Vulnerability Detections
CVE-mapped detections for known-exploited, weaponized, and proof-of-concept vulnerabilities. Each ships ready-to-deploy KQL & SPL detection logic. Filter by vendor, product, CVSS, CWE and exploitation status.
Unlock the full Pro package
Response playbooks, investigation guides and atomic tests for every technique — from £29/mo.
- CVE-2026-52887 Public PoC PoC
NocoBase myInAppChannels:list SQL Injection to PostgreSQL Superuser RCE (CVE-2026-52887)
CVE-2026-52887 is a critical (CVSS 10.0) SQL injection vulnerability in the @nocobase/plugin-notification-in-app-message plugin's /api/myInAppChannels:list endpoint filter parameter, affecting NocoBase versions <= 2.0.60. An unauthenticated or low-privileged attacker can inject arbitrary SQL through the filter query parameter, which is passed insufficiently sanitized into the underlying Sequelize/PostgreSQL query builder. Because NocoBase's database connection frequently runs with elevated (superuser) PostgreSQL privileges to support its dynamic schema/collection features, successful injection can be escalated via COPY ... TO/FROM PROGRAM or dblink/plpythonu extensions to achieve full remote code execution on the database host. Patched in v2.0.61 (PR #9630, commit 68d64e3).
vendor: npm product: @nocobase/plugin-notification-in-app-message cwe: CWE-89 disclosed: Jul 31, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-52855 Public PoC PoC
Pterodactyl Wings Egg Configuration-File Templating Node Secret Exposure (CVE-2026-52855)
Detects exploitation of CVE-2026-52855, a critical (CVSS 9.9) information disclosure vulnerability in Pterodactyl Wings prior to 1.12.3. The Wings daemon's egg configuration-file templating engine fails to properly scope variable substitution, allowing a malicious or crafted egg/server configuration to reference and render node-level secrets (e.g., the Wings daemon token, SFTP credentials, Docker/panel authentication secrets) into server-accessible configuration files. An attacker with the ability to create or modify an egg (via panel admin compromise, supply-chain egg import, or a malicious server owner in multi-tenant environments) can exfiltrate node configuration secrets, leading to full node takeover. Detection focuses on Wings daemon logs showing configuration-file template rendering events that reference sensitive node config keys, unexpected egg install/import activity, and outbound access to rendered server config files containing daemon secrets.
vendor: go product: github.com/pterodactyl/wings cwe: CWE-200, CWE-522 disclosed: Jul 31, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-67429 Public PoC PoC
Flyto2 Core Arbitrary File Write via image.download Path Traversal (CVE-2026-67429)
Detects exploitation of CVE-2026-67429, a critical (CVSS 10.0) arbitrary file write vulnerability in Flyto2 Core (pip package flyto-core) versions prior to 2.26.7. The image.download module and other file-writing modules fail to sanitize user-supplied filenames/paths (CWE-22 path traversal, CWE-73 external control of file name or path), allowing an unauthenticated or low-privileged attacker to write arbitrary files anywhere on the filesystem reachable by the flyto-core process. This can be leveraged to overwrite application code, cron files, SSH authorized_keys, systemd unit files, or web-accessible directories to achieve remote code execution. Detection focuses on identifying path traversal sequences and absolute/unexpected path targets passed to flyto-core's image.download and related file-writing endpoints, as well as downstream evidence such as newly written files in sensitive directories immediately following flyto-core process activity.
vendor: pip product: flyto-core cwe: CWE-22, CWE-73 disclosed: Jul 30, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-54680 Public PoC PoC
Kube-logging Logging Operator Fluentd Configuration Injection RCE (CVE-2026-54680)
Detects exploitation of CVE-2026-54680, a critical (CVSS 9.9) configuration injection vulnerability in kube-logging logging-operator (versions prior to the 0.0.0-20260608145523-cf437d7f1e05 pseudo-version / 6.6.0 release) that allows an attacker with the ability to influence Fluentd/Fluent Bit configuration inputs (e.g. via Flow/ClusterFlow/Output CRDs, log forwarding pipelines, or unsanitized log fields reflected into config templates) to inject arbitrary Fluentd configuration directives. This injection can lead to remote code execution via Fluentd's exec plugin, ruby code blocks, or file-based output writes, potentially compromising the logging-operator pod and any Kubernetes service account/token it holds, enabling lateral movement and cluster compromise.
vendor: go product: github.com/kube-logging/logging-operator cwe: CWE-74, CWE-77 disclosed: Jul 29, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-54735 Public PoC PoC
Prebid Server SSRF via Request Forgery (CVE-2026-54735)
Detects exploitation of CVE-2026-54735, a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in prebid/prebid-server affecting versions < 4.4.0, <= 3.30.0, <= 2.32.0, and <= 0.275.0. The flaw (CWE-918) allows an attacker to craft bid request or adapter/URL parameters that cause the prebid-server host to issue outbound requests to attacker-controlled or internal/cloud-metadata endpoints, potentially exfiltrating host environment data (cloud metadata credentials, internal service responses). Detection focuses on anomalous outbound HTTP requests originating from prebid-server processes/containers to internal RFC1918 ranges, loopback, link-local cloud metadata IPs (169.254.169.254), or unexpected external hosts triggered by bid/adapter request handling.
vendor: go product: github.com/prebid/prebid-server/v4, github.com/prebid/prebid-server/v3… cwe: CWE-918 disclosed: Jul 29, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-20316 KEV
Cisco Secure Firewall Management Center Hard-coded Credential Exploitation (CVE-2026-20316)
Detects exploitation attempts and successful authentication against Cisco Secure Firewall Management Center (FMC) using an undocumented, hard-coded static credential (CVE-2026-20316, CWE-259). This flaw is listed in CISA KEV and has been exploited in zero-day attacks per Cisco and public reporting. Detection focuses on FMC authentication logs, management-interface access from unexpected sources, and post-authentication administrative actions consistent with abuse of a built-in account.
vendor: Cisco product: Secure Firewall Management Center (FMC) cwe: CWE-259 disclosed: Jul 29, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2025-68686 KEV
Fortinet FortiOS Sensitive Information Exposure (CVE-2025-68686)
CVE-2025-68686 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability (CWE-200) in Fortinet FortiOS, added to CISA's Known Exploited Vulnerabilities catalog. Unauthorized actors may be able to access sensitive information exposed by affected FortiOS instances, potentially including configuration data, credentials, session tokens, or internal system details that could facilitate further compromise. This detection focuses on identifying anomalous access to FortiOS management interfaces, unusual API/CLI enumeration behavior, and downstream indicators of information disclosure abuse such as suspicious authentication following reconnaissance against exposed FortiOS endpoints.
vendor: Fortinet product: FortiOS cwe: CWE-200 disclosed: Jul 27, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-16812 KEV
Arista VeloCloud Orchestrator On-Prem OS Command Injection (CVE-2026-16812)
Detects exploitation attempts and post-exploitation indicators of CVE-2026-16812, an OS command injection vulnerability (CWE-78) in Arista VeloCloud Orchestrator On-Prem, actively exploited in the wild and listed on CISA KEV. Attackers send crafted HTTP requests to the Orchestrator management application that result in arbitrary OS command execution on the underlying host, typically leading to shell spawning, reverse shell callbacks, credential harvesting, or webshell deployment.
vendor: Arista product: VeloCloud Orchestrator cwe: CWE-78 disclosed: Jul 27, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-16232 KEV
Check Point SmartConsole Improper Authentication (CVE-2026-16232)
Detects exploitation attempts and indicators of the CVE-2026-16232 Improper Authentication vulnerability (CWE-287) in Check Point SmartConsole management client/server communications, added to CISA KEV. Attackers exploiting this flaw can bypass authentication checks to gain unauthorized access to SmartConsole management sessions, potentially allowing manipulation of security policy, log access, or lateral movement into the management plane.
