla CMS installations.
vendor: Widget Factory product: Joomla Content Editor cwe: CWE-284 disclosed: Jun 16, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-49980 Public PoC PoC
Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980)
CVE-2026-49980 is a critical unauthenticated remote code execution vulnerability in Rclone versions 1.46.0 through 1.74.2. When the rclone remote control daemon (rcd) is started with the --rc-serve flag, an attacker can instantiate arbitrary remotes inline via the RC API without authentication, bypassing the fix introduced for CVE-2026-41179. This allows execution of arbitrary commands on the host running rclone rcd. CVSS 9.8. PoC is publicly available.
vendor: go product: github.com/rclone/rclone cwe: CWE-306 disclosed: Jun 16, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-53753 Public PoC PoC
Crawl4AI AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE
Detects exploitation of CVE-2026-53753, a critical pre-authentication remote code execution vulnerability in Crawl4AI (<=0.8.6) Docker API. The vulnerability allows attackers to escape Python AST-based sandboxing via generator frame introspection (gi_frame.f_back chain), enabling arbitrary code execution without authentication. CVSS 9.8 critical; public PoC available.
vendor: pip product: crawl4ai cwe: CWE-94, CWE-913 disclosed: Jun 16, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-56266 Public PoC PoC
Crawl4AI Docker API Multiple Critical Vulnerabilities (File Write, SSRF, Auth Bypass, XSS, JS Execution)
Detects exploitation of CVE-2026-56266 affecting Crawl4AI <= 0.8.6 Docker API. The vulnerability bundle includes unauthenticated access (CWE-306), path traversal file write (CWE-22), server-side request forgery (CWE-918), stored/reflected XSS (CWE-79), JavaScript injection/execution (CWE-94), and hardcoded credentials (CWE-798). A public PoC is available. Successful exploitation allows full container compromise, internal network pivoting, and arbitrary file write to the host.
vendor: pip product: crawl4ai cwe: CWE-22, CWE-79 disclosed: Jun 16, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-30120 Public PoC PoC
Remotion RCE via Code Injection (CVE-2026-30120)
Detects exploitation of CVE-2026-30120, a critical remote code execution vulnerability in the Remotion npm package (versions < 4.0.410). The vulnerability stems from improper code injection controls (CWE-94), allowing attackers to execute arbitrary code in environments running vulnerable Remotion versions. A public PoC exists, elevating exploitation risk.
vendor: npm product: remotion cwe: CWE-94 disclosed: Jun 15, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-53633 Public PoC PoC
CVE-2026-53633: Vitest Browser Mode API RCE via CDP Proxy and Config Overwrite
CVE-2026-53633 is a critical (CVSS 9.8) remote code execution vulnerability in @vitest/browser and vite-plus packages. The browser mode API is exposed without adequate authorization controls (CWE-749, CWE-862), allowing unauthenticated attackers to proxy Chrome DevTools Protocol (CDP) commands and overwrite configuration files. This can lead to arbitrary code execution on the host running Vitest in browser mode. Affected versions include @vitest/browser >= 3.0.0 <= 3.2.4, >= 4.0.0 <= 4.1.7, >= 5.0.0-beta.0 <= 5.0.0-beta.3, and vite-plus <= 0.1.23. A public PoC exists.
vendor: npm product: @vitest/browser, vite-plus cwe: CWE-749, CWE-862 disclosed: Jun 15, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-54420 KEV
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
Detects exploitation of CVE-2026-54420, a UNIX symbolic link (symlink) following vulnerability in the LiteSpeed cPanel Plugin. Attackers with local access can create malicious symlinks to read or overwrite files outside the intended directory, potentially leading to privilege escalation or unauthorized file access on cPanel-managed hosting servers. This vulnerability is actively exploited in the wild (CISA KEV).
vendor: LiteSpeed product: cPanel Plugin cwe: CWE-61 disclosed: Jun 15, 20268.5 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-20262 KEV
Cisco Catalyst SD-WAN Manager Path Traversal Exploitation
Detects exploitation attempts targeting CVE-2026-20262, a path traversal vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager. Active exploitation has been confirmed by CISA KEV. Attackers can traverse directory boundaries via crafted HTTP requests to access sensitive files outside the web root, potentially exposing credentials, configuration data, or enabling further compromise of the SD-WAN management plane.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-22 disclosed: Jun 15, 20266.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Nwrite-up soon - CVE-2026-35273 KEV
Oracle PeopleSoft PeopleTools Missing Authentication for Critical Function (CVE-2026-35273)
CVE-2026-35273 is a missing authentication vulnerability (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can access critical PeopleSoft functions without authentication, potentially leading to unauthorized data access, privilege escalation, or full system compromise. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: Oracle product: PeopleSoft Enterprise PeopleTools cwe: CWE-306 disclosed: Jun 12, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-10520 KEV
Ivanti Sentry OS Command Injection Exploitation (CVE-2026-10520)
Detects exploitation attempts targeting CVE-2026-10520, an OS command injection vulnerability (CWE-78) in Ivanti Sentry. This vulnerability is actively exploited in the wild (CISA KEV) and allows unauthenticated or authenticated attackers to inject operating system commands through Ivanti Sentry's administrative or API interfaces, potentially leading to full system compromise. Ivanti Sentry acts as a gateway for enterprise mobile device management, making it a high-value target for threat actors seeking persistent access to corporate infrastructure.
vendor: Ivanti product: Sentry cwe: CWE-78 disclosed: Jun 11, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-48062 Public PoC PoC
CVE-2026-48062: CodeIgniter4 File Upload Extension Validation Bypass (ext_in Rule)
CVE-2026-48062 affects CodeIgniter4 framework versions prior to 4.7.2. The `ext_in` validation rule fails to properly validate file extensions during upload, allowing attackers to bypass extension restrictions and upload arbitrary files including web shells or malicious executables. This unrestricted file upload vulnerability (CWE-434) has a CVSS score of 9.8 and a public proof-of-concept. Successful exploitation can lead to remote code execution on the hosting server.
vendor: composer product: codeigniter4/framework cwe: CWE-434 disclosed: Jun 11, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-48030 Public PoC PoC
Pheditor OS Command Injection via Unsanitized 'dir' Parameter (CVE-2026-48030)
Detects exploitation of CVE-2026-48030, a critical OS command injection vulnerability in Pheditor versions 2.0.1 through 2.0.3. The terminal handler accepts an unsanitized 'dir' parameter that is passed directly to a shell command, allowing unauthenticated or authenticated attackers to execute arbitrary OS commands on the hosting server. A public proof-of-concept exists, making active exploitation likely.
vendor: composer product: pheditor/pheditor cwe: CWE-78 disclosed: Jun 9, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-11645 KEV
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CVE-2026-11645)
Detects exploitation attempts targeting CVE-2026-11645, an out-of-bounds read and write vulnerability in Google Chromium's V8 JavaScript engine. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation can lead to arbitrary code execution in the context of the browser process, enabling sandbox escape, credential theft, and further compromise.
vendor: Google product: Chromium V8 cwe: CWE-787, CWE-125 disclosed: Jun 9, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-20245 KEV
Cisco Catalyst SD-WAN Manager Improper Output Encoding Exploitation
Detects exploitation attempts targeting CVE-2026-20245, an improper encoding or escaping of output vulnerability (CWE-116) in Cisco Catalyst SD-WAN Manager. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to perform privilege escalation or inject malicious content through improperly encoded output. Detection focuses on anomalous authentication patterns, unexpected privilege changes, API abuse, and suspicious management plane activity against SD-WAN Manager instances.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-116 disclosed: Jun 9, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-7473 KEV
Arista EOS Incomplete Comparison Authentication Bypass (CVE-2026-7473)
Detects exploitation attempts targeting CVE-2026-7473, an incomplete comparison vulnerability (CWE-1023) in Arista Extensible Operating System (EOS). This flaw allows attackers to bypass authentication or authorization checks due to missing comparison factors, potentially enabling unauthorized access to network device management interfaces. The vulnerability is actively exploited in the wild (CISA KEV). Detection focuses on anomalous management-plane access patterns, unexpected SSH/API sessions, and configuration changes on Arista EOS devices.
vendor: Arista product: Extensible Operating System cwe: CWE-1023 disclosed: Jun 9, 20265.8 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Nwrite-up soon - CVE-2026-47724 Public PoC PoC
nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation
CVE-2026-47724 is a missing authorization vulnerability (CWE-862) in github.com/juev/nebula-mesh versions prior to 0.3.4. API endpoints fail to validate resource ownership before processing requests, allowing an authenticated operator to access, modify, or delete mesh network resources belonging to other operators. With a CVSS score of 9.9 and a public proof-of-concept, exploitation enables full cross-tenant privilege escalation within a nebula-mesh deployment. Organizations running nebula-mesh as a multi-tenant overlay network orchestrator are at critical risk.
vendor: go product: github.com/juev/nebula-mesh cwe: CWE-862 disclosed: Jun 8, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-50751 KEV
Check Point Security Gateway Improper Authentication (CVE-2026-50751)
Detects exploitation of CVE-2026-50751, an improper authentication vulnerability (CWE-287) in Check Point Security Gateway affecting deprecated IKEv1 VPN protocol. This vulnerability is actively exploited in the wild (CISA KEV) and may allow unauthenticated attackers to bypass authentication controls on the VPN gateway. Detection focuses on anomalous IKEv1 negotiation patterns, authentication bypass indicators, and suspicious gateway access following failed or malformed IKE exchanges.
vendor: Check Point product: Security Gateway cwe: CWE-287 disclosed: Jun 8, 20269.3 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Nwrite-up soon - CVE-2026-42271 KEV
BerriAI LiteLLM Command Injection (CVE-2026-42271)
Detects exploitation of CVE-2026-42271, a command injection vulnerability in BerriAI LiteLLM. An attacker who can reach the LiteLLM API or admin interface may inject OS commands that execute under the LiteLLM process context, leading to remote code execution. The vulnerability is tracked under CWE-78 (OS Command Injection) and CWE-77 (Command Injection) and is listed as actively exploited in CISA KEV.
vendor: BerriAI product: LiteLLM cwe: CWE-78, CWE-77 disclosed: Jun 8, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-47668 Public PoC PoC
CVE-2026-47668: DbGate Unauthenticated RCE via JSON Script Runner
Detects exploitation of CVE-2026-47668, a critical unauthenticated remote code execution vulnerability in dbgate-serve <= 7.1.8. The JSON Script Runner endpoint accepts and executes arbitrary JavaScript/JSON payloads without authentication, allowing attackers to achieve full server compromise. A public PoC is available.
vendor: npm product: dbgate-serve cwe: CWE-20, CWE-94 disclosed: Jun 5, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47744 Public PoC PoC
Shopper Framework Authorization Bypass and RBAC Privilege Escalation in Team Settings
CVE-2026-47744 is a critical authorization bypass and RBAC privilege escalation vulnerability in the Shopper e-commerce framework (composer package shopper/framework) affecting versions prior to 2.8.0. An authenticated low-privileged user can bypass role-based access controls in team settings to escalate privileges or perform unauthorized administrative actions. A public proof-of-concept exists, making active exploitation likely. CVSS score 9.9.
vendor: composer product: shopper/framework cwe: CWE-269, CWE-285 disclosed: Jun 5, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-28318 KEV
SolarWinds Serv-U Uncontrolled Resource Consumption (CVE-2026-28318)
Detects exploitation of CVE-2026-28318, an uncontrolled resource consumption vulnerability (CWE-400) in SolarWinds Serv-U. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to exhaust server resources, leading to denial of service conditions. Detection focuses on abnormal connection patterns, resource exhaustion indicators, and anomalous request volumes targeting Serv-U services.
vendor: SolarWinds product: Serv-U cwe: CWE-400 disclosed: Jun 5, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hwrite-up soon - CVE-2026-44180 Public PoC PoC
CVE-2026-44180: Jupyter Enterprise Gateway ContainerProcessProxy._enforce_prohibited_ids Bypass
CVE-2026-44180 is a critical (CVSS 9.8) input validation bypass in Jupyter Enterprise Gateway versions >= 2.0.0rc1 and < 3.3.0. The ContainerProcessProxy._enforce_prohibited_ids method fails to properly validate or enforce restrictions on kernel IDs, allowing an attacker to bypass container process isolation controls. This can enable unauthorized kernel spawning, container escape, or execution of arbitrary workloads within the enterprise gateway environment. A public proof-of-concept exists.
vendor: pip product: jupyter_enterprise_gateway cwe: CWE-20, CWE-180 disclosed: Jun 3, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-45247 KEV
Mirasvit Full Page Cache Warmer Deserialization RCE (CVE-2026-45247)
Detects exploitation of CVE-2026-45247, a deserialization of untrusted data vulnerability in the Mirasvit Full Page Cache Warmer Magento extension. Successful exploitation allows remote attackers to execute arbitrary code by sending crafted serialized PHP objects to vulnerable endpoints. This CVE is listed in CISA KEV, indicating active exploitation in the wild.
vendor: Mirasvit product: Mirasvit Full Page Cache Warmer cwe: CWE-502 disclosed: Jun 3, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2022-0492 KEV
Linux Kernel cgroup v1 release_agent Privilege Escalation (CVE-2022-0492)
CVE-2022-0492 is a Linux kernel vulnerability (CWE-287/CWE-862) in the cgroup v1 release_agent mechanism. A local unprivileged user can exploit improper capability checks to write to /sys/fs/cgroup/*/release_agent and execute arbitrary commands as root, enabling container escape and full host compromise. This vulnerability is listed on CISA KEV, indicating active exploitation in the wild.
vendor: Linux product: Kernel cwe: CWE-287, CWE-862 disclosed: Jun 2, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-47429 Public PoC PoC
CVE-2026-47429: Vitest UI Server Arbitrary File Read and Execution
CVE-2026-47429 is a critical missing authorization vulnerability (CWE-862, CVSS 9.8) in the Vitest UI server. When the Vitest UI server is listening, unauthenticated remote attackers can read arbitrary files from the filesystem and execute arbitrary code. Affected versions include Vitest < 3.2.6 and >= 4.0.0, < 4.1.0. A public proof-of-concept exists. Exploitation typically involves sending crafted WebSocket or HTTP requests to the Vitest UI server's RPC endpoint to traverse the filesystem or trigger code execution via the browser plugin's file system command handlers.
vendor: npm product: vitest cwe: CWE-862 disclosed: Jun 1, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47413 Public PoC PoC
CVE-2026-47413: PraisonAI Platform Unauthorized Workspace Owner Privilege Escalation
Detects exploitation of CVE-2026-47413, a critical privilege escalation vulnerability in praisonai-platform < 0.1.4 where any authenticated workspace member can promote arbitrary users to owner role via POST /workspaces/{id}/members without authorization checks. CVSS 9.6. PoC is publicly available.
vendor: pip product: praisonai-platform cwe: CWE-269, CWE-862 disclosed: Jun 1, 20269.6 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47428 Public PoC PoC
CVE-2026-47428: Vitest Browser Mode XSS via Unsanitized otelCarrier Query Parameter
CVE-2026-47428 is a reflected Cross-Site Scripting (XSS) vulnerability in @vitest/browser versions >= 4.0.17 < 4.1.6 and >= 5.0.0-beta.0 < 5.0.0-beta.3. The browser mode development server serves the otelCarrier query parameter as unsanitized inline script content in esm-client-injector.js and serverOrchestrator.ts, allowing an attacker to inject arbitrary JavaScript into the test runner's browser context. With a CVSS of 9.6 and public PoC available, this poses a critical risk to CI/CD pipelines and developer workstations running Vitest browser mode tests, potentially enabling credential theft, session hijacking, or supply chain compromise.
vendor: npm product: @vitest/browser cwe: CWE-79 disclosed: Jun 1, 20269.6 criticalCVSS vector not yet publishedwrite-up soon - CVE-2024-21182 KEV
Oracle WebLogic Server CVE-2024-21182 Exploitation Attempt
Detects exploitation attempts targeting CVE-2024-21182, an unspecified vulnerability in Oracle WebLogic Server. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Oracle WebLogic Server is a high-value target for threat actors due to its prevalence in enterprise Java EE environments. Exploitation may enable remote code execution, unauthorized data access, or server compromise.
vendor: Oracle product: WebLogic Server disclosed: Jun 1, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2026-47137 Public PoC PoC
CVE-2026-47137 — vm2 Sandbox Escape via nesting:true Bypass (RCE)
Detects exploitation of CVE-2026-47137, a critical sandbox escape vulnerability in the vm2 Node.js library (<=3.11.3). This bypass circumvents the CVE-2023-37903 patch by abusing the nesting:true configuration option without an explicit require, enabling full remote code execution from within a sandboxed context. CVSS 10.0. A patch is available in vm2 >= 3.11.4.
vendor: npm product: vm2 cwe: CWE-913 disclosed: May 29, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47140 Public PoC PoC
CVE-2026-47140 — vm2 Builtin Denylist Bypass via process/inspector Leads to Host RCE
Detects exploitation of CVE-2026-47140, a critical sandbox escape in the npm vm2 package (versions <= 3.11.3). Attackers bypass the builtin module denylist using process and inspector/promises references to execute arbitrary code on the host Node.js process. CVSS 10.0. PoC is publicly available.
vendor: npm product: vm2 cwe: CWE-693 disclosed: May 29, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47208 Public PoC PoC
CVE-2026-47208: vm2 Sandbox Breakout via Promise Species
Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.
vendor: npm product: vm2 cwe: CWE-913 disclosed: May 29, 202610.0 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47392 Public PoC PoC
PraisonAI Sandbox Escape via print.__self__ Builtins Leak in execute_code
Detects exploitation of CVE-2026-47392, a critical sandbox escape vulnerability in PraisonAI (praisonaiagents <= 1.6.39, PraisonAI <= 4.6.39). The flaw allows attackers to leak the Python builtins module through `print.__self__` within the `execute_code` subprocess mode, bypassing sandbox restrictions and achieving arbitrary code execution on the host. A public proof-of-concept is available.
vendor: pip product: praisonaiagents, PraisonAI cwe: CWE-184, CWE-693 disclosed: May 29, 20269.9 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47210 Public PoC PoC
vm2 Sandbox Escape via JSPI-backed Promise .finally() Species Bypass
Detects exploitation of CVE-2026-47210, a critical sandbox escape vulnerability in the npm vm2 library (versions <= 3.11.3). The vulnerability abuses the JavaScript Promise Integration (JSPI) mechanism and the Promise species pattern in .finally() to escape the vm2 sandbox and execute arbitrary code on the host. A public PoC exists and exploitation grants full host access with the privileges of the Node.js process.
vendor: npm product: vm2 cwe: CWE-913 disclosed: May 29, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47391 Public PoC PoC
CVE-2026-47391: PraisonAI Unauthenticated A2A LLM eval() Remote Code Execution
CVE-2026-47391 is a critical unauthenticated remote code execution vulnerability in PraisonAI versions <= 4.6.39. The official Agent-to-Agent (A2A) example exposes an endpoint that accepts arbitrary input, passes it through an LLM-driven pipeline, and executes the result via Python's eval() without authentication or input sanitization. An attacker can craft a malicious payload that causes the LLM to emit code executed directly by the server process, achieving full RCE with the privileges of the PraisonAI service.
vendor: pip product: PraisonAI cwe: CWE-95, CWE-306 disclosed: May 29, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47393 Public PoC PoC
PraisonAI Flask API Server Deployed Without Authentication (CVE-2026-47393)
PraisonAI versions <= 4.6.39, when deployed via `deploy --type api`, expose a Flask HTTP server with authentication disabled by default (CWE-306, CWE-1188). Any unauthenticated actor with network access can invoke the AI agent API, exfiltrate model outputs, or use the endpoint as a proxy for downstream attacks. CVSS 9.8 critical; public PoC available.
vendor: pip product: PraisonAI cwe: CWE-306, CWE-1188 disclosed: May 29, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47396 Public PoC PoC
PraisonAI Call Server Unauthenticated Agent Access (CVE-2026-47396)
Detects exploitation of CVE-2026-47396, a critical authentication bypass in PraisonAI's call server component. When the CALL_SERVER_TOKEN environment variable is unset, the server exposes unauthenticated endpoints for listing, invoking, and deleting AI agents. An attacker can enumerate available agents, invoke arbitrary agent workflows, or destroy agent configurations without any credentials. CVSS 9.8 (Critical), CWE-284/CWE-306.
vendor: pip product: PraisonAI cwe: CWE-284, CWE-306 disclosed: May 29, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-47410 Public PoC PoC
PraisonAI Platform JWT Hardcoded Secret Key Token Forgery
Detects exploitation of CVE-2026-47410, a critical vulnerability in praisonai-platform (<= 0.1.2) where the JWT signing key defaults to the hardcoded value 'dev-secret-change-me' when PLATFORM_ENV is unset. An unauthenticated attacker can forge valid JWTs for any user, including administrators, enabling full platform compromise.
vendor: pip product: praisonai-platform cwe: CWE-321, CWE-798 disclosed: May 29, 20269.8 criticalCVSS vector not yet publishedwrite-up soon - CVE-2026-0257 KEV
Palo Alto Networks PAN-OS Authentication Bypass (CVE-2026-0257)
Detects exploitation attempts of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS caused by improper reliance on cookies for security decisions (CWE-565). An attacker can manipulate session cookies to bypass authentication controls on PAN-OS management interfaces or VPN endpoints. This vulnerability is confirmed exploited in the wild (CISA KEV).
vendor: Palo Alto Networks product: PAN-OS cwe: CWE-565 disclosed: May 29, 20269.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nwrite-up soon - CVE-2026-0770 KEV PoC
Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829)
Detects exploitation of CVE-2026-0770, an Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow that allows unauthenticated or low-privileged actors to trigger execution of code, components, or custom nodes sourced from an untrusted control sphere. This flaw is listed in CISA KEV with a public exploit-db PoC and is actively exploited. Exploitation typically manifests as unexpected outbound connections from the Langflow host to fetch remote component definitions, followed by anomalous child process spawns from the Langflow server process, or webhook/API calls to Langflow's flow-execution and custom component endpoints from untrusted sources.
vendor: Langflow product: Langflow cwe: CWE-829 disclosed: May 29, 2026— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2026-48027 KEV
Nx Console Embedded Malicious Code Execution (CVE-2026-48027)
CVE-2026-48027 describes an embedded malicious code vulnerability (CWE-506) in Nx Console, a popular VS Code and JetBrains IDE extension for managing Nx monorepos. A compromised or trojanized version of Nx Console contains backdoored code that executes at extension load time within the developer IDE process, enabling attacker-controlled behavior including credential harvesting, reverse shells, or supply chain lateral movement into CI/CD pipelines. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Detection focuses on anomalous process spawning from IDE extension host processes, unexpected network connections originating from VS Code or JetBrains runtimes, and suspicious file writes consistent with embedded malicious payloads.
vendor: Nx product: Nx Console cwe: CWE-506 disclosed: May 27, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-8398 KEV
Daemon Tools Lite Embedded Malicious Code (CVE-2026-8398)
CVE-2026-8398 is a supply chain compromise affecting Daemon Tools Lite, where threat actors embedded malicious code (CWE-506) within the software distribution. Installations of the trojanized version may result in backdoor access, credential theft, or lateral movement from hosts running the compromised software. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Daemon product: Daemon Tools Lite cwe: CWE-506 disclosed: May 27, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-45321 KEV
TanStack Router Unspecified Vulnerability Exploitation
Detects potential exploitation of CVE-2026-45321, an unspecified vulnerability in TanStack Router that has been added to the CISA Known Exploited Vulnerabilities catalog. TanStack Router is a type-safe routing library for React applications. Given KEV status, active exploitation in the wild is confirmed. Detection focuses on anomalous web application behavior, suspicious client-side routing patterns, unexpected server-side request patterns, and post-exploitation indicators consistent with JavaScript framework exploitation.
vendor: TanStack product: TanStack disclosed: May 27, 20269.6 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-48172 KEV
LiteSpeed cPanel Plugin Privilege Escalation (CVE-2026-48172)
Detects exploitation of CVE-2026-48172, a privilege escalation vulnerability in the LiteSpeed cPanel Plugin (CWE-266: Incorrect Privilege Assignment). Attackers with low-privileged cPanel access can leverage the plugin's improper privilege handling to elevate to root or administrative system access. This vulnerability is actively exploited in the wild (CISA KEV).
vendor: LiteSpeed product: cPanel Plugin cwe: CWE-266 disclosed: May 26, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-9082 KEV
Drupal Core SQL Injection Exploitation (CVE-2026-9082)
Detects exploitation attempts targeting CVE-2026-9082, a SQL injection vulnerability in Drupal Core. This KEV-listed vulnerability allows attackers to inject malicious SQL via crafted HTTP requests, potentially leading to unauthorized data access, credential theft, or remote code execution via stacked queries. Active exploitation has been observed in the wild.
vendor: Drupal product: Core cwe: CWE-89 disclosed: May 22, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-34291 KEV
CVE-2025-34291: Langflow Origin Validation Error Exploitation
Detects exploitation of CVE-2025-34291, an origin validation error (CWE-346) in Langflow that allows attackers to bypass origin checks. This vulnerability is actively exploited in the wild (CISA KEV) and may enable unauthorized access to Langflow API endpoints, flow execution, or administrative functions by bypassing cross-origin restrictions.
vendor: Langflow product: Langflow cwe: CWE-346 disclosed: May 21, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-34926 KEV
Trend Micro Apex One Directory Traversal Exploitation (CVE-2026-34926)
Detects exploitation attempts targeting CVE-2026-34926, a directory traversal vulnerability (CWE-23) in Trend Micro Apex One (On-Premise). This KEV-listed vulnerability allows unauthenticated or low-privileged attackers to traverse directory boundaries via crafted HTTP requests to the Apex One management server, potentially enabling arbitrary file read or write operations. Active exploitation has been observed in the wild.
vendor: Trend Micro product: Apex One cwe: CWE-23 disclosed: May 21, 20266.7 mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:Lwrite-up soon - CVE-2008-4250 KEV
MS08-067 NetAPI Buffer Overflow Exploitation Attempt (CVE-2008-4250)
CVE-2008-4250 is a critical buffer overflow vulnerability in the Windows Server service (netapi32.dll) affecting Microsoft Windows XP, 2000, 2003, Vista, and Server 2008. Exploitation via a specially crafted RPC request to the NetpwPathCanonicalize function allows unauthenticated remote code execution as SYSTEM. This vulnerability was exploited by the Conficker worm and remains listed in CISA's Known Exploited Vulnerabilities catalog. Detection focuses on suspicious SMB/RPC activity, NetAPI service anomalies, and post-exploitation indicators including lateral movement and payload staging.
vendor: Microsoft product: Windows cwe: CWE-94 disclosed: May 20, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2009-1537 KEV
Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537)
CVE-2009-1537 is a NULL byte overwrite vulnerability in Microsoft DirectX (quartz.dll) that can be exploited via a maliciously crafted QuickTime media file. Successful exploitation allows remote code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Addressed in MS09-028.
vendor: Microsoft product: DirectX disclosed: May 20, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2009-3459 KEV
Adobe Acrobat and Reader Heap-Based Buffer Overflow (CVE-2009-3459)
Detects exploitation of a heap-based buffer overflow vulnerability in Adobe Acrobat and Reader (CVE-2009-3459). This CISA KEV vulnerability allows attackers to execute arbitrary code via a crafted PDF file. Exploitation typically results in AcroRd32.exe or Acrobat.exe spawning unexpected child processes, making unusual network connections, or writing executable payloads to disk.
vendor: Adobe product: Acrobat and Reader cwe: CWE-119 disclosed: May 20, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2010-0249 KEV
Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2010-0249)
CVE-2010-0249 is a use-after-free vulnerability (CWE-416) in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code via a specially crafted web page. This vulnerability was actively exploited in the wild (Operation Aurora) and is listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation typically involves a malicious HTML/JavaScript page that triggers memory corruption through manipulated DOM objects, enabling arbitrary code execution in the context of the logged-on user.
vendor: Microsoft product: Internet Explorer cwe: CWE-416 disclosed: May 20, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2010-0806 KEV
CVE-2010-0806 Microsoft Internet Explorer Use-After-Free Exploitation
Detects exploitation of CVE-2010-0806, a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability allows remote attackers to execute arbitrary code via a crafted web page. It is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in the wild.