vendor: Check Point product: SmartConsole cwe: CWE-287 disclosed: Jul 22, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-50522 KEV
Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-50522)
Detects exploitation attempts and post-exploitation indicators of CVE-2026-50522, an unauthenticated/authenticated deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint that allows remote code execution via crafted serialized payloads submitted to SharePoint application pages or web services. This CVE is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on w3wp.exe (SharePoint app pool) spawning suspicious child processes, ViewState/serialized-object anomalies in IIS logs, ASPNET compilation directory writes (dropped webshells), and PowerShell/cmd execution originating from the SharePoint process tree.
vendor: Microsoft product: SharePoint cwe: CWE-502 disclosed: Jul 22, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-20896 Public PoC PoC
Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896)
The official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to * by default. Because Gitea's reverse-proxy authentication feature trusts the X-WEBAUTH-USER header from any source claiming to be a trusted proxy, an unauthenticated attacker with direct network access to the Gitea HTTP listener (bypassing any intended reverse proxy) can set this header to impersonate any username, including admin accounts, and obtain a fully authenticated session without credentials. Affects code.gitea.io/gitea < 1.26.3. This detection identifies HTTP requests to Gitea that carry X-WEBAUTH-USER (or similar reverse-proxy auth headers) originating from IP addresses outside the expected reverse-proxy/load-balancer CIDR, as well as anomalous successful authentications tied to reverse-proxy auth with no corresponding upstream proxy log entry.
vendor: go product: code.gitea.io/gitea cwe: CWE-284 disclosed: Jul 21, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2021-27137 KEV
DD-WRT Stack-Based Buffer Overflow Exploitation Attempt (CVE-2021-27137)
Detects exploitation attempts against a stack-based buffer overflow vulnerability (CWE-121) in DD-WRT firmware. The flaw allows an attacker with network access to the DD-WRT web management interface to trigger a stack overflow via crafted HTTP requests, potentially leading to remote code execution or denial of service on the router/embedded device. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Detection focuses on abnormal HTTP requests to DD-WRT management interfaces (oversized parameters, malformed CGI requests), unexpected crash/restart of httpd or DD-WRT management processes, and post-exploitation network behavior originating from embedded/IoT network segments.
vendor: DD-WRT product: DD-WRT cwe: CWE-121 disclosed: Jul 21, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-60137 KEV
WordPress Core SQL Injection Exploitation (CVE-2026-60137)
Detects exploitation attempts and successful exploitation of CVE-2026-60137, a SQL injection vulnerability (CWE-89) in WordPress Core affecting unauthenticated or authenticated request handling. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild. Exploitation typically manifests as anomalous SQL syntax in HTTP request parameters targeting WordPress endpoints (wp-admin, wp-json REST API, xmlrpc.php, plugin/theme AJAX handlers), followed by unusual database error responses, data exfiltration patterns, or subsequent webshell/backdoor deployment. WordPress 7.0.2 remediates this issue; unpatched sites remain at critical risk per CISA BOD 26-04 prioritization guidance.
vendor: WordPress product: Core cwe: CWE-89 disclosed: Jul 21, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-63030 KEV
WordPress Core Interpretation Conflict Vulnerability (CVE-2026-63030)
WordPress Core contains an interpretation conflict vulnerability (CWE-436) fixed in WordPress 7.0.2, in which differing parsing/interpretation behavior between components of the request-handling pipeline (e.g., PHP, web server, and WordPress core routing/sanitization layers) allows an attacker to smuggle or disguise malicious input so it is treated differently downstream than upstream validation expected. This class of flaw is commonly abused to bypass input filtering, achieve request smuggling-style effects against reverse proxies/CDNs fronting WordPress, or slip malicious payloads (e.g., leading to file write, privilege escalation, or authentication bypass) past security controls that assume a single canonical interpretation of the request. The vulnerability is listed in CISA KEV, indicating confirmed active exploitation in the wild, and is subject to CISA BOD 26-04 remediation timelines for federal and high-risk entities. No CVSS score has been published at time of writing; PoC details are not publicly available, but active exploitation implies working exploit code exists among threat actors. Detection focuses on anomalous WordPress core request patterns consistent with interpretation-conflict abuse: malformed/duplicate headers, ambiguous content-length/transfer-encoding combinations, unusual URL encoding or path traversal-like sequences hitting wp-admin/wp-login/wp-json endpoints, and post-exploitation indicators such as new admin users, unexpected plugin/theme file writes, or webshell drops shortly after anomalous requests.
vendor: WordPress product: Core cwe: CWE-436 disclosed: Jul 21, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-25089 KEV
Fortinet FortiSandbox OS Command Injection (CVE-2026-25089)
Detects potential exploitation of CVE-2026-25089, an OS command injection vulnerability (CWE-78) in Fortinet FortiSandbox that allows an authenticated or remote attacker to execute arbitrary commands on the underlying operating system via crafted input to a vulnerable API/web endpoint. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is subject to BOD 26-04 prioritized remediation timelines. Detection focuses on anomalous shell/process execution spawned from FortiSandbox web/management processes, suspicious HTTP requests containing shell metacharacters against FortiSandbox management interfaces, and post-exploitation command execution artifacts.
vendor: Fortinet product: FortiSandbox cwe: CWE-78 disclosed: Jul 16, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-39808 KEV
Fortinet FortiSandbox OS Command Injection (CVE-2026-39808)
Detects potential exploitation of CVE-2026-39808, an OS command injection vulnerability (CWE-78) in Fortinet FortiSandbox that allows an authenticated or unauthenticated attacker to execute arbitrary OS commands via crafted requests to the FortiSandbox management interface. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on anomalous shell/command execution patterns originating from FortiSandbox processes, suspicious HTTP requests to the management interface containing shell metacharacters, and unexpected child processes spawned by FortiSandbox web/API services observed via syslog, proxy, or EDR telemetry on adjacent/monitoring hosts.
vendor: Fortinet product: FortiSandbox cwe: CWE-78 disclosed: Jul 16, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-58644 KEV
Microsoft SharePoint Deserialization of Untrusted Data Exploitation (CVE-2026-58644)
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-58644, a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild. Successful exploitation typically results in remote code execution via crafted serialized payloads submitted to vulnerable SharePoint endpoints (e.g. ViewState, application pages, or REST/SOAP endpoints), often followed by w3wp.exe spawning abnormal child processes, webshell drops into SharePoint application directories, and LSASS/credential access activity.
vendor: Microsoft product: SharePoint cwe: CWE-502 disclosed: Jul 16, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2023-4346 KEV
KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout (CVE-2023-4346)
Detects potential exploitation of CVE-2023-4346, an overly restrictive account lockout mechanism (CWE-645) in the KNX Association's KNX Protocol Connection Authorization Option 1 used in KNX building automation / ICS environments. The flaw allows an attacker to repeatedly attempt authorization against a KNX secure connection without being effectively locked out, enabling brute-force guessing of the connection authorization key/password used to gate access to building automation devices (HVAC, lighting, access control, alarm systems). This CVE is listed in CISA KEV and is subject to BOD 26-04 prioritized remediation timelines. Detection relies on identifying repeated failed KNX/IP secure authorization attempts from a single source against a KNX interface/gateway, or repeated connection requests bypassing expected lockout thresholds, observed via network telemetry, firewall/IDS logs, or KNXnet/IP gateway logs.