vendor: Microsoft product: Internet Explorer cwe: CWE-399 disclosed: May 20, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-41091 KEV
Microsoft Defender Link Following Privilege Escalation (CVE-2026-41091)
Detects exploitation of CVE-2026-41091, a link-following vulnerability (CWE-59) in Microsoft Defender that allows attackers to follow symbolic links or junction points to access or overwrite privileged files. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to privilege escalation or arbitrary file manipulation in the context of the Defender service.
vendor: Microsoft product: Defender cwe: CWE-59 disclosed: May 20, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-45498 KEV
Microsoft Defender Denial of Service Vulnerability (CVE-2026-45498)
CVE-2026-45498 is a Denial of Service vulnerability in Microsoft Defender. Exploitation can cause Defender to crash, hang, or become unresponsive, effectively disabling endpoint protection on affected hosts. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may leverage this to disable security tooling prior to follow-on intrusion activity.
vendor: Microsoft product: Defender disclosed: May 20, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hwrite-up soon - CVE-2026-42897 KEV
Microsoft Exchange Server Cross-Site Scripting (XSS) Exploitation
Detects exploitation attempts targeting CVE-2026-42897, a Cross-Site Scripting (XSS) vulnerability in Microsoft Exchange Server. This KEV-listed vulnerability allows attackers to inject malicious scripts into Exchange web interfaces, potentially leading to session hijacking, credential theft, or further lateral movement within the environment. Detection focuses on anomalous HTTP requests to Exchange OWA/ECP endpoints containing XSS payloads, unexpected script execution from Exchange processes, and suspicious web request patterns indicative of active exploitation.
vendor: Microsoft product: Microsoft cwe: CWE-79 disclosed: May 15, 20266.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nwrite-up soon - CVE-2026-20182 KEV
Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182)
Detects exploitation attempts of CVE-2026-20182, an authentication bypass vulnerability (CWE-287) in the Cisco Catalyst SD-WAN Controller. This KEV-listed vulnerability allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access to the SD-WAN management plane. Successful exploitation can lead to full network fabric compromise, configuration tampering, and lateral movement across SD-WAN-connected sites.
vendor: Cisco product: Catalyst SD-WAN cwe: CWE-287 disclosed: May 14, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-42208 KEV
BerriAI LiteLLM SQL Injection Exploitation (CVE-2026-42208)
Detects exploitation attempts targeting a SQL injection vulnerability in BerriAI LiteLLM (CVE-2026-42208, CWE-89). LiteLLM is a widely deployed LLM proxy/gateway; successful exploitation allows unauthenticated or authenticated attackers to manipulate backend database queries, potentially exfiltrating API keys, user data, model configurations, and spend tracking records. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: BerriAI product: LiteLLM cwe: CWE-89 disclosed: May 8, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-6973 KEV
CVE-2026-6973: Ivanti EPMM Improper Input Validation Exploitation
Detects exploitation attempts targeting CVE-2026-6973, an improper input validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM). This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to bypass authentication or execute unauthorized actions against the EPMM management interface.
vendor: Ivanti product: Endpoint Manager Mobile (EPMM) cwe: CWE-20 disclosed: May 7, 20267.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-0300 KEV
Palo Alto Networks PAN-OS Out-of-bounds Write (CVE-2026-0300)
Detects exploitation attempts targeting CVE-2026-0300, an out-of-bounds write vulnerability (CWE-787) in Palo Alto Networks PAN-OS. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to execute arbitrary code, crash the device, or escalate privileges on affected PAN-OS appliances. Detection focuses on anomalous management plane activity, unexpected process crashes, memory corruption indicators, and suspicious inbound traffic patterns targeting PAN-OS management interfaces.
vendor: Palo Alto Networks product: PAN-OS cwe: CWE-787 disclosed: May 6, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-31431 KEV
Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431)
CVE-2026-31431 is a Linux Kernel vulnerability classified as CWE-669 (Incorrect Resource Transfer Between Spheres). The flaw allows improper transfer of resources across security boundaries within the kernel, potentially enabling privilege escalation or unauthorized memory access. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers with local access may exploit this to escalate privileges to root or escape container boundaries.
vendor: Linux product: Kernel cwe: CWE-669 disclosed: May 1, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-41940 KEV
CVE-2026-41940: WebPros cPanel & WHM / WP2 Missing Authentication for Critical Function
CVE-2026-41940 is an actively exploited missing authentication vulnerability (CWE-306) in WebPros cPanel & WHM and WP2 (WordPress Squared). Unauthenticated remote attackers can invoke critical administrative functions without valid credentials, enabling account takeover, malicious plugin installation, privilege escalation, and full server compromise. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: WebPros product: cPanel & WHM and WP2 (WordPress Squared) cwe: CWE-306 disclosed: Apr 30, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-1708 KEV
ConnectWise ScreenConnect Path Traversal (CVE-2024-1708)
Detects exploitation of CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8. Attackers can traverse outside the intended directory to read, write, or execute arbitrary files on the host. This vulnerability is actively exploited in the wild and listed on CISA KEV. It is commonly chained with CVE-2024-1709 (authentication bypass) to achieve unauthenticated remote code execution.
vendor: ConnectWise product: ScreenConnect cwe: CWE-22 disclosed: Apr 28, 20268.4 highCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-32202 KEV
CVE-2026-32202 Microsoft Windows Protection Mechanism Failure
Detects exploitation of CVE-2026-32202, a Microsoft Windows Protection Mechanism Failure vulnerability (CWE-693) listed in CISA KEV. This vulnerability allows attackers to bypass security controls in Windows, potentially enabling privilege escalation, defense evasion, or code execution. Detection focuses on anomalous process behavior, security feature bypass indicators, and suspicious Windows API usage patterns consistent with protection mechanism circumvention.
vendor: Microsoft product: Windows cwe: CWE-693 disclosed: Apr 28, 20264.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nwrite-up soon - CVE-2024-57726 KEV
SimpleHelp Missing Authorization Vulnerability (CVE-2024-57726)
CVE-2024-57726 is a missing authorization vulnerability (CWE-862) in SimpleHelp remote support software versions 5.5.7 and earlier. This CISA KEV-listed vulnerability allows unauthenticated or low-privileged attackers to bypass authorization controls, potentially enabling unauthorized access to administrative functions, file system traversal, or remote code execution on systems running the SimpleHelp server. Active exploitation has been observed in the wild.
vendor: SimpleHelp product: SimpleHelp cwe: CWE-862 disclosed: Apr 24, 20269.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2024-7399 KEV
Samsung MagicINFO 9 Server Path Traversal and Arbitrary File Upload
Detects exploitation of CVE-2024-7399, a path traversal and unrestricted file upload vulnerability in Samsung MagicINFO 9 Server. Successful exploitation allows unauthenticated or low-privileged attackers to upload arbitrary files outside the intended directory, potentially leading to remote code execution. This CVE is actively exploited in the wild (CISA KEV).
vendor: Samsung product: MagicINFO 9 Server cwe: CWE-22, CWE-434 disclosed: Apr 24, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-57728 KEV
SimpleHelp Path Traversal Vulnerability (CVE-2024-57728)
Detects exploitation of CVE-2024-57728, a path traversal vulnerability (CWE-22) in SimpleHelp remote support software versions 5.5.7 and earlier. Attackers can traverse directory boundaries to read arbitrary files from the server, potentially exposing credentials, configuration files, and sensitive system data. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: SimpleHelp product: SimpleHelp cwe: CWE-22 disclosed: Apr 24, 20267.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-39987 KEV
Marimo Remote Code Execution via Missing Authentication (CVE-2026-39987)
CVE-2026-39987 is a critical remote code execution vulnerability in the Marimo reactive notebook framework caused by missing authentication (CWE-306) for critical server-side functions. An unauthenticated remote attacker can invoke kernel execution endpoints to run arbitrary Python code in the context of the Marimo server process. This vulnerability is actively exploited in the wild and listed on the CISA KEV catalog.
vendor: Marimo product: Marimo cwe: CWE-306 disclosed: Apr 23, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-33825 KEV
CVE-2026-33825 - Microsoft Defender Insufficient Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-33825, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Defender. This KEV-listed vulnerability allows attackers to bypass Defender access controls, potentially disabling protections, modifying exclusions, or tampering with security configurations without appropriate privilege levels.
vendor: Microsoft product: Defender cwe: CWE-1220 disclosed: Apr 22, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-32975 KEV
Quest KACE SMA Improper Authentication Exploitation Detected
Detects exploitation attempts against CVE-2025-32975, an improper authentication vulnerability (CWE-287) in Quest KACE Systems Management Appliance (SMA). This KEV-listed vulnerability allows attackers to bypass authentication controls, potentially enabling unauthorized access to the SMA management interface and downstream managed endpoints. Successful exploitation could lead to full appliance compromise and lateral movement across managed systems.
vendor: Quest product: KACE Systems Management Appliance (SMA) cwe: CWE-287 disclosed: Apr 20, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2023-27351 KEV
CVE-2023-27351 - PaperCut NG/MF Improper Authentication Exploitation
Detects exploitation attempts targeting CVE-2023-27351, an improper authentication vulnerability (CWE-287) in PaperCut NG/MF print management software. This CISA KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls, potentially enabling unauthorized access to the PaperCut administration interface and sensitive print management data. Threat actors have actively exploited PaperCut vulnerabilities in the wild for initial access and lateral movement.
vendor: PaperCut product: NG/MF cwe: CWE-287 disclosed: Apr 20, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2026-20128 KEV
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format (CVE-2026-20128)
CVE-2026-20128 affects Cisco Catalyst SD-WAN Manager and involves storing passwords in a recoverable format (CWE-257). An attacker with local or network access to the SD-WAN Manager may be able to extract plaintext or weakly-obfuscated credentials from configuration files, databases, or memory. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation could lead to credential theft enabling lateral movement, further network compromise, or full SD-WAN infrastructure takeover.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-257 disclosed: Apr 20, 20267.5 highCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-20133 KEV
Cisco Catalyst SD-WAN Manager Sensitive Information Exposure (CVE-2026-20133)
Detects exploitation attempts targeting CVE-2026-20133, a CWE-200 information disclosure vulnerability in Cisco Catalyst SD-WAN Manager that allows unauthorized actors to access sensitive configuration and credential data. This vulnerability is actively exploited in the wild (CISA KEV) and may be leveraged to pivot into SD-WAN infrastructure.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-200 disclosed: Apr 20, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2024-27199 KEV
JetBrains TeamCity Relative Path Traversal (CVE-2024-27199)
Detects exploitation of CVE-2024-27199, a relative path traversal vulnerability in JetBrains TeamCity on-premises. Unauthenticated attackers can traverse directory paths in the TeamCity web server to access restricted endpoints and files outside the intended web root, potentially leading to information disclosure or authentication bypass chained with CVE-2024-27198.
vendor: JetBrains product: TeamCity cwe: CWE-23 disclosed: Apr 20, 20267.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lwrite-up soon - CVE-2025-2749 KEV
Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749)
Detects exploitation of CVE-2025-2749, a path traversal and unrestricted file upload vulnerability in Kentico Xperience CMS. Attackers can traverse directory boundaries to write arbitrary files — including web shells — to locations outside the intended upload path, enabling remote code execution on the hosting server. This CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: Kentico product: Kentico Xperience cwe: CWE-22, CWE-434 disclosed: Apr 20, 20267.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-48700 KEV
Zimbra Collaboration Suite XSS Exploitation (CVE-2025-48700)
Detects exploitation of a stored or reflected cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). This KEV-listed vulnerability allows attackers to inject malicious scripts into the Zimbra web client, potentially leading to session hijacking, credential theft, or further lateral movement within the organization. XSS in webmail platforms is frequently exploited by threat actors to steal session tokens and pivot to email account compromise.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-79 disclosed: Apr 20, 20266.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nwrite-up soon - CVE-2026-20122 KEV
Cisco Catalyst SD-WAN Manager Privileged API Abuse (CVE-2026-20122)
Detects exploitation of CVE-2026-20122, a critical vulnerability in Cisco Catalyst SD-WAN Manager involving incorrect use of privileged APIs (CWE-648). This KEV-listed flaw allows attackers to invoke privileged API endpoints without proper authorization, potentially enabling unauthorized configuration changes, credential harvesting, or full SD-WAN infrastructure takeover. Active exploitation has been observed in the wild per CISA Emergency Directive ED-26-03.
vendor: Cisco product: Catalyst SD-WAN Manger cwe: CWE-648 disclosed: Apr 20, 20265.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nwrite-up soon - CVE-2026-34197 KEV
Apache ActiveMQ Improper Input Validation (CVE-2026-34197)
Detects exploitation of CVE-2026-34197, an improper input validation vulnerability (CWE-20/CWE-94) in Apache ActiveMQ that has been added to the CISA Known Exploited Vulnerabilities catalog. Successful exploitation may allow remote attackers to execute arbitrary code or inject malicious content via crafted messages or broker connections. ActiveMQ's OpenWire protocol and web console are common attack surfaces for this class of vulnerability.
vendor: Apache product: ActiveMQ cwe: CWE-20, CWE-94 disclosed: Apr 16, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2009-0238 KEV
Microsoft Office Remote Code Execution (CVE-2009-0238)
CVE-2009-0238 is a remote code execution vulnerability in Microsoft Office (addressed in MS09-009) caused by improper handling of specially crafted Excel files, leading to arbitrary code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and has been actively exploited in the wild via malicious Office documents delivered through phishing campaigns.
vendor: Microsoft product: Office cwe: CWE-94 disclosed: Apr 14, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-32201 KEV
Microsoft SharePoint Server Improper Input Validation (CVE-2026-32201)
Detects exploitation of CVE-2026-32201, an improper input validation vulnerability in Microsoft SharePoint Server. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to send crafted HTTP requests to SharePoint endpoints to bypass input validation controls, potentially enabling unauthorized access, remote code execution, or data exfiltration. CWE-20 class vulnerabilities in SharePoint have historically been leveraged for initial access and lateral movement in enterprise environments.
vendor: Microsoft product: SharePoint Server cwe: CWE-20 disclosed: Apr 14, 20266.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nwrite-up soon - CVE-2026-21643 KEV
Fortinet FortiClient EMS SQL Injection Exploitation (CVE-2026-21643)
Detects exploitation attempts targeting a SQL injection vulnerability in Fortinet FortiClient EMS (CVE-2026-21643). This KEV-listed vulnerability allows unauthenticated or authenticated attackers to inject malicious SQL statements into FortiClient EMS, potentially enabling data exfiltration, authentication bypass, or remote code execution via database-level commands such as xp_cmdshell.
vendor: Fortinet product: FortiClient EMS cwe: CWE-89 disclosed: Apr 13, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2023-21529 KEV
Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529)
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
vendor: Microsoft product: Exchange Server cwe: CWE-502 disclosed: Apr 13, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-34621 KEV
Adobe Acrobat and Reader Prototype Pollution Vulnerability (CVE-2026-34621)
Detects exploitation of CVE-2026-34621, a prototype pollution vulnerability (CWE-1321) in Adobe Acrobat and Reader. This KEV-listed vulnerability allows attackers to manipulate JavaScript object prototypes within PDF processing, potentially leading to arbitrary code execution, privilege escalation, or sandbox escape. Exploitation typically occurs via malicious PDF documents that trigger prototype chain manipulation during rendering or form processing.
vendor: Adobe product: Acrobat and Reader cwe: CWE-1321 disclosed: Apr 13, 20268.6 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2012-1854 KEV
CVE-2012-1854 - Microsoft VBA Insecure Library Loading (DLL Hijacking)
Detects exploitation of CVE-2012-1854, a DLL hijacking vulnerability in Microsoft Visual Basic for Applications (VBA). Attackers can place a malicious DLL in a directory searched before the legitimate library path, causing Office applications loading VBA to execute attacker-controlled code. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: Visual Basic for Applications (VBA) cwe: CWE-426 disclosed: Apr 13, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2020-9715 KEV
Adobe Acrobat Use-After-Free Exploitation (CVE-2020-9715)
Detects exploitation of CVE-2020-9715, a use-after-free vulnerability in Adobe Acrobat that allows arbitrary code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in the wild. Attackers typically deliver malicious PDF documents that trigger memory corruption upon rendering, leading to code execution in the context of the Acrobat process.
vendor: Adobe product: Acrobat cwe: CWE-416 disclosed: Apr 13, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2023-36424 KEV
CVE-2023-36424 - Microsoft Windows Out-of-Bounds Read Exploitation
Detects exploitation attempts of CVE-2023-36424, a Microsoft Windows out-of-bounds read vulnerability (CWE-125) listed in CISA's Known Exploited Vulnerabilities catalog. Out-of-bounds read vulnerabilities in Windows kernel or system components can be leveraged for privilege escalation, information disclosure, or as a stepping stone in exploit chains. This detection monitors for anomalous process behavior, crash artifacts, and privilege escalation patterns consistent with exploitation of this class of vulnerability.
vendor: Microsoft product: Windows cwe: CWE-125 disclosed: Apr 13, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-60710 KEV
Microsoft Windows Link Following Vulnerability (CVE-2025-60710)
CVE-2025-60710 is an actively exploited Microsoft Windows link following vulnerability (CWE-59) that allows an attacker to abuse symbolic links or junction points to redirect file operations to unintended locations. This class of vulnerability is commonly leveraged for privilege escalation, file tampering, or unauthorized access to protected resources. The vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.
vendor: Microsoft product: Windows cwe: CWE-59 disclosed: Apr 13, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-1340 KEV
Ivanti EPMM Code Injection Exploitation (CVE-2026-1340)
Detects exploitation attempts targeting CVE-2026-1340, a code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows remote attackers to inject and execute arbitrary code via the EPMM management interface. Successful exploitation may lead to full device management compromise, lateral movement, and data exfiltration from enrolled mobile devices.
vendor: Ivanti product: Endpoint Manager Mobile (EPMM) cwe: CWE-94 disclosed: Apr 8, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-35616 KEV
CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-35616, an improper access control vulnerability (CWE-284) in Fortinet FortiClient Enterprise Management Server (EMS). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may leverage this flaw to bypass access controls on the EMS server, potentially enabling unauthorized configuration changes, endpoint agent manipulation, or lateral movement through managed endpoints.
vendor: Fortinet product: FortiClient EMS cwe: CWE-284 disclosed: Apr 6, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-3502 KEV
TrueConf Client Download of Code Without Integrity Check (CVE-2026-3502)
Detects exploitation of CVE-2026-3502, a CWE-494 (Download of Code Without Integrity Check) vulnerability in TrueConf Client. An attacker with a network position to intercept or manipulate TrueConf Client update/download channels can deliver unsigned or tampered code to client systems, enabling arbitrary code execution. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: TrueConf product: Client cwe: CWE-494 disclosed: Apr 2, 20267.8 highCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:Lwrite-up soon - CVE-2026-5281 KEV
CVE-2026-5281 — Google Dawn Use-After-Free Exploitation
Detects exploitation of CVE-2026-5281, a use-after-free vulnerability in Google Dawn (the WebGPU implementation used by Chrome). Exploitation may result in renderer compromise, sandbox escape, or arbitrary code execution via a malicious web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Google product: Dawn cwe: CWE-416 disclosed: Apr 1, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-3055 KEV
Citrix NetScaler Out-of-Bounds Read (CVE-2026-3055)
Detects exploitation attempts targeting CVE-2026-3055, an out-of-bounds read vulnerability (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway. This vulnerability is actively exploited in the wild (CISA KEV) and may allow unauthenticated remote attackers to read sensitive memory contents, potentially leading to information disclosure or enabling further attacks. Detection focuses on anomalous HTTP request patterns, NetScaler management plane access, and memory-related crash indicators.
vendor: Citrix product: NetScaler cwe: CWE-125 disclosed: Mar 30, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-53521 KEV
F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521)
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
vendor: F5 product: BIG-IP cwe: CWE-121 disclosed: Mar 27, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-33634 KEV
Aquasecurity Trivy Embedded Malicious Code (CVE-2026-33634)
CVE-2026-33634 describes an embedded malicious code vulnerability (CWE-506) in Aquasecurity Trivy, a widely-used open-source vulnerability scanner. A compromised or trojanized Trivy binary may execute attacker-controlled code during container image scanning, CI/CD pipeline runs, or Kubernetes admission checks. Because Trivy is frequently granted elevated permissions to access container registries, Kubernetes API servers, and cloud credential chains, a backdoored instance poses critical supply-chain risk: exfiltration of secrets, lateral movement into CI/CD infrastructure, and persistent implant installation. This detection monitors for anomalous process behavior, unexpected network egress, and suspicious file activity originating from Trivy processes.
vendor: Aquasecurity product: Trivy cwe: CWE-506 disclosed: Mar 26, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-33017 KEV
CVE-2026-33017: Langflow Code Injection Vulnerability
Detects exploitation of CVE-2026-33017, a code injection vulnerability in Langflow that allows unauthenticated or low-privileged attackers to execute arbitrary code via the Langflow API. The vulnerability stems from improper input validation (CWE-94/CWE-95) combined with missing authentication controls (CWE-306), enabling remote code execution against Langflow instances. This CVE is on the CISA KEV list, indicating active exploitation in the wild.
vendor: Langflow product: Langflow cwe: CWE-94, CWE-95 disclosed: Mar 25, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-32432 KEV
CVE-2025-32432: Craft CMS Remote Code Injection
Detects exploitation of CVE-2025-32432, a critical code injection vulnerability (CWE-94) in Craft CMS that allows remote attackers to execute arbitrary code. This vulnerability is actively exploited in the wild (CISA KEV) and targets Craft CMS installations via malicious template or input injection vectors.
vendor: Craft CMS product: Craft CMS cwe: CWE-94 disclosed: Mar 20, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2025-54068 KEV
Laravel Livewire Code Injection (CVE-2025-54068)
Detects exploitation of CVE-2025-54068, a code injection vulnerability in Laravel Livewire. This KEV-listed vulnerability allows attackers to inject and execute arbitrary PHP code through Livewire component handling, potentially leading to remote code execution on affected Laravel applications.
vendor: Laravel product: Livewire cwe: CWE-94 disclosed: Mar 20, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-31277 KEV
Apple Multiple Products Buffer Overflow Exploitation (CVE-2025-31277)
Detects potential exploitation of CVE-2025-31277, a buffer overflow vulnerability (CWE-119) affecting multiple Apple products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation may allow attackers to execute arbitrary code, escalate privileges, or cause denial of service on affected Apple devices and systems.
vendor: Apple product: Multiple Products cwe: CWE-119 disclosed: Mar 20, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-43510 KEV
Apple Multiple Products Improper Locking Vulnerability (CVE-2025-43510)
CVE-2025-43510 is an improper locking vulnerability (CWE-667) affecting multiple Apple products, including macOS, iOS, iPadOS, tvOS, visionOS, and watchOS. This flaw, added to CISA's Known Exploited Vulnerabilities catalog, allows an attacker with local access to potentially exploit race conditions arising from improper mutex or lock management, leading to privilege escalation, memory corruption, or kernel-level code execution. Detection focuses on anomalous kernel panics, unexpected privilege escalations, exploitation of race conditions, and post-exploitation indicators on Apple endpoints.
vendor: Apple product: Multiple Products cwe: CWE-667 disclosed: Mar 20, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-43520 KEV
Apple Multiple Products Classic Buffer Overflow Exploitation (CVE-2025-43520)
Detects exploitation attempts targeting CVE-2025-43520, a classic buffer overflow vulnerability (CWE-120) affecting Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Buffer overflow exploitation may manifest as abnormal process crashes, memory corruption signals, unexpected child process spawning from Apple system processes, or anomalous network connections following process exploitation.
vendor: Apple product: Multiple Products cwe: CWE-120 disclosed: Mar 20, 20265.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hwrite-up soon - CVE-2026-20131 KEV
Cisco FMC/SCC Deserialization RCE Exploitation (CVE-2026-20131)
Detects exploitation of CVE-2026-20131, a deserialization of untrusted data vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management. Successful exploitation allows unauthenticated or authenticated remote attackers to execute arbitrary commands on the underlying OS. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Cisco product: Secure Firewall Management Center (FMC) cwe: CWE-502 disclosed: Mar 19, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-20963 KEV
Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-20963)
Detects exploitation of CVE-2026-20963, a deserialization of untrusted data vulnerability in Microsoft SharePoint. Attackers can send crafted serialized payloads to SharePoint endpoints, leading to remote code execution in the context of the SharePoint application pool. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: Microsoft product: SharePoint cwe: CWE-502 disclosed: Mar 18, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-66376 KEV
Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploitation
Detects exploitation attempts targeting CVE-2025-66376, a cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite (ZCS). This KEV-listed vulnerability allows attackers to inject malicious scripts into the Zimbra web interface, potentially leading to session hijacking, credential theft, or further compromise of email infrastructure. Active exploitation has been confirmed by CISA.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-79 disclosed: Mar 18, 20266.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nwrite-up soon - CVE-2025-47813 KEV
Wing FTP Server Information Disclosure via Error Messages (CVE-2025-47813)
Detects potential exploitation of CVE-2025-47813, an information disclosure vulnerability in Wing FTP Server (CWE-209) where detailed error messages expose sensitive server-side information. This vulnerability is actively exploited in the wild (CISA KEV). Attackers may probe the FTP server with malformed or unexpected requests to trigger verbose error responses revealing internal paths, software versions, configuration details, or stack traces.
vendor: Wing FTP Server product: Wing FTP Server cwe: CWE-209 disclosed: Mar 16, 20264.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nwrite-up soon - CVE-2026-3909 KEV
Google Skia Out-of-Bounds Write (CVE-2026-3909)
Detects exploitation attempts targeting CVE-2026-3909, an out-of-bounds write vulnerability in Google Skia graphics library. Skia is embedded in Chrome and other Google products. Exploitation can lead to arbitrary code execution via crafted web content or malicious files. This vulnerability is confirmed exploited in the wild (CISA KEV).
vendor: Google product: Skia cwe: CWE-787 disclosed: Mar 13, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-3910 KEV
CVE-2026-3910: Google Chromium V8 Memory Buffer Bounds Violation
Detects exploitation attempts and post-exploitation indicators related to CVE-2026-3910, an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Google Chromium's V8 JavaScript engine. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve remote code execution via a malicious web page, potentially leading to sandbox escape and full system compromise.
vendor: Google product: Chromium V8 cwe: CWE-119 disclosed: Mar 13, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-68613 KEV
n8n Improper Control of Dynamically-Managed Code Resources (CVE-2025-68613)
Detects exploitation of CVE-2025-68613, a critical vulnerability in n8n workflow automation platform where improper control of dynamically-managed code resources (CWE-913) allows attackers to execute arbitrary code. This vulnerability is actively exploited in the wild (CISA KEV). Attackers can abuse n8n's Code node or expression evaluation engine to break out of intended sandboxing and execute arbitrary system commands on the underlying host.
vendor: n8n product: n8n cwe: CWE-913 disclosed: Mar 11, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-26399 KEV
SolarWinds Web Help Desk Deserialization of Untrusted Data (CVE-2025-26399)
CVE-2025-26399 is a deserialization of untrusted data vulnerability (CWE-502) in SolarWinds Web Help Desk. Exploitation allows remote attackers to execute arbitrary code by sending maliciously crafted serialized Java objects to the application. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. SolarWinds Web Help Desk is widely deployed in enterprise and government environments for IT service management, making this a high-priority target for threat actors seeking privileged network access.
vendor: SolarWinds product: Web Help Desk cwe: CWE-502 disclosed: Mar 9, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2021-22054 KEV
Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054)
Detects exploitation of CVE-2021-22054, a Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM. An unauthenticated attacker can send crafted HTTP requests to the UEM server, causing it to make arbitrary outbound HTTP/HTTPS requests to internal or external resources. This can be leveraged to scan internal networks, access cloud metadata services (e.g., AWS IMDS), or pivot to internal services not directly reachable by the attacker. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Omnissa product: Workspace One UEM cwe: CWE-918 disclosed: Mar 9, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2026-1603 KEV
Ivanti Endpoint Manager (EPM) Authentication Bypass (CVE-2026-1603)
CVE-2026-1603 is an authentication bypass vulnerability (CWE-288) in Ivanti Endpoint Manager (EPM). This KEV-listed vulnerability allows unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to the EPM management interface. Successful exploitation may lead to full compromise of managed endpoints, lateral movement, and deployment of malicious software across the enterprise.