vendor: KNX Association product: KNX Protocol Connection Authorization Option 1 cwe: CWE-645 disclosed: Jul 15, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-46817 KEV
Oracle E-Business Suite Improper Privilege Management Exploitation (CVE-2026-46817)
Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite (CWE-269, CWE-287, CWE-306) that allows unauthenticated or low-privileged actors to escalate privileges or bypass authentication controls on EBS application and concurrent manager components. This vulnerability is listed in CISA KEV and is subject to BOD 26-04 remediation timelines. Detection focuses on anomalous authentication bypass patterns, privilege escalation to APPS/SYSADMIN roles, unexpected concurrent manager job submissions, and suspicious HTTP requests to EBS servlet endpoints associated with known exploitation chains.
vendor: Oracle product: E-Business Suite cwe: CWE-269, CWE-287 disclosed: Jul 15, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-54052 Public PoC PoC
n8n-MCP Cross-Tenant Workflow Backup Access (CVE-2026-54052)
Detects exploitation of CVE-2026-54052, an authorization bypass (CWE-639/CWE-862) in n8n-mcp <= 2.56.0 HTTP multi-tenant deployments allowing cross-tenant access to workflow version backups. Attackers manipulate tenant/workflow identifiers in backup retrieval requests to read another tenant's stored workflow versions, which may contain embedded credentials, API keys, and webhook secrets.
vendor: npm product: n8n-mcp cwe: CWE-639, CWE-862 disclosed: Jul 14, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-45262 Public PoC PoC
FacturaScripts REST API Authenticated SQL Injection via Where::sqlColumn Parenthesis Bypass (CVE-2026-45262)
FacturaScripts prior to and including version 2026.1 contains an authenticated SQL injection vulnerability in the REST API 'filter' parameter. The Where::sqlColumn method fails to properly sanitize column/operator tokens when parentheses are used to bypass filter validation, allowing an authenticated low-privileged API user (with a valid API key) to inject arbitrary SQL via crafted filter[field][operator] query string parameters. Given CVSS 9.9 and CWE-918 (SSRF) alongside CWE-89, exploitation may extend beyond data exfiltration into internal request forgery via database-level functions (e.g., LOAD_FILE, or DB-driver network calls), enabling full compromise of the underlying MySQL/MariaDB/PostgreSQL instance and lateral movement into internal network segments reachable from the database host.
vendor: composer product: facturascripts/facturascripts cwe: CWE-89, CWE-918 disclosed: Jul 14, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-15409 KEV
SonicWall SMA1000 Server-Side Request Forgery Exploitation (CVE-2026-15409)
Detects exploitation attempts and successful compromise indicators for CVE-2026-15409, a Server-Side Request Forgery (CWE-918) vulnerability in SonicWall SMA1000 Appliances. The vulnerability allows an unauthenticated or low-privileged attacker to coerce the SMA1000 appliance into issuing arbitrary HTTP/HTTPS requests to internal-only or cloud metadata endpoints, potentially disclosing credentials, tokens, or internal network topology, and enabling pivoting into segmented networks. This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is subject to CISA BOD 26-04 prioritized remediation timelines. Detection focuses on outbound requests originating from the SMA1000 management/proxy processes to loopback addresses, RFC1918 ranges the appliance should not otherwise reach, cloud metadata IPs (169.254.169.254), and anomalous internal service ports, correlated with SMA1000 web/application logs.
vendor: SonicWall product: SMA1000 Appliances cwe: CWE-918 disclosed: Jul 14, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-15410 KEV
SonicWall SMA1000 Code Injection Exploitation (CVE-2026-15410)
Detects exploitation attempts against SonicWall SMA1000 appliances leveraging an OS/code injection vulnerability (CWE-94) that allows an authenticated or unauthenticated remote attacker to execute arbitrary code on the appliance. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on SMA1000 web management/AMC interface access, anomalous process spawning from SMA1000 web/application service accounts, and post-exploitation artifacts such as webshells, reverse shells, or configuration tampering.
vendor: SonicWall product: SMA1000 Appliances cwe: CWE-94 disclosed: Jul 14, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-56155 KEV
Microsoft AD FS Insufficient Access Control Granularity Exploitation (CVE-2026-56155)
Detects exploitation activity targeting CVE-2026-56155, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Active Directory Federation Services (AD FS). Actively exploited (CISA KEV). The flaw allows an authenticated actor with limited privileges to obtain access to federated resources or claims beyond their intended scope due to coarse-grained authorization decisions in the AD FS relying party trust / claims pipeline, potentially enabling federation token issuance for unauthorized applications or privilege escalation across trusted relying parties. Detection focuses on anomalous AD FS token issuance patterns, unexpected relying party trust access, claims rule modification, and AD FS admin/service account activity outside baseline behavior.
vendor: Microsoft product: Active Directory Federation Services cwe: CWE-1220 disclosed: Jul 14, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-56164 KEV
Microsoft SharePoint Server Missing Authentication for Critical Function (CVE-2026-56164)
Detects exploitation attempts against CVE-2026-56164, a Missing Authentication for Critical Function vulnerability (CWE-306) in Microsoft SharePoint Server that allows unauthenticated attackers to invoke sensitive server-side functionality without prior credentials. This flaw is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed in-the-wild exploitation. Attackers typically abuse this by sending crafted HTTP requests directly to internal SharePoint API/service endpoints that fail to enforce authentication checks, potentially leading to remote code execution, data exfiltration, or the deployment of webshells (consistent with prior SharePoint ToolShell-style campaigns). This detection focuses on identifying anonymous or unauthenticated access to sensitive SharePoint endpoints, unusual IIS worker process child processes, and webshell-drop indicators following unauthenticated requests.
vendor: Microsoft product: SharePoint Server cwe: CWE-306 disclosed: Jul 14, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-61667 Public PoC PoC
DIRAC FileCatalog DatasetManager SQL Injection to RCE (CVE-2026-61667)
Detects exploitation attempts against DIRAC's FileCatalog DatasetManager component, where a SQL injection vulnerability (CWE-89) can be chained with unsafe eval() usage (CWE-95) to achieve remote code execution. Affects DIRAC versions >=6,<8.0.79; >=8.1.0a1,<9.0.22; >=9.1.0,<9.1.10. A public PoC exists (GHSA-m4m7-4cw8-62j6). Detection focuses on anomalous SQL error signatures, injection payload patterns in DatasetManager RPC calls, and subsequent process spawning from the DIRAC service process indicative of successful eval()-based code execution.
vendor: pip product: DIRAC cwe: CWE-89, CWE-95 disclosed: Jul 13, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-45579 Public PoC PoC
DIRAC RequestManager eval() Remote Code Execution (CVE-2026-45579)
Detects exploitation attempts and successful compromise of DIRAC's RequestManager component via CVE-2026-45579, a CWE-95 (Eval Injection) vulnerability where untrusted RPC input passed to RequestManager is evaluated via Python's eval() function, resulting in unauthenticated or low-privilege remote code execution. Affected DIRAC (pip package) versions are >=6,<8.0.79, >=8.1.0a1,<9.0.22, and >=9.1.0,<9.1.10. A public PoC exists (GHSA-9jpv-c7p4-997x). Detection focuses on anomalous eval-triggering payloads sent to DIRAC RequestManager RPC/DISET endpoints, resulting child process spawns from DIRAC service processes, and post-exploitation artifacts consistent with grid/HPC computing infrastructure compromise.
vendor: pip product: DIRAC cwe: CWE-95 disclosed: Jul 13, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-50551 Public PoC PoC
SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551)
Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-79 disclosed: Jul 10, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-54159 Public PoC PoC
PrestaShop ps_facetedsearch PHP Object Injection Leading to Unauthenticated RCE (CVE-2026-54159)
CVE-2026-54159 is a critical (CVSS 10.0) PHP Object Injection vulnerability (CWE-74) in the PrestaShop ps_facetedsearch module (versions >=3.0.0, <4.0.4). The module caches faceted-search filter state using unsafe PHP deserialization of user-controllable input, allowing an unauthenticated attacker to submit a crafted serialized payload that instantiates gadget-chain objects, ultimately leading to arbitrary PHP code execution on the storefront web server. Exploitation requires no authentication and no user interaction, and a public PoC exists (GHSA-m5f5-28qr-9g9r).
vendor: composer product: prestashop/ps_facetedsearch cwe: CWE-74 disclosed: Jul 10, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-54158 Public PoC PoC
SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158)
SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-79, CWE-1188 disclosed: Jul 10, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-54067 Public PoC PoC
SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067)
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
vendor: go product: github.com/siyuan-note/siyuan/kernel cwe: CWE-79, CWE-1188 disclosed: Jul 10, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48939 KEV
iCagenda Unrestricted File Upload Exploitation (CVE-2026-48939)
Detects exploitation attempts against CVE-2026-48939, an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the iCagenda Joomla component. Attackers abuse insufficient file-type validation in iCagenda's upload handlers (event image/attachment upload endpoints) to upload web shells or other executable content, achieving remote code execution on the underlying web server. This CVE is listed in CISA KEV, indicating confirmed active exploitation and mandated remediation under BOD 26-04.
vendor: iCagenda product: iCagenda cwe: CWE-434 disclosed: Jul 10, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-56291 KEV
Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291)
Detects exploitation attempts against CVE-2026-56291, an unrestricted upload of file with dangerous type vulnerability (CWE-434) in Balbooa Forms for Joomla. This vulnerability is listed in CISA KEV, indicating confirmed active exploitation. Attackers abuse the forms file upload functionality to upload web shells or other malicious executable content (PHP, PHTML, PHAR, etc.) bypassing extension/type restrictions, leading to remote code execution on the underlying web server.
vendor: Balbooa product: Forms cwe: CWE-434 disclosed: Jul 10, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-52778 Public PoC PoC
YesWiki Formula Calculator Unsafe eval() Remote Code Execution (CVE-2026-52778)
YesWiki prior to 4.6.6 exposes an unsafe PHP eval() call in its Formula Calculator feature (BazaR calculated field logic). An unauthenticated or low-privileged attacker can craft a malicious formula expression that is passed directly into eval(), resulting in arbitrary PHP code execution on the underlying web server, or a crafted expression that triggers resource exhaustion / infinite loops causing denial of service. Successful exploitation grants the attacker the privileges of the web server process, enabling webshell deployment, credential theft, and lateral movement.
vendor: composer product: yeswiki/yeswiki cwe: CWE-94, CWE-1333 disclosed: Jul 9, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-52831 Public PoC PoC
Nuclio Cron Trigger Header/Body Command Injection (CVE-2026-52831)
Detects exploitation of CVE-2026-52831, a critical (CVSS 10.0) command injection vulnerability in Nuclio's cron trigger handling. Unsanitized event headers and body content are injected into a CronJob-generated shell command, enabling unauthenticated attackers to achieve persistent remote code execution inside Nuclio function containers and, from there, the underlying Kubernetes node. Detection focuses on shell metacharacter injection in Nuclio dashboard/trigger logs, anomalous child processes spawned from nuclio-handler/processor binaries, and suspicious CronJob-launched shell activity in Kubernetes.
vendor: go product: github.com/nuclio/nuclio cwe: CWE-78 disclosed: Jul 8, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-48282 KEV
CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation
Detects exploitation attempts targeting CVE-2026-48282, a path traversal vulnerability (CWE-22) in Adobe ColdFusion. Active exploitation confirmed by CISA KEV listing. Attackers may use directory traversal sequences in HTTP requests to read sensitive files outside the web root, including configuration files containing credentials, or to achieve remote code execution via file write primitives.
vendor: Adobe product: ColdFusion cwe: CWE-22 disclosed: Jul 7, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-48908 KEV
CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted File Upload
Detects exploitation of CVE-2026-48908, an unrestricted file upload vulnerability (CWE-434) in JoomShaper SP Page Builder for Joomla. Attackers can upload files with dangerous types (e.g., PHP webshells) through the page builder interface, leading to remote code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: JoomShaper product: SP Page Builder cwe: CWE-434 disclosed: Jul 7, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-56290 KEV
CVE-2026-56290: Joomlack Page Builder Improper Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-56290, an improper access control vulnerability (CWE-284) in Joomlack Page Builder for Joomla. This KEV-listed vulnerability allows unauthorized access to restricted Page Builder functionality, potentially enabling content manipulation, privilege escalation, or unauthorized administrative actions on affected Joomla installations.
vendor: Joomlack product: Page Builder cwe: CWE-284 disclosed: Jul 7, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-55500 Public PoC PoC
9router (npm) Unprotected Database Import/Export Leading to Credential Theft and Database Takeover (CVE-2026-55500)
CVE-2026-55500 affects the 9router npm package (<= 0.4.71), which exposes an unauthenticated/improperly-protected database import/export interface. Attackers can invoke this exposed functionality to exfiltrate the entire application database — including credentials, session tokens, and configuration secrets — or import a malicious database to achieve full application takeover. CVSS 9.9, CWE-200 (Exposure of Sensitive Information). A public PoC/advisory exists (GHSA-qvfm-67h2-2qfx). Detections focus on anomalous HTTP requests to database export/import endpoints, bulk data egress, unauthenticated administrative API access, and post-exploitation credential misuse.
vendor: npm product: 9router cwe: CWE-200 disclosed: Jul 6, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-54769 Public PoC PoC
CVE-2026-54769: Langroid TableChatAgent Sandbox Escape via eval() RCE
Detects exploitation of CVE-2026-54769, a critical sandbox escape vulnerability in Langroid's TableChatAgent component (versions <= 0.65.1). The incomplete eval() mitigation allows attackers to craft malicious inputs that escape the intended sandbox and achieve remote code execution on the host system. CVSS 10.0 with public PoC available.
vendor: pip product: langroid cwe: CWE-94 disclosed: Jul 6, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-52889 Public PoC PoC
Formie Hidden Field Default Server-Side Template Injection (CVE-2026-52889)
Detects exploitation attempts against CVE-2026-52889, a Server-Side Template Injection (SSTI, CWE-1336) vulnerability in the Formie plugin (verbb/formie) for Craft CMS. The vulnerability exists in how Formie processes 'default value' expressions for Hidden form fields, allowing an unauthenticated or low-privileged attacker to inject Twig template syntax that is evaluated server-side, potentially leading to remote code execution. Affects verbb/formie < 3.1.27. Detection focuses on Twig/Craft template injection payload patterns in form submission requests, anomalous POST bodies to Formie submission endpoints, and resulting web shell / RCE indicators (process spawning from PHP-FPM/Craft, outbound connections, file writes to web root).
vendor: composer product: verbb/formie cwe: CWE-1336 disclosed: Jul 6, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-53913 Public PoC PoC
Apache Camel camel-keycloak KeycloakSecurityPolicy Authentication Bypass (CVE-2026-53913)
Apache Camel's camel-keycloak component contains a KeycloakSecurityPolicy that improperly handles authentication (CWE-287), resulting in missing authentication for a critical function and a fail-open condition. Affected versions >=4.15.0 <4.18.3 and >=4.19.0 <4.21.0 allow requests to bypass Keycloak-enforced authentication checks on Camel routes, permitting unauthenticated access to protected endpoints/routes. CVSS 9.8, PoC public via GHSA-qvc3-6q9x-95pj.