vendor: Ivanti product: Endpoint Manager (EPM) cwe: CWE-288 disclosed: Mar 9, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2017-7921 KEV
Hikvision Improper Authentication Exploitation (CVE-2017-7921)
Detects exploitation attempts targeting CVE-2017-7921, an improper authentication vulnerability (CWE-287) in Hikvision IP cameras and multiple products. This vulnerability allows unauthenticated attackers to bypass authentication and gain unauthorized access to camera streams, configurations, and credentials by manipulating URL parameters. Listed on CISA KEV, indicating active exploitation in the wild. Attackers commonly use this to gain persistent access to surveillance infrastructure, pivot within networks, or exfiltrate sensitive footage.
vendor: Hikvision product: Multiple Products cwe: CWE-287 disclosed: Mar 5, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2021-22681 KEV
Rockwell Automation Logix Controllers Insufficient Credential Protection (CVE-2021-22681)
CVE-2021-22681 is an insufficient protection of credentials vulnerability (CWE-522) affecting Rockwell Automation multiple products including Logix controllers. An attacker can intercept or obtain weakly protected credentials used to authenticate with Logix controllers, enabling authentication bypass. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and poses critical risk in OT/ICS environments where unauthorized controller access could cause process disruption or physical damage.
vendor: Rockwell product: Multiple Products cwe: CWE-522 disclosed: Mar 5, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2023-43000 KEV
Apple Multiple Products Use-After-Free Vulnerability (CVE-2023-43000)
Detects exploitation of CVE-2023-43000, a use-after-free vulnerability (CWE-416) affecting multiple Apple products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Use-after-free conditions in Apple system components can allow attackers to execute arbitrary code, escalate privileges, or achieve kernel-level compromise on affected macOS, iOS, and related platforms.
vendor: Apple product: Multiple Products cwe: CWE-416 disclosed: Mar 5, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2021-30952 KEV
CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation
Detects exploitation attempts of CVE-2021-30952, an integer overflow vulnerability in Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Integer overflow conditions in Apple platform components can lead to memory corruption, arbitrary code execution, or privilege escalation.
vendor: Apple product: Multiple Products cwe: CWE-190 disclosed: Mar 5, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2023-41974 KEV
Apple iOS/iPadOS Use-After-Free Exploitation (CVE-2023-41974)
Detects exploitation attempts and post-exploitation activity related to CVE-2023-41974, a use-after-free vulnerability in Apple iOS and iPadOS. This vulnerability allows an attacker to achieve arbitrary code execution, potentially leading to full device compromise. It is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Detection focuses on mobile device management telemetry, abnormal process behavior on managed Apple devices, and network indicators associated with mobile exploit frameworks.
vendor: Apple product: iOS and iPadOS cwe: CWE-416 disclosed: Mar 5, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-22719 KEV
CVE-2026-22719: VMware Aria Operations Command Injection
Detects exploitation of CVE-2026-22719, a command injection vulnerability (CWE-77) in Broadcom VMware Aria Operations. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through unsanitized input, potentially leading to full host compromise, lateral movement, and persistence within virtualized environments.
vendor: Broadcom product: VMware Aria Operations cwe: CWE-77 disclosed: Mar 3, 20268.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-20127 KEV
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass (CVE-2026-20127)
CVE-2026-20127 is an authentication bypass vulnerability (CWE-287) affecting Cisco Catalyst SD-WAN Controller and Manager. A remote, unauthenticated attacker may exploit improper authentication mechanisms to gain unauthorized access to the management plane. This vulnerability is actively exploited in the wild per CISA KEV and is subject to Emergency Directive ED-26-03.
vendor: Cisco product: Catalyst SD-WAN Controller and Manager cwe: CWE-287 disclosed: Feb 25, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2022-20775 KEV
CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt
Detects exploitation attempts targeting CVE-2022-20775, a path traversal vulnerability (CWE-25, CWE-282) in Cisco SD-WAN software. Successful exploitation may allow an authenticated attacker to read or write arbitrary files on the underlying operating system, potentially leading to privilege escalation or persistent access. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Cisco product: SD-WAN cwe: CWE-25, CWE-282 disclosed: Feb 25, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-25108 KEV
Soliton FileZen OS Command Injection Exploitation (CVE-2026-25108)
Detects exploitation of CVE-2026-25108, an OS command injection vulnerability (CWE-78) in Soliton Systems K.K FileZen file-sharing appliance. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog and allows unauthenticated or authenticated attackers to inject arbitrary OS commands through vulnerable input fields, potentially leading to full system compromise.
vendor: Soliton Systems K.K product: FileZen cwe: CWE-78 disclosed: Feb 24, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-49113 KEV
RoundCube Webmail Deserialization of Untrusted Data (CVE-2025-49113)
CVE-2025-49113 is an actively exploited deserialization of untrusted data vulnerability (CWE-502) in Roundcube Webmail. When exploited, an attacker can send a specially crafted serialized PHP object via the web interface, leading to remote code execution on the underlying server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and requires immediate patching to versions 1.5.10 or 1.6.11.
vendor: Roundcube product: Webmail cwe: CWE-502 disclosed: Feb 20, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-68461 KEV
RoundCube Webmail Cross-Site Scripting (XSS) Exploitation Attempt
Detects exploitation attempts targeting CVE-2025-68461, a stored/reflected cross-site scripting vulnerability in RoundCube Webmail. This vulnerability, listed in CISA's Known Exploited Vulnerabilities catalog, allows attackers to inject malicious scripts via email content, potentially leading to session hijacking, credential theft, or further compromise of the mail server environment. Affected versions include RoundCube Webmail prior to 1.5.12 and 1.6.12.
vendor: Roundcube product: Webmail cwe: CWE-79 disclosed: Feb 20, 20266.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nwrite-up soon - CVE-2026-22769 KEV
Dell RecoverPoint for Virtual Machines (RP4VMs) Hard-coded Credentials Exploitation
Detects exploitation of CVE-2026-22769, a hard-coded credentials vulnerability in Dell RecoverPoint for Virtual Machines (RP4VMs). Threat actors (including UNC6201) have actively exploited this zero-day to gain unauthorized access to RP4VMs appliances, enabling lateral movement, data exfiltration, and ransomware deployment within virtualized environments. The hard-coded credentials allow unauthenticated remote access to RP4VMs management interfaces.
vendor: Dell product: RecoverPoint for Virtual Machines (RP4VMs) cwe: CWE-798 disclosed: Feb 18, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2021-22175 KEV
GitLab SSRF Exploitation (CVE-2021-22175)
Detects exploitation of CVE-2021-22175, a Server-Side Request Forgery (SSRF) vulnerability in GitLab. An attacker can craft requests that cause the GitLab server to make HTTP requests to internal or external resources, potentially exposing cloud metadata endpoints, internal services, or facilitating lateral movement. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: GitLab product: GitLab cwe: CWE-918 disclosed: Feb 18, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2020-7796 KEV
Zimbra Collaboration Suite SSRF Exploitation (CVE-2020-7796)
Detects exploitation attempts targeting CVE-2020-7796, a Server-Side Request Forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). This vulnerability allows unauthenticated remote attackers to make the Zimbra server issue arbitrary HTTP requests to internal or external resources, potentially enabling internal network scanning, credential theft, or pivoting to internal services.
vendor: Synacor product: Zimbra Collaboration Suite cwe: CWE-918 disclosed: Feb 17, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2008-0015 KEV
Microsoft Windows Video ActiveX Control Remote Code Execution (CVE-2008-0015)
Detects exploitation attempts targeting the Microsoft Windows Video ActiveX Control vulnerability (CVE-2008-0015), addressed in MS09-032. The msvidctl.dll ActiveX control contains a memory corruption flaw that allows remote attackers to execute arbitrary code via a crafted web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in drive-by download campaigns.
vendor: Microsoft product: Windows disclosed: Feb 17, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-2441 KEV
CVE-2026-2441: Google Chromium CSS Use-After-Free Exploitation
Detects exploitation of CVE-2026-2441, a use-after-free vulnerability in the CSS engine of Google Chromium. This vulnerability is actively exploited in the wild (CISA KEV) and can allow remote code execution via a malicious web page. Detection focuses on abnormal Chromium renderer process behavior, suspicious child process spawning, and memory corruption indicators consistent with UAF exploitation.
vendor: Google product: Chromium cwe: CWE-416 disclosed: Feb 17, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-7694 KEV
TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694)
CVE-2024-7694 is an unrestricted file upload vulnerability (CWE-434) in TeamT5 ThreatSonar Anti-Ransomware. An attacker can upload files with dangerous types to the ThreatSonar management interface, potentially achieving remote code execution on the host running the security product. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation of a security product creates a high-impact scenario where the attacker may gain privileged access to the endpoint security management plane.
vendor: TeamT5 product: ThreatSonar Anti-Ransomware cwe: CWE-434 disclosed: Feb 17, 20267.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-43468 KEV
CVE-2024-43468: Microsoft Configuration Manager SQL Injection Exploitation
Detects exploitation attempts targeting CVE-2024-43468, a SQL injection vulnerability in Microsoft Configuration Manager (SCCM/ConfigMgr). This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands against the ConfigMgr site database, potentially leading to remote code execution, credential theft, and lateral movement within the environment. Listed in CISA KEV indicating active exploitation in the wild.
vendor: Microsoft product: Configuration Manager cwe: CWE-89 disclosed: Feb 12, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-40536 KEV
SolarWinds Web Help Desk Security Control Bypass (CVE-2025-40536)
Detects exploitation of CVE-2025-40536, a security control bypass vulnerability (CWE-693) in SolarWinds Web Help Desk. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass authentication or authorization controls within the Web Help Desk application. Successful exploitation may enable unauthorized access to ticketing data, credential stores, or administrative functions.
vendor: SolarWinds product: Web Help Desk cwe: CWE-693 disclosed: Feb 12, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-20700 KEV
Apple Multiple Products Buffer Overflow Exploitation (CVE-2026-20700)
Detects exploitation attempts and post-exploitation activity related to CVE-2026-20700, a buffer overflow vulnerability (CWE-119) affecting multiple Apple products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Buffer overflow exploitation against Apple platforms may result in arbitrary code execution, privilege escalation, or sandbox escape.
vendor: Apple product: Multiple Products cwe: CWE-119 disclosed: Feb 12, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-15556 KEV
Notepad++ Download of Code Without Integrity Check (CVE-2025-15556)
CVE-2025-15556 is a CWE-494 (Download of Code Without Integrity Check) vulnerability in Notepad++ that has been added to CISA's Known Exploited Vulnerabilities catalog. The vulnerability allows an attacker to deliver malicious code through Notepad++'s update or plugin mechanism without cryptographic integrity verification, enabling arbitrary code execution in the context of the user running Notepad++. This is actively exploited in the wild and should be treated as high-priority for endpoint detection and response.
vendor: Notepad++ product: Notepad++ cwe: CWE-494 disclosed: Feb 12, 20267.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21510 KEV
CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure
Detects exploitation of CVE-2026-21510, a Microsoft Windows Shell protection mechanism failure (CWE-693) that allows attackers to bypass security controls enforced by the Windows Shell. This vulnerability is actively exploited in the wild (CISA KEV). Attackers may abuse this flaw to execute unauthorized code, bypass security prompts, or escalate privileges via crafted shell interactions.
vendor: Microsoft product: Windows cwe: CWE-693 disclosed: Feb 10, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21513 KEV
CVE-2026-21513 — Microsoft MSHTML Framework Protection Mechanism Failure
Detects exploitation of CVE-2026-21513, a protection mechanism failure (CWE-693) in the Microsoft MSHTML framework on Windows. This KEV-listed vulnerability allows attackers to bypass security controls implemented in MSHTML, potentially enabling code execution via crafted web content processed by Internet Explorer compatibility components, Microsoft Office documents embedding web content, or applications using the WebBrowser control. Active exploitation has been confirmed by CISA.
vendor: Microsoft product: Windows cwe: CWE-693 disclosed: Feb 10, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21514 KEV
Microsoft Office Word Reliance on Untrusted Inputs in Security Decision (CVE-2026-21514)
Detects exploitation of CVE-2026-21514, a Microsoft Office Word vulnerability classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This flaw allows attackers to manipulate security-relevant decisions in Word by supplying crafted untrusted input, potentially bypassing security controls such as Protected View, macro policy enforcement, or document trust decisions. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: Microsoft product: Office cwe: CWE-807 disclosed: Feb 10, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21519 KEV
Microsoft Windows Type Confusion Vulnerability (CVE-2026-21519)
Detects exploitation of CVE-2026-21519, a type confusion vulnerability (CWE-843) in Microsoft Windows. Type confusion vulnerabilities occur when code allocates or initializes a resource using one type but accesses it using an incompatible type, leading to out-of-bounds memory access, arbitrary code execution, or privilege escalation. This CVE is listed on the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: Microsoft product: Windows cwe: CWE-843 disclosed: Feb 10, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21533 KEV
Microsoft Windows Improper Privilege Management (CVE-2026-21533)
Detects exploitation of CVE-2026-21533, a Microsoft Windows Improper Privilege Management vulnerability (CWE-269) listed in CISA's Known Exploited Vulnerabilities catalog. Successful exploitation allows a local attacker to elevate privileges on a compromised Windows system. Detection focuses on anomalous privilege token manipulation, unexpected service/process privilege escalation, and suspicious access patterns consistent with local privilege escalation techniques.
vendor: Microsoft product: Windows cwe: CWE-269 disclosed: Feb 10, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21525 KEV
CVE-2026-21525 - Microsoft Windows NULL Pointer Dereference Exploitation
Detects exploitation attempts and post-exploitation activity related to CVE-2026-21525, a NULL pointer dereference vulnerability in Microsoft Windows. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve privilege escalation or code execution via memory corruption techniques targeting Windows kernel or user-mode components.
vendor: Microsoft product: Windows cwe: CWE-476 disclosed: Feb 10, 20266.2 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hwrite-up soon - CVE-2026-1731 KEV PoC
BeyondTrust Remote Support Pre-Auth RCE (CVE-2026-1731)
Detects exploitation of CVE-2026-1731, a pre-authentication remote code execution vulnerability (CWE-78, OS command injection) in BeyondTrust Remote Support and Privileged Remote Access. CVSS 9.8. Actively exploited in the wild (CISA KEV). Attackers can execute arbitrary OS commands without authentication via crafted HTTP requests to the appliance web interface.