vendor: maven product: org.apache.camel:camel-keycloak cwe: CWE-287 disclosed: Jul 6, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-48204 Public PoC PoC
Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204)
Detects exploitation attempts against CVE-2026-48204, a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. Affected versions (>=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0) fail to filter caller-supplied gridfs.* HTTP/Camel exchange headers before applying them to GridFS producer operations, allowing an attacker to override the intended GridFS operation (e.g. force a delete/listAll/findOne instead of the intended write) and inject NoSQL query operators into MongoDB GridFS filter queries. This can lead to unauthorized data disclosure, deletion of stored files, or NoSQL injection against the backing MongoDB metadata collection. A public PoC/advisory exists (GHSA-f7g3-2cg6-f5hj).
vendor: maven product: org.apache.camel:camel-mongodb-gridfs cwe: CWE-20 disclosed: Jul 6, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-49352 Public PoC PoC
9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352)
Detects exploitation attempts against 9router (npm package) versions 0.2.21 through 0.4.41, which ship a hardcoded default fallback JWT signing secret (CWE-798). When an operator fails to override the default secret, an attacker can forge arbitrary JWTs (including admin/privileged claims) and bypass authentication entirely. Detection focuses on identifying JWTs signed with the known-public default secret, anomalous authentication success patterns following token forgery, and process/network indicators consistent with public PoC exploitation against 9router deployments.
vendor: npm product: 9router cwe: CWE-798 disclosed: Jul 2, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-54617 Public PoC PoC
LaunchServer FileServerHandler Unauthenticated Path Traversal (CVE-2026-54617)
Detects exploitation attempts against pro.gravit.launcher:launchserver-api's FileServerHandler, which is vulnerable to an unauthenticated path traversal (CWE-22) allowing arbitrary file read (CWE-200) and disclosure of sensitive data such as credentials or keys (CWE-522) in versions <= 5.7.11. Attackers send crafted HTTP requests containing traversal sequences (../, encoded variants, absolute paths) to the LaunchServer file-serving endpoint to read files outside the intended web root, including server configs, private keys, and auth databases.
vendor: maven product: pro.gravit.launcher:launchserver-api cwe: CWE-22, CWE-200 disclosed: Jul 2, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-9559 Public PoC PoC
Mautic Campaign Import Path Traversal (CVE-2026-9559)
Detects exploitation attempts against CVE-2026-9559, a critical path traversal vulnerability (CVSS 9.9) in Mautic core's Campaign Import feature affecting versions >=7.0.0, <7.1.2. An unauthenticated or low-privileged attacker can craft a malicious campaign import file (CSV/ZIP) containing path traversal sequences (../) or archive entries that write files outside the intended import directory, potentially achieving arbitrary file write and remote code execution via webshell placement. A public PoC exists (GHSA-6r9h-4h75-7q4x). This detection identifies suspicious campaign import requests, path traversal payloads in multipart uploads, unexpected file writes outside Mautic's media/import directories, and subsequent webshell execution.
vendor: composer product: mautic/core cwe: CWE-22, CWE-73 disclosed: Jul 2, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-9558 Public PoC PoC
Mautic Server-Side Template Injection (SSTI) in Theme Templates
Detects exploitation of CVE-2026-9558, a critical (CVSS 9.9) Server-Side Template Injection vulnerability in Mautic's theme template engine (CWE-1336, Twig-based SSTI). An authenticated or in some deployments unauthenticated attacker can inject malicious Twig template syntax through theme customization, email/landing page builder, or theme upload/import functionality, achieving remote code execution on the underlying PHP host. Affects mautic/core versions >=1.3.0 <4.4.13, >=5.0.0 <5.2.11, >=6.0.0 <6.0.9, and >=7.0.0 <7.1.2. A public PoC/advisory exists (GHSA-9fx4-7cmj-47vg).
vendor: composer product: mautic/core cwe: CWE-1336 disclosed: Jul 2, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-50027 Public PoC PoC
MCP Memory Service Unauthenticated Document API Access (CVE-2026-50027)
Detects exploitation of CVE-2026-50027, a missing authentication vulnerability (CWE-306) in mcp-memory-service versions prior to 10.67.1 that allows unauthenticated attackers to read, write, and delete stored memory documents via exposed API endpoints. Successful exploitation grants full unauthenticated access to sensitive memory/document contents, enabling data exfiltration, tampering, or destruction of stored AI agent memory state.
vendor: pip product: mcp-memory-service cwe: CWE-306 disclosed: Jul 2, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-44935 Public PoC PoC
Rancher Fleet Cross-Namespace Secret Disclosure via Unvalidated valuesFrom in Helm Deployer (CVE-2026-44935)
Detects exploitation of CVE-2026-44935, a critical (CVSS 9.9) vulnerability in Rancher Fleet's Helm Deployer where unvalidated `valuesFrom` references allow a low-privileged user with GitRepo/Bundle creation rights in one namespace to reference and exfiltrate Secret or ConfigMap contents from arbitrary other namespaces, including cluster-admin credentials, cloud provider keys, and Fleet agent tokens. Exploitation involves crafting a GitOps Bundle or GitRepo resource whose Helm `valuesFrom` fields point at a Secret/ConfigMap name in a namespace the attacker does not own; the Fleet controller resolves the reference without namespace/RBAC validation and renders the secret data into Helm values, which are then visible via `helm get values`, Bundle status, or logs. Affected versions: Fleet >= 0.15.0 < 0.15.2, >= 0.14.0 < 0.14.6, >= 0.13.0 < 0.13.11, >= 0.12.0 < 0.12.15. A public PoC/advisory is available; no changes to affected/patched version status have been reported since initial disclosure.
vendor: go product: github.com/rancher/fleet cwe: CWE-863 disclosed: Jul 1, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-45659 KEV
CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE
Detects exploitation of CVE-2026-45659, a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server. Successful exploitation allows remote code execution by sending crafted serialized .NET objects to SharePoint web endpoints. This CVE is listed in CISA KEV indicating active exploitation in the wild.
vendor: Microsoft product: SharePoint Server cwe: CWE-502 disclosed: Jul 1, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-50566 Public PoC PoC
Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566)
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
vendor: go product: github.com/fission/fission cwe: CWE-250, CWE-269 disclosed: Jun 30, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-50564 Public PoC PoC
Fission Environment CRD PodSpec Passthrough Node Escape (CVE-2026-50564)
Fission (<=1.23.0) allows the Environment Custom Resource podspec passthrough (poolspec.container / poolspec.podspec) to inject arbitrary Kubernetes PodSpec fields including hostPID, hostNetwork, hostIPC, and privileged securityContext into builder/executor pods created by the fission-builder and fission-router controllers. Any principal able to create or update Environment CRDs (which in many multi-tenant Fission deployments includes low-privileged function developers) can escalate to full node compromise by scheduling a privileged, host-namespace-sharing pod, then pivoting to the underlying kubelet, container runtime socket, or other pods on the node. CVSS 9.9.
vendor: go product: github.com/fission/fission cwe: CWE-269, CWE-284 disclosed: Jun 30, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-50563 Public PoC PoC
Fission Container Executor PodSpec Injection - Node Escape Attempt
Detects exploitation of CVE-2026-50563, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0). The container executor allows unauthenticated or low-privileged users to inject arbitrary PodSpec fields into function pods, enabling container escape to the underlying Kubernetes node. Attackers can inject hostPID, hostNetwork, privileged containers, hostPath volume mounts, or custom service accounts to achieve full node compromise.