vendor: BeyondTrust product: Remote Support, Privileged Remote Access cwe: CWE-78 disclosed: Feb 6, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-11953 KEV
React Native Community CLI OS Command Injection (CVE-2025-11953)
Detects exploitation of CVE-2025-11953, an OS command injection vulnerability (CWE-78) in the React Native Community CLI. An attacker who can influence arguments or configuration consumed by the React Native CLI can inject arbitrary OS commands that execute with the privileges of the developer or CI/CD process invoking the CLI. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: React Native Community product: CLI cwe: CWE-78 disclosed: Feb 5, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-24423 KEV
SmarterMail Missing Authentication for Critical Function (CVE-2026-24423)
Detects exploitation of CVE-2026-24423, a missing authentication vulnerability (CWE-306) in SmarterTools SmarterMail. This KEV-listed vulnerability allows unauthenticated attackers to access critical functions in SmarterMail, potentially enabling unauthorized administrative access, data exfiltration, or further lateral movement. Detection focuses on unauthenticated access patterns to administrative and critical API endpoints.
vendor: SmarterTools product: SmarterMail cwe: CWE-306 disclosed: Feb 5, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2019-19006 KEV
Sangoma FreePBX Remote Admin Authentication Bypass (CVE-2019-19006)
CVE-2019-19006 is an improper authentication vulnerability (CWE-287) in Sangoma FreePBX that allows remote unauthenticated attackers to bypass administrative authentication controls. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation grants attackers full administrative access to the FreePBX VoIP management interface, enabling call interception, configuration tampering, toll fraud, and potential lateral movement into the broader network.
vendor: Sangoma product: FreePBX cwe: CWE-287 disclosed: Feb 3, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-40551 KEV
CVE-2025-40551 — SolarWinds Web Help Desk Deserialization RCE
Detects exploitation of CVE-2025-40551, a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. Successful exploitation allows unauthenticated or low-privileged attackers to achieve remote code execution on the WHD server. This CVE is listed in CISA KEV, indicating active exploitation in the wild.
vendor: SolarWinds product: Web Help Desk cwe: CWE-502 disclosed: Feb 3, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2021-39935 KEV
GitLab SSRF via Import Feature (CVE-2021-39935)
CVE-2021-39935 is a Server-Side Request Forgery (SSRF) vulnerability in GitLab Community and Enterprise Editions. An attacker can abuse GitLab's project import or integration features to cause the server to issue arbitrary HTTP requests to internal network resources, enabling reconnaissance, metadata service access, and potential lateral movement within cloud-hosted or on-premises GitLab deployments. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: GitLab product: Community and Enterprise Editions cwe: CWE-918 disclosed: Feb 3, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2025-64328 KEV
Sangoma FreePBX OS Command Injection (CVE-2025-64328)
Detects exploitation of an OS command injection vulnerability in Sangoma FreePBX. An authenticated or unauthenticated attacker may inject arbitrary OS commands through vulnerable FreePBX web interfaces or API endpoints, leading to remote code execution on the underlying Linux host. This vulnerability is tracked as CVE-2025-64328 and is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Sangoma product: FreePBX cwe: CWE-78 disclosed: Feb 3, 20267.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-1281 KEV
CVE-2026-1281 — Ivanti EPMM Code Injection Exploitation
Detects exploitation of CVE-2026-1281, a code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM). This KEV-listed vulnerability allows remote attackers to inject and execute arbitrary code via the EPMM management interface. Detection focuses on anomalous process execution, suspicious web shell activity, and unexpected outbound connections from EPMM server infrastructure.
vendor: Ivanti product: Endpoint Manager Mobile (EPMM) cwe: CWE-94 disclosed: Jan 29, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-24858 KEV
Fortinet Multiple Products Authentication Bypass via Alternate Path or Channel (CVE-2026-24858)
Detects exploitation of CVE-2026-24858, an authentication bypass vulnerability (CWE-288) affecting multiple Fortinet products. Attackers abuse an alternate authentication path or channel — specifically SSO abuse on FortiOS — to bypass normal authentication controls and gain unauthorized access. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: Fortinet product: Multiple Products cwe: CWE-288 disclosed: Jan 27, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-52691 KEV
SmarterMail Unrestricted File Upload Exploitation (CVE-2025-52691)
Detects exploitation of CVE-2025-52691, an unrestricted file upload vulnerability in SmarterTools SmarterMail. This vulnerability allows attackers to upload files with dangerous types (e.g., web shells, executables) to the mail server, potentially enabling remote code execution. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: SmarterTools product: SmarterMail cwe: CWE-434 disclosed: Jan 26, 202610.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2026-23760 KEV
SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760)
Detects exploitation of CVE-2026-23760, an authentication bypass vulnerability (CWE-288) in SmarterTools SmarterMail. Attackers can access protected functionality through an alternate path or channel without valid credentials, potentially leading to unauthorized mailbox access, data exfiltration, or lateral movement. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: SmarterTools product: SmarterMail cwe: CWE-288 disclosed: Jan 26, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-24061 KEV
GNU InetUtils Argument Injection Vulnerability (CVE-2026-24061)
CVE-2026-24061 is an argument injection vulnerability (CWE-88) in GNU InetUtils affecting utilities such as telnet, ftp, rsh, rcp, and related tools. An attacker who can control arguments passed to InetUtils binaries may inject additional command-line options, potentially enabling unauthorized network access, privilege escalation, or lateral movement. This vulnerability is listed on the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: GNU product: InetUtils cwe: CWE-88 disclosed: Jan 26, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2018-14634 KEV
Linux Kernel Integer Overflow in create_elf_tables (CVE-2018-14634)
CVE-2018-14634 is an integer overflow vulnerability in the Linux kernel's create_elf_tables() function, triggered during process execution via the execve syscall. A local unprivileged attacker can exploit this flaw to achieve privilege escalation to root by crafting a binary with an extremely large argument list. This vulnerability exists in Linux kernel versions 2.6.x through 4.14.x and is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Linux product: Kernel cwe: CWE-190 disclosed: Jan 26, 20267.8 highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-21509 KEV
Microsoft Office Security Feature Bypass (CVE-2026-21509)
Detects exploitation of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass security controls within Office applications, potentially enabling malicious document execution without expected security warnings or Protected View enforcement.
vendor: Microsoft product: Office cwe: CWE-807 disclosed: Jan 26, 20267.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-37079 KEV
VMware vCenter Server Out-of-bounds Write (CVE-2024-37079)
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
vendor: Broadcom product: VMware vCenter Server cwe: CWE-787 disclosed: Jan 23, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-68645 KEV
Synacor Zimbra Collaboration Suite PHP Remote File Inclusion (CVE-2025-68645)
Detects exploitation of CVE-2025-68645, a PHP Remote File Inclusion (RFI) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CWE-98 class vulnerabilities allow attackers to inject and execute remote PHP files via unsanitized user-controlled input passed to PHP file inclusion functions, enabling arbitrary code execution in the context of the web server process. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-98 disclosed: Jan 22, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-31125 KEV
CVE-2025-31125: Vite Dev Server Improper Access Control
Detects exploitation of CVE-2025-31125, an improper access control vulnerability in Vite (Vitejs) dev server. The vulnerability allows unauthorized access to sensitive files outside the intended serve root, classified under CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.
vendor: Vite product: Vitejs cwe: CWE-200, CWE-284 disclosed: Jan 22, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2025-34026 KEV
Versa Concerto Improper Authentication (CVE-2025-34026)
Detects exploitation attempts targeting CVE-2025-34026, an improper authentication vulnerability (CWE-288) in Versa Concerto SD-WAN orchestration platform. This vulnerability allows attackers to bypass authentication controls, potentially enabling unauthorized access to the Concerto management interface. Listed as a CISA KEV, indicating active exploitation in the wild.
vendor: Versa product: Concerto cwe: CWE-288 disclosed: Jan 22, 20267.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2025-54313 KEV
Prettier eslint-config-prettier Embedded Malicious Code (CVE-2025-54313)
Detects exploitation indicators related to CVE-2025-54313, a supply chain compromise affecting the eslint-config-prettier npm package (Prettier). The package was trojanized with embedded malicious code (CWE-506), enabling arbitrary code execution during npm install or build processes. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Prettier product: eslint-config-prettier cwe: CWE-506 disclosed: Jan 22, 20267.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:Nwrite-up soon - CVE-2026-20045 KEV
CVE-2026-20045: Cisco Unified Communications Manager Code Injection
Detects exploitation attempts targeting CVE-2026-20045, a code injection vulnerability (CWE-94) in Cisco Unified Communications Manager. This KEV-listed vulnerability allows remote attackers to inject and execute arbitrary code. Detection focuses on anomalous process execution, unexpected web shell activity, and suspicious outbound connections originating from CUCM processes.
vendor: Cisco product: Unified Communications Manager cwe: CWE-94 disclosed: Jan 21, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2026-20805 KEV
Microsoft Windows Information Disclosure (CVE-2026-20805)
Detects exploitation of CVE-2026-20805, a Microsoft Windows information disclosure vulnerability (CWE-200) that allows attackers to access sensitive memory or kernel data. This vulnerability is actively exploited in the wild (CISA KEV). Successful exploitation may expose credentials, memory contents, or system information that enables privilege escalation or lateral movement.
vendor: Microsoft product: Windows cwe: CWE-200 disclosed: Jan 13, 20265.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2025-8110 KEV
Gogs Path Traversal Vulnerability (CVE-2025-8110)
Detects exploitation attempts targeting CVE-2025-8110, a path traversal vulnerability (CWE-22) in Gogs self-hosted Git service. Attackers can craft malicious HTTP requests containing directory traversal sequences to read arbitrary files outside the intended web root, potentially exposing sensitive configuration files, SSH keys, or repository data. This vulnerability is listed in the CISA KEV catalog indicating active exploitation in the wild.
vendor: Gogs product: Gogs cwe: CWE-22 disclosed: Jan 12, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-37164 KEV
HPE OneView Code Injection Exploitation (CVE-2025-37164)
Detects exploitation of CVE-2025-37164, a code injection vulnerability (CWE-94) in Hewlett Packard Enterprise OneView. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and allows attackers to inject and execute arbitrary code through the OneView management platform, potentially compromising datacenter infrastructure management.
vendor: Hewlett Packard Enterprise (HPE) product: OneView cwe: CWE-94 disclosed: Jan 7, 20269.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2009-0556 KEV
Microsoft Office PowerPoint Code Injection (CVE-2009-0556)
Detects exploitation attempts of CVE-2009-0556, a code injection vulnerability in Microsoft Office PowerPoint. Attackers can exploit this vulnerability via crafted PowerPoint files to execute arbitrary code in the context of the logged-in user. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: Office cwe: CWE-94 disclosed: Jan 7, 20268.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-14847 KEV
MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847)
Detects exploitation attempts targeting CVE-2025-14847, an improper handling of length parameter inconsistency vulnerability (CWE-130) in MongoDB and MongoDB Server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may craft malformed requests with inconsistent length parameters to cause unexpected server behavior, potentially leading to denial of service, data corruption, or unauthorized access.
vendor: MongoDB product: MongoDB and MongoDB Server cwe: CWE-130 disclosed: Dec 29, 20257.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2023-52163 KEV
Digiever DS-2105 Pro Missing Authorization Exploitation (CVE-2023-52163)
Detects exploitation of CVE-2023-52163, a missing authorization vulnerability (CWE-862) in Digiever DS-2105 Pro NVR devices. This KEV-listed vulnerability allows unauthenticated attackers to access restricted functionality or administrative interfaces without proper credential validation. Threat actors actively exploit exposed NVR devices for initial access, lateral movement, and persistence in OT/IoT environments.
vendor: Digiever product: DS-2105 Pro cwe: CWE-862 disclosed: Dec 22, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-14733 KEV
CVE-2025-14733: WatchGuard Firebox Out-of-Bounds Write Exploitation
Detects exploitation attempts targeting CVE-2025-14733, an out-of-bounds write vulnerability (CWE-787) in WatchGuard Firebox devices. This vulnerability is actively exploited in the wild (CISA KEV) and may allow remote code execution or device compromise. Detection focuses on anomalous management interface activity, unexpected process crashes, and network indicators consistent with exploitation.
vendor: WatchGuard product: Firebox cwe: CWE-787 disclosed: Dec 19, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-20393 KEV
CVE-2025-20393 — Cisco Multiple Products Improper Input Validation (KEV)
Detects exploitation attempts targeting CVE-2025-20393, an improper input validation vulnerability (CWE-20) affecting Cisco Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active in-the-wild exploitation. Attackers may leverage this flaw to bypass security controls, execute unauthorized commands, or gain elevated access to affected Cisco appliances.
vendor: Cisco product: Multiple Products cwe: CWE-20 disclosed: Dec 17, 202510.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2025-59374 KEV
ASUS Live Update Embedded Malicious Code (CVE-2025-59374)
Detects indicators of compromise related to CVE-2025-59374, a supply chain attack where ASUS Live Update software contained embedded malicious code (CWE-506). This mirrors the ShadowHammer operation pattern where threat actors compromised the ASUS software update infrastructure to deliver backdoored updates to endpoints. Detection focuses on suspicious child processes spawned by ASUS Live Update, anomalous network connections, and staging activity consistent with backdoor execution.
vendor: ASUS product: Live Update cwe: CWE-506 disclosed: Dec 17, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-40602 KEV
CVE-2025-40602 - SonicWall SMA1000 Missing Authorization Exploitation
Detects exploitation attempts targeting CVE-2025-40602, a missing authorization vulnerability (CWE-862) combined with execution with unnecessary privileges (CWE-250) in SonicWall SMA1000 appliances. This KEV-listed vulnerability allows unauthenticated or insufficiently privileged attackers to access restricted resources or execute privileged operations. Detection focuses on anomalous HTTP requests to SMA1000 management interfaces, unexpected authentication bypass patterns, and post-exploitation activity indicative of privilege escalation on SMA gateway infrastructure.
vendor: SonicWall product: SMA1000 appliance cwe: CWE-862, CWE-250 disclosed: Dec 17, 20256.6 mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-59718 KEV
Fortinet Multiple Products Improper Verification of Cryptographic Signature (CVE-2025-59718)
Detects exploitation of CVE-2025-59718, an improper verification of cryptographic signature vulnerability (CWE-347) affecting multiple Fortinet products. This vulnerability, listed in CISA's Known Exploited Vulnerabilities catalog, allows attackers to bypass signature validation checks, potentially enabling unsigned firmware/software installation, man-in-the-middle attacks on update channels, or code execution with elevated privileges on affected Fortinet appliances.