vendor: go product: github.com/fission/fission cwe: CWE-269, CWE-284 disclosed: Jun 30, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-50545 Public PoC PoC
CVE-2026-50545: Fission Environment CRD PodSpec Injection
Detects exploitation of CVE-2026-50545, a critical vulnerability in Fission serverless framework (<= 1.23.0) where an attacker with permissions to create or modify Fission Environment custom resources can inject arbitrary PodSpec fields, enabling node escape and full Kubernetes cluster takeover. The vulnerability stems from insufficient validation of user-supplied PodSpec in the Environment CRD, allowing privilege escalation via hostPID, hostNetwork, privileged containers, or volume mounts to sensitive node paths.
vendor: go product: github.com/fission/fission cwe: CWE-269, CWE-284 disclosed: Jun 30, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48558 KEV
CVE-2026-48558 — SimpleHelp Authentication Bypass (CWE-347)
Detects exploitation of CVE-2026-48558, an authentication bypass vulnerability in SimpleHelp remote support software caused by improper verification of cryptographic signatures (CWE-347). This KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls. SimpleHelp is commonly used by MSPs and IT support teams, making it a high-value target for initial access and lateral movement.
vendor: SimpleHelp product: SimpleHelp cwe: CWE-347 disclosed: Jun 29, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-49257 Public PoC PoC
CVE-2026-49257: mcp-pinot Unauthenticated Tool Invocation via Default oauth_enabled=False
Detects exploitation of CVE-2026-49257, a critical authentication bypass in mcp-pinot-server (<=3.0.1). The server defaults to oauth_enabled=False and binds to 0.0.0.0, allowing any network-adjacent or internet-facing attacker to invoke MCP tools without authentication. CVSS 10.0 with public PoC available.
vendor: pip product: mcp-pinot-server cwe: CWE-306 disclosed: Jun 26, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-49252 Public PoC PoC
Deepstream Server Prototype Pollution (CVE-2026-49252)
CVE-2026-49252 is a critical prototype pollution vulnerability (CVSS 9.9) in @deepstream/server versions prior to 10.0.5. An attacker can manipulate JavaScript object prototypes via crafted deepstream messages, potentially leading to remote code execution, privilege escalation, or denial of service. A public proof-of-concept is available.
vendor: npm product: @deepstream/server cwe: CWE-1321 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48769 Public PoC PoC
CVE-2026-48769: Incus Arbitrary File Write via Trusted Image Hash
CVE-2026-48769 is a critical arbitrary file write vulnerability (CVSS 9.9) in Incus container/VM manager versions prior to 7.2.0. The vulnerability exists in the incusd daemon due to improper validation of image hashes from trusted sources, allowing an attacker to write arbitrary files on the client system. A malicious or compromised image server trusted by the Incus client can serve a crafted image that causes incusd to write attacker-controlled content to arbitrary filesystem paths, potentially leading to privilege escalation, persistence, or full system compromise.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-20 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48755 Public PoC PoC
Incus Argument Injection in Backup Compression Algorithm (CVE-2026-48755)
CVE-2026-48755 is a critical argument injection vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. The backup compression algorithm parameter is not properly validated, allowing an attacker with API access to inject arbitrary arguments into the compression utility invocation. This can lead to Arbitrary File Write (AFW) and Arbitrary Command Execution (ACE) on the host system running incusd, potentially escaping the container management boundary and compromising the underlying hypervisor or host.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-20 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48753 Public PoC PoC
CVE-2026-48753: Incus S3 Multipart Upload Path Traversal Arbitrary File Write
Detects exploitation of CVE-2026-48753, a critical path traversal vulnerability (CVSS 9.9) in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.1.0. An attacker can write arbitrary files on the host by crafting malicious S3 multipart upload requests containing path traversal sequences in the object key, potentially leading to container escape, privilege escalation, or persistent backdoor installation.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48752 Public PoC PoC
Incus Arbitrary File Read/Write via Malicious Image Template Symlink
CVE-2026-48752 is a critical vulnerability (CVSS 9.9) in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. A malicious container image can include a crafted symlink within the templates/ directory that, when processed by incusd during image import or container creation, allows an attacker to read or write arbitrary files on the host filesystem. This constitutes a container escape primitive with host takeover potential. A public proof-of-concept exists.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48751 Public PoC PoC
CVE-2026-48751: Incus Restricted Project Bypass Leading to Arbitrary Command Execution
Detects exploitation of CVE-2026-48751, a critical missing authorization vulnerability (CWE-862) in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. An attacker with access to a restricted Incus project can bypass project restrictions to execute arbitrary commands on the host system, achieving container escape with a CVSS score of 9.9. A public proof-of-concept is available.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-862 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48750 Public PoC PoC
Incus exec-output Symlink Arbitrary File Write on Host (CVE-2026-48750)
CVE-2026-48750 is a critical arbitrary file write vulnerability (CVSS 9.9) in Incus container/VM manager (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. A crafted container image can place a symlink at the exec-output path, causing incusd to write attacker-controlled content to arbitrary locations on the host filesystem. This enables container escape leading to full host compromise. A public PoC is available.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-48749 Public PoC PoC
CVE-2026-48749: Incus Arbitrary File Read/Write via rootfs Symlink in Malicious Image
Detects exploitation of CVE-2026-48749, a critical vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. Attackers can craft a malicious container image with symlinks in the rootfs/ directory that resolve to host filesystem paths, enabling arbitrary file read and write on the underlying host. This constitutes a container escape primitive and may lead to full host compromise. CVSS 9.9 with public PoC available.
vendor: go product: github.com/lxc/incus/v7/cmd/incusd cwe: CWE-73 disclosed: Jun 26, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-46595 Public PoC PoC
CVE-2026-46595: golang.org/x/crypto/ssh VerifiedPublicKeyCallback Authentication Bypass
Detects exploitation of CVE-2026-46595, a critical authentication bypass vulnerability (CVSS 10.0) in golang.org/x/crypto/ssh versions prior to 0.52.0. When VerifiedPublicKeyCallback is used, SSH server implementations fail to enforce permission checks, allowing attackers to authenticate without proper authorization. This is a regression/variant of CVE-2024-45337 and carries a public PoC. Red Hat continues to issue errata across RHEL-derived ecosystems (RHSA-2026:23262, RHSA-2026:23264, RHSA-2026:26546, RHSA-2026:26547, RHSA-2026:30650, RHSA-2026:30651, RHSA-2026:33531, RHSA-2026:33524, RHSA-2026:36648, RHSA-2026:36207, RHSA-2026:36820, RHSA-2026:36808, RHSA-2026:36797, RHSA-2026:36796, RHSA-2026:36651, RHSA-2026:37387, RHSA-2026:37275, RHSA-2026:40118), indicating sustained, broad distribution-level patching activity as downstream vendors work through their release trains.
vendor: go product: golang.org/x/crypto/ssh cwe: CWE-863 disclosed: Jun 25, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-55166 Public PoC PoC
CVE-2026-55166: Lemur ACME SSRF and IDOR Leading to AWS IAM/PKI Compromise
Detects exploitation of CVE-2026-55166 in Netflix Lemur (versions < 1.9.2), which combines an ACME protocol Server-Side Request Forgery (CWE-918) with a creator-equality Insecure Direct Object Reference (CWE-639/CWE-285). Successful exploitation allows an attacker to pivot from certificate management to AWS IAM credential theft and PKI infrastructure compromise. PoC is publicly available. Fixed in Lemur 1.9.2 — organizations should upgrade immediately.