vendor: Fortinet product: Multiple Products cwe: CWE-347 disclosed: Dec 16, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-14611 KEV
Gladinet CentreStack and Triofox Hard-Coded Cryptographic Key Exploitation
Detects exploitation of CVE-2025-14611, a hard-coded cryptographic key vulnerability (CWE-798) in Gladinet CentreStack and Triofox. Attackers who obtain the static machineKey or cryptographic seed can forge ASP.NET ViewState tokens or authentication artifacts, enabling remote code execution via deserialization attacks without valid credentials. This vulnerability is actively exploited and listed on CISA KEV.
vendor: Gladinet product: CentreStack and Triofox cwe: CWE-798 disclosed: Dec 15, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-43529 KEV
Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529)
Detects exploitation attempts targeting CVE-2025-43529, a use-after-free vulnerability in Apple's WebKit browser engine affecting multiple Apple products. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to arbitrary code execution when a user visits a maliciously crafted webpage. Attackers may leverage this flaw to achieve initial access or privilege escalation on macOS, iOS, and iPadOS devices.
vendor: Apple product: Multiple Products cwe: CWE-416 disclosed: Dec 15, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2018-4063 KEV
Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation
Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.
vendor: Sierra Wireless product: AirLink ALEOS cwe: CWE-434 disclosed: Dec 12, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-14174 KEV
CVE-2025-14174: Google Chromium Out of Bounds Memory Access Exploitation
Detects exploitation of CVE-2025-14174, an out-of-bounds memory access vulnerability in Google Chromium. This vulnerability is actively exploited in the wild (CISA KEV) and can allow attackers to execute arbitrary code or escape the browser sandbox via a crafted web page. Detection focuses on abnormal Chromium process behavior including child process spawning, memory anomalies, and post-exploitation indicators.
vendor: Google product: Chromium disclosed: Dec 12, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-58360 KEV
OSGeo GeoServer XXE Injection Exploitation Attempt
Detects exploitation attempts targeting CVE-2025-58360, an Improper Restriction of XML External Entity (XXE) Reference vulnerability in OSGeo GeoServer. Attackers can submit malicious XML payloads to GeoServer endpoints to perform server-side request forgery, read local files, or exfiltrate data via out-of-band DNS/HTTP channels. This CVE is listed on CISA's Known Exploited Vulnerabilities catalog.
vendor: OSGeo product: GeoServer cwe: CWE-611 disclosed: Dec 11, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-6218 KEV
CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation
Detects exploitation of CVE-2025-6218, a path traversal vulnerability in RARLAB WinRAR. Attackers can craft malicious archive files that, when extracted, write files outside the intended extraction directory, enabling arbitrary file placement on the victim system. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to code execution, persistence, or privilege escalation by dropping malicious files to sensitive locations such as startup folders, system directories, or application data paths.
vendor: RARLAB product: WinRAR cwe: CWE-22 disclosed: Dec 9, 20257.8 highCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-62221 KEV
CVE-2025-62221 Microsoft Windows Use After Free Exploitation
Detects exploitation attempts of CVE-2025-62221, a use-after-free vulnerability in Microsoft Windows. This class of memory corruption flaw allows attackers to execute arbitrary code by manipulating freed memory objects. As a CISA KEV entry, active exploitation in the wild has been confirmed. Detection focuses on anomalous process behavior, kernel-mode memory corruption indicators, crash telemetry, and privilege escalation patterns consistent with UAF exploitation chains.
vendor: Microsoft product: Windows cwe: CWE-416 disclosed: Dec 9, 20257.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2022-37055 KEV
CVE-2022-37055 D-Link Router Buffer Overflow Exploitation
Detects exploitation attempts targeting CVE-2022-37055, a buffer overflow vulnerability (CWE-120) in D-Link routers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may exploit this vulnerability to achieve remote code execution on affected D-Link routers, potentially enabling network pivoting, persistent access, or botnet enrollment.
vendor: D-Link product: Routers cwe: CWE-120 disclosed: Dec 8, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-66644 KEV
Array Networks ArrayOS AG OS Command Injection (CVE-2025-66644)
Detects exploitation of CVE-2025-66644, an OS command injection vulnerability in Array Networks ArrayOS AG. This vulnerability allows remote attackers to execute arbitrary operating system commands through the Array Networks SSL VPN/ZTNA gateway. The flaw is tracked by CISA as a Known Exploited Vulnerability (KEV), indicating active in-the-wild exploitation. Attackers may leverage this to gain initial access, establish persistence, or pivot laterally within the network.
vendor: Array Networks product: ArrayOS AG cwe: CWE-78 disclosed: Dec 8, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-55182 KEV
CVE-2025-55182 — Meta React Server Components Remote Code Execution
Detects exploitation of CVE-2025-55182, a critical remote code execution vulnerability in Meta React Server Components. This vulnerability allows attackers to achieve server-side code execution by abusing the React Server Components protocol, potentially leading to full server compromise. The vulnerability is actively exploited in the wild (CISA KEV).
vendor: Meta product: React Server Components disclosed: Dec 5, 202510.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2021-26828 KEV
CVE-2021-26828: OpenPLC ScadaBR Unrestricted File Upload RCE
Detects exploitation of CVE-2021-26828, an unrestricted file upload vulnerability in OpenPLC ScadaBR that allows authenticated attackers to upload files with dangerous types (e.g., JSP, PHP, WAR) to the server, leading to remote code execution. ScadaBR is a SCADA/HMI web application widely used in industrial control systems. This vulnerability is actively exploited in the wild and listed in CISA KEV.
vendor: OpenPLC product: ScadaBR cwe: CWE-434 disclosed: Dec 3, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2021-26829 KEV
OpenPLC ScadaBR Cross-Site Scripting (XSS) Exploitation Detected
Detects exploitation attempts targeting CVE-2021-26829, a stored or reflected cross-site scripting vulnerability in OpenPLC ScadaBR. ScadaBR is a SCADA/HMI platform used in industrial control environments. Successful exploitation allows attackers to inject malicious scripts into the web interface, potentially enabling session hijacking, credential theft, or lateral movement within OT/ICS environments. This CVE is listed on CISA's Known Exploited Vulnerabilities catalog.
vendor: OpenPLC product: ScadaBR cwe: CWE-79 disclosed: Nov 28, 20255.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nwrite-up soon - CVE-2025-13223 KEV
Google Chromium V8 Type Confusion Exploitation (CVE-2025-13223)
Detects exploitation attempts targeting CVE-2025-13223, a type confusion vulnerability (CWE-843) in Google Chromium's V8 JavaScript engine. This KEV-listed vulnerability allows remote attackers to execute arbitrary code via a crafted HTML page. Exploitation typically involves a malicious web page triggering memory corruption through confused object type handling in V8, leading to sandbox escape or remote code execution within the browser process.
vendor: Google product: Chromium V8 cwe: CWE-843 disclosed: Nov 19, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-68670 Public PoC PoC
xrdp Unauthenticated Stack Buffer Overflow via RDP Connection Sequence (CVE-2025-68670)
CVE-2025-68670 is a critical unauthenticated stack buffer overflow (CWE-121) in xrdp versions prior to 0.10.5. During the RDP connection sequence, a remote unauthenticated attacker can send a specially crafted packet that overflows a stack buffer, potentially enabling remote code execution as the xrdp process user. CVSS 9.1. A public PoC exists. Patch to xrdp >= 0.10.5 immediately.
vendor: neutrinolabs, xrdp product: xrdp cwe: CWE-121 disclosed: Nov 18, 20259.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hwrite-up soon - CVE-2025-58034 KEV
Fortinet FortiWeb OS Command Injection (CVE-2025-58034)
Detects exploitation of CVE-2025-58034, an OS command injection vulnerability (CWE-78) in Fortinet FortiWeb. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through FortiWeb's management or inspection interfaces, potentially leading to full appliance compromise, lateral movement, and persistent access to network segmentation points.
vendor: Fortinet product: FortiWeb cwe: CWE-78 disclosed: Nov 18, 20257.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-64446 KEV
CVE-2025-64446: Fortinet FortiWeb Path Traversal Exploitation
Detects exploitation attempts targeting CVE-2025-64446, a path traversal vulnerability (CWE-23) in Fortinet FortiWeb. This vulnerability allows attackers to traverse directory boundaries and access files outside the intended web root, potentially exposing sensitive configuration files, credentials, or system files. The vulnerability is listed in CISA KEV indicating active exploitation in the wild.
vendor: Fortinet product: FortiWeb cwe: CWE-23 disclosed: Nov 14, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-9242 KEV
WatchGuard Firebox Out-of-Bounds Write Exploitation (CVE-2025-9242)
Detects exploitation attempts targeting CVE-2025-9242, an out-of-bounds write vulnerability (CWE-787) in WatchGuard Firebox appliances. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation may allow remote code execution or denial of service on affected Firebox devices.
vendor: WatchGuard product: Firebox cwe: CWE-787 disclosed: Nov 12, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-12480 KEV
Gladinet Triofox Improper Access Control Exploitation Detected
Detects exploitation attempts targeting CVE-2025-12480, an improper access control vulnerability (CWE-284) in Gladinet Triofox. This vulnerability allows attackers to bypass access controls, potentially gaining unauthorized access to file storage and collaboration resources. Listed as a CISA Known Exploited Vulnerability, active exploitation has been observed in the wild.
vendor: Gladinet product: Triofox cwe: CWE-284 disclosed: Nov 12, 20259.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nwrite-up soon - CVE-2025-62215 KEV
CVE-2025-62215 Microsoft Windows Race Condition Exploitation
Detects exploitation attempts of CVE-2025-62215, a race condition vulnerability (CWE-362) in Microsoft Windows. This KEV-listed vulnerability can be abused by attackers to gain elevated privileges or execute arbitrary code by winning a time-of-check to time-of-use (TOCTOU) race condition. Detection focuses on suspicious process creation patterns, handle manipulation, and abnormal thread timing indicative of race condition exploitation.
vendor: Microsoft product: Windows cwe: CWE-362 disclosed: Nov 12, 20257.0 highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-48703 KEV
CVE-2025-48703 - CWP Control Web Panel OS Command Injection
Detects exploitation of CVE-2025-48703, an OS command injection vulnerability (CWE-78) in CWP Control Web Panel. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through the web panel interface, potentially leading to full server compromise.
vendor: CWP product: Control Web Panel cwe: CWE-78 disclosed: Nov 4, 20259.0 criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2025-11371 KEV
Gladinet CentreStack/Triofox Unauthorized File/Directory Access (CVE-2025-11371)
Detects exploitation of CVE-2025-11371, a CWE-552 vulnerability in Gladinet CentreStack and Triofox where files or directories are accessible to external parties without proper authorization. This CISA KEV-listed vulnerability allows unauthenticated or unauthorized actors to access sensitive files and directories exposed by the affected file-sharing platform.
vendor: Gladinet product: CentreStack and Triofox cwe: CWE-552 disclosed: Nov 4, 20257.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2025-24893 KEV
CVE-2025-24893 XWiki Platform Eval Injection Exploitation
Detects exploitation of CVE-2025-24893, an eval injection vulnerability (CWE-95) in XWiki Platform that allows remote code execution via server-side template injection. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers can craft malicious wiki content or URLs containing Groovy/Velocity template expressions that are evaluated server-side, leading to arbitrary code execution under the XWiki process context.
vendor: XWiki product: Platform cwe: CWE-95 disclosed: Oct 30, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-41244 KEV
CVE-2025-41244 - VMware Aria Operations & VMware Tools Privilege Escalation via Unsafe Actions
Detects exploitation of CVE-2025-41244, a privilege escalation vulnerability in Broadcom VMware Aria Operations and VMware Tools caused by privileges defined with unsafe actions (CWE-267). This KEV-listed vulnerability allows attackers with lower-privileged access to escalate privileges by abusing overly permissive or unsafe role/action definitions within VMware Aria Operations or VMware Tools components. Indicators include anomalous administrative API calls, unexpected privilege changes in VMware management interfaces, and suspicious process activity from VMware Tools guest utilities.
vendor: Broadcom product: VMware Aria Operations and VMware Tools cwe: CWE-267 disclosed: Oct 30, 20257.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-6205 KEV
Dassault Systèmes DELMIA Apriso Missing Authorization (CVE-2025-6205)
Detects exploitation attempts targeting CVE-2025-6205, a missing authorization vulnerability (CWE-862) in Dassault Systèmes DELMIA Apriso. This vulnerability allows unauthenticated or low-privileged attackers to access protected resources or perform actions without proper authorization checks. Listed as a CISA KEV, indicating active exploitation in the wild.
vendor: Dassault Systèmes product: DELMIA Apriso cwe: CWE-862 disclosed: Oct 28, 20259.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nwrite-up soon - CVE-2025-6204 KEV
CVE-2025-6204 — Dassault Systèmes DELMIA Apriso Code Injection
Detects exploitation of CVE-2025-6204, a code injection vulnerability (CWE-94) in Dassault Systèmes DELMIA Apriso. This vulnerability allows attackers to inject and execute arbitrary code through the Apriso application layer. It is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation can lead to remote code execution, lateral movement, and full compromise of manufacturing execution system (MES) environments.
vendor: Dassault Systèmes product: DELMIA Apriso cwe: CWE-94 disclosed: Oct 28, 20258.0 highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2025-59287 KEV
Microsoft WSUS Deserialization of Untrusted Data (CVE-2025-59287)
Detects exploitation of CVE-2025-59287, a deserialization of untrusted data vulnerability in Microsoft Windows Server Update Services (WSUS). Successful exploitation allows an attacker to execute arbitrary code in the context of the WSUS service by sending a crafted serialized object. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.
vendor: Microsoft product: Windows cwe: CWE-502 disclosed: Oct 24, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-54236 KEV
Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236)
Detects exploitation of CVE-2025-54236, an improper input validation vulnerability in Adobe Commerce and Magento. This KEV-listed vulnerability allows attackers to submit maliciously crafted input to Commerce/Magento endpoints, potentially leading to remote code execution, unauthorized data access, or store compromise. Detection focuses on anomalous HTTP request patterns to Magento/Commerce endpoints, unexpected PHP execution, and indicators of post-exploitation activity.
vendor: Adobe product: Commerce and Magento cwe: CWE-20 disclosed: Oct 24, 20259.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nwrite-up soon - CVE-2025-61932 KEV
Motex LANSCOPE Endpoint Manager - Improper Verification of Communication Channel Source (CVE-2025-61932)
CVE-2025-61932 is an Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Motex LANSCOPE Endpoint Manager. This flaw allows an attacker to send commands or data through a communication channel without proper verification of the channel's origin, potentially enabling unauthorized control over managed endpoints. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may abuse this to impersonate the LANSCOPE management server and push malicious instructions to endpoint agents.
vendor: Motex product: LANSCOPE Endpoint Manager cwe: CWE-940 disclosed: Oct 22, 20259.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-2746 KEV
CVE-2025-2746: Kentico Xperience CMS Authentication Bypass
Detects exploitation of CVE-2025-2746, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS that allows attackers to access protected resources via alternate paths or channels without valid credentials. This vulnerability is actively exploited in the wild (CISA KEV).
vendor: Kentico product: Xperience CMS cwe: CWE-288 disclosed: Oct 20, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-2747 KEV
Kentico Xperience CMS Authentication Bypass (CVE-2025-2747)
Detects exploitation of CVE-2025-2747, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS. Attackers can access protected administrative or content management endpoints via alternate paths or channels without valid credentials, enabling unauthorized access to sensitive CMS functionality. This vulnerability is actively exploited in the wild and listed in CISA KEV.
vendor: Kentico product: Xperience CMS cwe: CWE-288 disclosed: Oct 20, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2022-48503 KEV
CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability Exploitation
Detects potential exploitation of CVE-2022-48503, an unspecified vulnerability affecting Apple multiple products. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Detection focuses on suspicious process activity, network connections, and crash telemetry from Apple ecosystem processes that may indicate exploitation attempts.
vendor: Apple product: Multiple Products disclosed: Oct 20, 20258.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-21589 Theoretical
Juniper Session Smart Router Authentication Bypass (CVE-2025-21589)
CVE-2025-21589 is a critical authentication bypass vulnerability (CWE-288, CVSS 9.8) in Juniper Networks Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router. An unauthenticated remote attacker can bypass authentication mechanisms to gain administrative access to the management interface without valid credentials. Affected versions include SSR 5.6.7–5.6.16, 6.0.x before 6.0.8, 6.1.x before 6.1.12-lts, 6.2.x before 6.2.8-lts, and 6.3.x before 6.3.3-r2. Exploitation grants full control of affected routers and conductors, enabling lateral movement, traffic interception, configuration tampering, and persistent backdoor establishment.
vendor: Juniper Networks product: Session Smart Router, Session Smart Conductor… cwe: CWE-288 disclosed: Sep 10, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2025-24054 KEV PoC
Windows NTLM Credential Leak via File Download Interaction
CVE-2025-24054 is a Windows NTLM hash disclosure vulnerability triggered when a user interacts with a specially crafted file (e.g., .library-ms, .url, .lnk) that forces an outbound NTLM authentication attempt to an attacker-controlled server. Exploitation requires minimal user interaction — simply downloading or viewing a malicious file in Explorer can suffice. The leaked Net-NTLMv2 hash can be cracked offline or relayed for lateral movement. This vulnerability is actively exploited in the wild and listed in CISA's KEV catalog.
vendor: Microsoft product: Windows cwe: CWE-73 disclosed: Mar 11, 20256.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2025-21298 Public PoC PoC
CVE-2025-21298: Windows OLE RCE via Malicious RTF Document
Detects exploitation of CVE-2025-21298, a use-after-free (CWE-416) vulnerability in Windows OLE that allows remote code execution when a user opens a specially crafted RTF document. With a CVSS score of 9.8 and public PoC availability, this is a critical-severity vulnerability affecting Windows 10, 11, and Server 2008-2025. Exploitation typically involves phishing emails with RTF attachments that trigger the OLE subsystem to execute attacker-controlled code in the context of the victim user.
vendor: Microsoft product: Windows, Windows OLE cwe: CWE-416 disclosed: Jan 14, 20259.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-43451 KEV
CVE-2024-43451: Windows NTLM Hash Disclosure via File Interaction
CVE-2024-43451 is a Windows NTLM hash disclosure vulnerability (NTLMv2 spoofing) affecting Windows 10, Windows 11, and Windows Server 2008-2025. Minimal user interaction with a malicious file (right-click, open, or preview) triggers an outbound NTLM authentication request to an attacker-controlled server, leaking the victim's NTLMv2 hash. The hash can be cracked offline or used in relay attacks. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: Windows cwe: CWE-73 disclosed: Nov 12, 20246.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nwrite-up soon - CVE-2024-38112 KEV
CVE-2024-38112 - Windows MSHTML Spoofing via .url File Phishing (Void Banshee)
Detects exploitation of CVE-2024-38112, a Windows MSHTML spoofing vulnerability actively exploited by the Void Banshee threat group. Attackers deliver crafted .url files that invoke the legacy Internet Explorer MSHTML engine (mhtml: or ms-its: URI handlers) to load remote malicious content, bypassing modern browser security controls. Patch released July 2024; in CISA KEV catalog.
vendor: Microsoft product: Windows, MSHTML Platform cwe: CWE-668 disclosed: Jul 9, 20247.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Nwrite-up soon - CVE-2024-30078 Theoretical
CVE-2024-30078: Windows Wi-Fi Driver Remote Code Execution via Adjacent Network
Detects exploitation attempts of CVE-2024-30078, a critical Windows Wi-Fi Driver vulnerability (CWE-591: Sensitive Data Storage in Improperly Locked Memory) that allows unauthenticated remote code execution from an adjacent network. An attacker within Wi-Fi range can send specially crafted network packets to trigger memory corruption in the Windows Wi-Fi driver (nwifi.sys), potentially gaining SYSTEM-level code execution without user interaction. Affected platforms include Windows 10, Windows 11, and Windows Server 2008 through 2022.
vendor: Microsoft product: Windows, Windows Wi-Fi Driver cwe: CWE-591 disclosed: Jun 11, 20248.8 highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-3400 KEV
Palo Alto PAN-OS GlobalProtect Command Injection (CVE-2024-3400)
CVE-2024-3400 is a critical unauthenticated remote code execution vulnerability (CVSS 10.0) in Palo Alto Networks PAN-OS GlobalProtect gateway. A command injection flaw in the GlobalProtect feature allows an unauthenticated attacker to execute arbitrary OS commands as root by sending specially crafted HTTPS requests. Actively exploited in the wild as part of Operation MidnightEclipse by threat actor UTA0218, attackers have deployed a Python-based backdoor (UPSTYLE) and conducted lateral movement. Affected versions include PAN-OS 10.2.x < 10.2.9-h1, 11.0.x < 11.0.4-h1, and 11.1.x < 11.1.2-h3.
vendor: Palo Alto Networks product: PAN-OS, GlobalProtect cwe: CWE-77 disclosed: Apr 12, 202410.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hwrite-up soon - CVE-2024-26234 Weaponized PoC
CVE-2024-26234 — Windows Proxy Driver Spoofing via Malicious Signed Driver
Detects exploitation of CVE-2024-26234, a Windows Proxy Driver Spoofing vulnerability where threat actors abuse Microsoft's WHQL signing process to load a malicious signed kernel driver. The driver installs a proxy component enabling persistent backdoor access. Severity is elevated given weaponized exploit status and kernel-level code execution potential.
vendor: Microsoft product: Windows cwe: CWE-284 disclosed: Apr 9, 20246.7 mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-21413 KEV
CVE-2024-21413: Microsoft Outlook RCE via Moniker Link (MonikerLink)
CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook caused by improper input validation of hyperlinks using the 'file://' moniker protocol combined with an exclamation mark suffix. When a victim previews or opens a crafted email, Outlook follows the malicious link without the usual Protected View warning, leaking NTLM credentials via an outbound SMB connection and potentially enabling remote code execution. CVSS 9.8. Actively exploited in the wild (CISA KEV).
vendor: Microsoft product: Outlook, Microsoft 365 Apps… cwe: CWE-20 disclosed: Feb 13, 20249.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-23897 KEV PoC
CVE-2024-23897: Jenkins Arbitrary File Read via CLI Argument Parser (Pre-Auth RCE Chain)
CVE-2024-23897 is a critical path traversal vulnerability (CWE-22) in Jenkins' built-in CLI argument parser (args4j). The parser expands file contents prefixed with '@' as command arguments, allowing unauthenticated attackers to read arbitrary files from the Jenkins controller filesystem — including secrets, credentials, and SSH keys. When combined with additional weaknesses (e.g., exposed Remember Me tokens or cryptographic keys), this chain enables unauthenticated remote code execution. CVSS 9.8. Actively exploited (CISA KEV). Affects Jenkins <= 2.441 and LTS <= 2.426.2.
vendor: Jenkins product: Jenkins cwe: CWE-22 disclosed: Jan 24, 20249.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2024-21887 KEV
Ivanti Connect Secure Authenticated Command Injection (CVE-2024-21887)
CVE-2024-21887 is a critical authenticated command injection vulnerability (CVSS 9.1) in Ivanti Connect Secure and Policy Secure web components. When chained with the authentication bypass CVE-2023-46805, unauthenticated remote attackers can execute arbitrary commands on the appliance as root. Nation-state threat actors (UNC5221) exploited this as a zero-day to deploy LIGHTWIRE, WIREFIRE, and FRAMESTING web shells and conduct credential harvesting and lateral movement. CISA added this to the KEV catalog in January 2024.
vendor: Ivanti product: Connect Secure, Policy Secure cwe: CWE-77 disclosed: Jan 12, 20249.1 criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2016-3081 KEV PoC
Apache Struts REST Plugin / S2-032 Command Injection (CVE-2016-3081)
Detects exploitation of CVE-2016-3081 (Apache Struts S2-032), a remote command injection flaw in the Struts REST plugin / dynamic method invocation. When Dynamic Method Invocation (DMI) is enabled, an attacker can supply a crafted 'method:' prefixed parameter containing an OGNL expression that is evaluated by the framework, resulting in arbitrary command execution on the server. This detection looks for HTTP requests whose URI, query string or POST body contain the tell-tale 'method:' OGNL payload markers (e.g. getRuntime().exec, _memberAccess, ProcessBuilder, multipart/form-data crafted payloads) and for anomalous child processes spawned by the Java/Tomcat process hosting the Struts application. CVE-2016-3081 is on the CISA KEV catalog and has public exploit code (Exploit-DB 39756).
vendor: Apache product: Struts cwe: CWE-77 disclosed: May 2, 2016— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2015-5287 KEV PoC
CVE-2015-5287: Red Hat ABRT sosreport Local Privilege Escalation
Detects local privilege escalation exploitation of CVE-2015-5287 in Red Hat's Automatic Bug Reporting Tool (ABRT). A race condition and improper file handling in the sosreport/abrt-action-install-debuginfo path allows a local unprivileged user to manipulate files created by the privileged abrtd daemon (running as root), enabling arbitrary file write/overwrite and command execution as root. Exploitation is characterized by unusual abrt process activity, symlink/hardlink manipulation inside /var/spool/abrt and /var/tmp/abrt, and abrt-hook-ccpp or sosreport spawning shells as root shortly after a crash is triggered by a non-root user.
vendor: Red Hat product: Automatic Bug Reporting Tool disclosed: Dec 1, 2015— unscoredCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2015-5477 KEV PoC
ISC BIND named TKEY Query Remote Denial of Service (CVE-2015-5477)
Detects exploitation of CVE-2015-5477, a critical data-processing error in ISC BIND's handling of TKEY queries. A remote, unauthenticated attacker can send a specially crafted DNS packet containing a TKEY record that triggers a REQUIRE assertion failure in named (buffer.c / db.c), causing the daemon to exit (INSIST/REQUIRE assertion). Because a single malformed packet crashes named, this is a trivially weaponizable remote DoS against any recursive or authoritative BIND server. Detection focuses on DNS TKEY query records (qtype 249) directed at named, correlated with abnormal named process termination / assertion-failure log lines and service restarts. Listed in CISA KEV.
vendor: ISC product: BIND cwe: CWE-19 disclosed: Aug 1, 2015— unscoredCVSS vector not yet publishedwrite-up soon - CVE-2015-3246 KEV PoC
CVE-2015-3246: Red Hat Libuser Race Condition Privilege Escalation
Detects local privilege escalation exploitation of CVE-2015-3246, a race condition and improper input validation flaw in the Red Hat libuser library. The library's helper utilities (userhelper, chfn, chsh) improperly handle newline characters in the GECOS field of /etc/passwd, allowing a local unprivileged user to corrupt /etc/passwd and inject a root-level account or otherwise gain root privileges. This detection identifies exploitation attempts by monitoring for suspicious invocation of libuser SUID helpers, anomalous modification of /etc/passwd, and known public exploit patterns (EDB-37706, EDB-44633, Metasploit libuser_roothelper_priv_esc).
vendor: Red Hat product: Libuser disclosed: Jul 27, 2015— unscoredCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hwrite-up soon - CVE-2015-3306 KEV PoC
ProFTPD mod_copy Unauthenticated Remote Command Execution (CVE-2015-3306)
Detects exploitation of CVE-2015-3306, an improper access control flaw in the mod_copy module of ProFTPD. The SITE CPFR and SITE CPTO commands are exposed without authentication, allowing a remote attacker to copy arbitrary files on the server. Attackers chain this with the PHP/SSH config to write attacker-controlled data (e.g., a webshell) into a web-accessible directory, achieving unauthenticated remote command execution. This detection looks for anonymous or unauthenticated use of SITE CPFR/CPTO sequences, copies that target web roots or authorized_keys files, and the follow-on execution indicative of a dropped webshell.
vendor: ProFTPD product: ProFTPD cwe: CWE-284 disclosed: Apr 13, 2015— unscoredCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hwrite-up soon
Related tactics
360 vulnerability detections
259 vulnerability detections
Browse by tactic
- Reconnaissance TA0043
- Resource Development TA0042
- Initial Access TA0001
- Execution TA0002
- Persistence TA0003
- Privilege Escalation TA0004
- Stealth TA0005
- Defense Impairment TA0112
- Credential Access TA0006
- Discovery TA0007
- Lateral Movement TA0008
- Collection TA0009
- Command and Control TA0011
- Exfiltration TA0010
- Impact TA0040