vendor: pip product: lemur cwe: CWE-285, CWE-639 disclosed: Jun 25, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-12569 KEV
CVE-2026-12569 - PTC Windchill and FlexPLM Improper Input Validation / Unsafe Deserialization
Detects exploitation attempts targeting CVE-2026-12569, an improper input validation and unsafe deserialization vulnerability (CWE-20, CWE-502) in PTC Windchill and FlexPLM. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Attackers may leverage this to achieve remote code execution via crafted serialized objects or malformed input submitted to Windchill/FlexPLM HTTP endpoints.
vendor: PTC product: Windchill and FlexPLM cwe: CWE-20, CWE-502 disclosed: Jun 25, 20269.8 criticalwrite-up soon - CVE-2026-20230 KEV
Cisco Unified Communications Manager SSRF Exploitation Detected
Detects exploitation attempts of CVE-2026-20230, a Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Communications Manager (CUCM). An unauthenticated remote attacker may craft malicious HTTP requests to the CUCM web interface to cause the server to initiate requests to arbitrary internal or external destinations, potentially enabling internal network reconnaissance, credential theft via metadata services, or pivoting to internal resources.
vendor: Cisco product: Unified Communications Manager cwe: CWE-918 disclosed: Jun 25, 20268.6 highwrite-up soon - CVE-2026-54350 Public PoC PoC
Budibase Anonymous NoSQL Operator Injection via Published-App Query Templates
CVE-2026-54350 is a critical (CVSS 10.0) NoSQL operator injection vulnerability in @budibase/server versions prior to 3.39.12. Unauthenticated attackers can inject MongoDB-style operators (e.g., $gt, $where, $regex) into published-app query templates, bypassing authentication and data access controls. Successful exploitation can lead to full database exfiltration, authentication bypass, and remote code execution via $where clauses. A public PoC is available.
vendor: npm product: @budibase/server cwe: CWE-89, CWE-943 disclosed: Jun 23, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-52813 Public PoC PoC
Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks
CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.
vendor: go product: gogs.io/gogs cwe: CWE-23 disclosed: Jun 23, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-52806 Public PoC PoC
CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge
Detects exploitation of CVE-2026-52806, a critical command injection vulnerability (CWE-77) in Gogs versions prior to 0.14.3. An attacker can inject arbitrary shell commands via the git rebase --exec argument during pull request merge operations, leading to remote code execution on the Gogs server. A public PoC is available.
vendor: go product: gogs.io/gogs cwe: CWE-77 disclosed: Jun 23, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-34908 KEV
CVE-2026-34908 — Ubiquiti UniFi OS Improper Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-34908, an improper access control vulnerability (CWE-284) in Ubiquiti UniFi OS. This vulnerability is listed on the CISA Known Exploited Vulnerabilities catalog and allows attackers to bypass access controls on UniFi OS devices. Detection focuses on unauthorized API access, anomalous management plane requests, and lateral movement patterns consistent with UniFi controller compromise.
vendor: Ubiquiti product: UniFi OS cwe: CWE-284 disclosed: Jun 23, 202610.0 criticalwrite-up soon - CVE-2026-34909 KEV
Ubiquiti UniFi OS Path Traversal Exploitation Attempt
Detects exploitation attempts targeting CVE-2026-34909, a path traversal vulnerability (CWE-22) in Ubiquiti UniFi OS. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to traverse directory boundaries to access sensitive files or execute unauthorized actions on UniFi network management devices.
vendor: Ubiquiti product: UniFi OS cwe: CWE-22 disclosed: Jun 23, 202610.0 criticalwrite-up soon - CVE-2026-34910 KEV
Ubiquiti UniFi OS Improper Input Validation Vulnerability (CVE-2026-34910)
Detects exploitation attempts targeting CVE-2026-34910, an improper input validation vulnerability in Ubiquiti UniFi OS. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog and allows attackers to send malformed or unexpected input to UniFi OS network management interfaces, potentially leading to unauthorized access, command execution, or device compromise. UniFi OS powers a wide range of Ubiquiti network devices including Dream Machines, Cloud Keys, and network switches used in enterprise and SMB environments.
vendor: Ubiquiti product: UniFi OS cwe: CWE-20 disclosed: Jun 23, 202610.0 criticalwrite-up soon - CVE-2025-67038 KEV
CVE-2025-67038 Lantronix EDS5000 Code Injection Exploitation
Detects exploitation attempts targeting CVE-2025-67038, a code injection vulnerability (CWE-78/CWE-94) in Lantronix EDS5000 series device servers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to inject OS commands or code through the device management interface. The EDS5000 series includes EDS5008, EDS5016, and EDS5032 models commonly deployed as serial-to-network device servers in industrial and enterprise environments.
vendor: Lantronix product: EDS5000 cwe: CWE-78, CWE-94 disclosed: Jun 23, 20269.8 criticalwrite-up soon - CVE-2026-44179 Public PoC PoC
CVE-2026-44179: XWiki Pro Macros RCE via Excerpt-Include Macro
Detects exploitation of CVE-2026-44179, a critical remote code execution vulnerability in com.xwiki.pro:xwiki-pro-macros versions >= 1.13 and < 1.14.5. The vulnerability (CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code) allows unauthenticated or low-privileged attackers to execute arbitrary code on the server by injecting malicious Groovy/Velocity script expressions into XWiki page titles or content that are subsequently processed by the excerpt-include macro. A public proof-of-concept is available.
vendor: maven product: com.xwiki.pro:xwiki-pro-macros cwe: CWE-95 disclosed: Jun 22, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-33646 Public PoC PoC
CVE-2026-33646: Mise Arbitrary Code Execution via Tera Template Injection in .tool-versions
Detects exploitation of CVE-2026-33646, a critical trust bypass vulnerability in mise (formerly rtx) versions prior to 2026.3.10. Attackers can embed Tera template directives inside .tool-versions files to achieve arbitrary code execution when mise processes the file, bypassing trust checks. CVSS 9.6. PoC public.
vendor: rust product: mise disclosed: Jun 22, 20269.6 criticalVector not yet publishedwrite-up soon - CVE-2025-58048 Public PoC PoC
CVE-2025-58048: Paymenter Remote Code Execution via Unrestricted File Upload
Detects exploitation of CVE-2025-58048, a critical unrestricted file upload vulnerability (CWE-434) in Paymenter versions prior to 1.2.11. Attackers can upload malicious files (e.g., PHP webshells) through publicly accessible upload endpoints, achieving remote code execution on the server. CVSS 9.9 with public PoC available.
vendor: composer product: paymenter/paymenter cwe: CWE-434 disclosed: Jun 22, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-55255 KEV PoC
Langflow IDOR: Unauthorized Access to Another User's Flow via /api/v1/responses
CVE-2026-55255 is a critical IDOR (Insecure Direct Object Reference) vulnerability in Langflow versions prior to 1.9.1, now confirmed actively exploited in the wild and listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. An authenticated attacker can enumerate and access another user's flow data by manipulating object identifiers in requests to the /api/v1/responses endpoint. With a CVSS score of 9.9, this vulnerability allows horizontal privilege escalation between users, potentially exposing sensitive AI flow configurations, credentials embedded in flows, and proprietary automation logic. Organizations running Langflow must treat patching as urgent given KEV status and active exploitation.
vendor: pip product: langflow cwe: CWE-639 disclosed: Jun 19, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-54782 Public PoC PoC
CoreWCF SAML Token Signature Validation Authentication Bypass (CVE-2026-54782)
CVE-2026-54782 is a critical (CVSS 10.0) authentication bypass vulnerability in CoreWCF.Primitives affecting SAML 1.1 and 2.0 token signature validation. An unauthenticated attacker can craft a SAML assertion with an invalid or missing signature that CoreWCF accepts as valid, bypassing all authentication controls on WCF service endpoints. Affects CoreWCF.Primitives < 1.8.1 and >= 1.9.0, < 1.9.1. A public PoC exists.
vendor: nuget product: CoreWCF.Primitives cwe: CWE-290, CWE-347 disclosed: Jun 19, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-54051 Public PoC PoC
CVE-2026-54051: network-ai npm Package OS Command Injection
Detects exploitation of CVE-2026-54051, a critical OS command injection vulnerability (CWE-78) in the npm package 'network-ai' versions prior to 5.9.1. Improper neutralization of special elements allows attackers to inject arbitrary OS commands through the package's API, potentially leading to full system compromise. A public PoC is available.
vendor: npm product: network-ai cwe: CWE-78 disclosed: Jun 19, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-0755 Public PoC PoC
CVE-2026-0755: gemini-mcp-tool OS Command Injection and File Exfiltration via Prompt Quoting
CVE-2026-0755 is a critical OS command injection vulnerability (CWE-78) in the npm package gemini-mcp-tool versions >= 1.1.2 and < 1.1.6. Attackers can craft malicious prompts containing unescaped shell metacharacters or @file directives to achieve arbitrary OS command execution and local file exfiltration on systems running the affected MCP tool. The vulnerability arises from insufficient sanitization of user-supplied prompt strings before they are passed to underlying shell execution contexts. A public proof-of-concept exists. CVSS score is 9.8 (Critical).
vendor: npm product: gemini-mcp-tool cwe: CWE-78 disclosed: Jun 18, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-47103 Public PoC PoC
python-statemachine SCXML <data expr> Eval Injection (CVE-2026-47103)
CVE-2026-47103 is a critical eval injection vulnerability (CWE-95) in python-statemachine versions >= 3.0.0 and < 3.2.0. When processing SCXML documents, the library evaluates expressions in <data expr=...> elements using Python's eval(), allowing an attacker who can supply or influence SCXML input to execute arbitrary Python code in the context of the application process. A public PoC is available and exploitation requires no authentication when SCXML is parsed from user-controlled input. CVSS score 9.8.
vendor: pip product: python-statemachine cwe: CWE-95 disclosed: Jun 18, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-20253 KEV
CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function
Detects exploitation attempts targeting CVE-2026-20253, a missing authentication vulnerability (CWE-306) in Splunk Enterprise. This KEV-listed vulnerability allows unauthenticated access to critical Splunk functions. Attackers may leverage this to execute searches, exfiltrate data, or manipulate Splunk configurations without valid credentials.
vendor: Splunk product: Enterprise cwe: CWE-306 disclosed: Jun 18, 20269.8 criticalwrite-up soon - CVE-2026-32966 Public PoC PoC
Apache DolphinScheduler DataSource API Missing Authorization - Arbitrary Metadata Disclosure (CVE-2026-32966)
Apache DolphinScheduler versions before 3.4.2 contain a missing authorization check in the DataSource API endpoint. An unauthenticated or low-privileged attacker can query data source metadata including connection strings, credentials, hostnames, and database names without appropriate access controls. CVSS 9.8 critical. Public PoC available.
vendor: maven product: org.apache.dolphinscheduler:dolphinscheduler-api cwe: CWE-863 disclosed: Jun 17, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-49980 Public PoC PoC
Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980)
CVE-2026-49980 is a critical unauthenticated remote code execution vulnerability in Rclone versions 1.46.0 through 1.74.2. When the rclone remote control daemon (rcd) is started with the --rc-serve flag, an attacker can instantiate arbitrary remotes inline via the RC API without authentication, bypassing the fix introduced for CVE-2026-41179. This allows execution of arbitrary commands on the host running rclone rcd. CVSS 9.8. PoC is publicly available.
vendor: go product: github.com/rclone/rclone cwe: CWE-306 disclosed: Jun 16, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-56266 Public PoC PoC
Crawl4AI Docker API Multiple Critical Vulnerabilities (File Write, SSRF, Auth Bypass, XSS, JS Execution)
Detects exploitation of CVE-2026-56266 affecting Crawl4AI <= 0.8.6 Docker API. The vulnerability bundle includes unauthenticated access (CWE-306), path traversal file write (CWE-22), server-side request forgery (CWE-918), stored/reflected XSS (CWE-79), JavaScript injection/execution (CWE-94), and hardcoded credentials (CWE-798). A public PoC is available. Successful exploitation allows full container compromise, internal network pivoting, and arbitrary file write to the host.
vendor: pip product: crawl4ai cwe: CWE-22, CWE-79 disclosed: Jun 16, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-53753 Public PoC PoC
Crawl4AI AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE
Detects exploitation of CVE-2026-53753, a critical pre-authentication remote code execution vulnerability in Crawl4AI (<=0.8.6) Docker API. The vulnerability allows attackers to escape Python AST-based sandboxing via generator frame introspection (gi_frame.f_back chain), enabling arbitrary code execution without authentication. CVSS 9.8 critical; public PoC available.
vendor: pip product: crawl4ai cwe: CWE-94, CWE-913 disclosed: Jun 16, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-48907 KEV
Widget Factory Joomla Content Editor Improper Access Control (CVE-2026-48907)
Detects exploitation of CVE-2026-48907, an improper access control vulnerability (CWE-284) in the Joomla Content Editor (JCE) plugin by Widget Factory. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass access controls, potentially enabling unauthorized file uploads, remote code execution, or administrative actions within Joomla CMS installations.
vendor: Widget Factory product: Joomla Content Editor cwe: CWE-284 disclosed: Jun 16, 20269.8 criticalwrite-up soon - CVE-2026-30120 Public PoC PoC
Remotion RCE via Code Injection (CVE-2026-30120)
Detects exploitation of CVE-2026-30120, a critical remote code execution vulnerability in the Remotion npm package (versions < 4.0.410). The vulnerability stems from improper code injection controls (CWE-94), allowing attackers to execute arbitrary code in environments running vulnerable Remotion versions. A public PoC exists, elevating exploitation risk.
vendor: npm product: remotion cwe: CWE-94 disclosed: Jun 15, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-53633 Public PoC PoC
CVE-2026-53633: Vitest Browser Mode API RCE via CDP Proxy and Config Overwrite
CVE-2026-53633 is a critical (CVSS 9.8) remote code execution vulnerability in @vitest/browser and vite-plus packages. The browser mode API is exposed without adequate authorization controls (CWE-749, CWE-862), allowing unauthenticated attackers to proxy Chrome DevTools Protocol (CDP) commands and overwrite configuration files. This can lead to arbitrary code execution on the host running Vitest in browser mode. Affected versions include @vitest/browser >= 3.0.0 <= 3.2.4, >= 4.0.0 <= 4.1.7, >= 5.0.0-beta.0 <= 5.0.0-beta.3, and vite-plus <= 0.1.23. A public PoC exists.
vendor: npm product: @vitest/browser, vite-plus cwe: CWE-749, CWE-862 disclosed: Jun 15, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-54420 KEV
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
Detects exploitation of CVE-2026-54420, a UNIX symbolic link (symlink) following vulnerability in the LiteSpeed cPanel Plugin. Attackers with local access can create malicious symlinks to read or overwrite files outside the intended directory, potentially leading to privilege escalation or unauthorized file access on cPanel-managed hosting servers. This vulnerability is actively exploited in the wild (CISA KEV).
vendor: LiteSpeed product: cPanel Plugin cwe: CWE-61 disclosed: Jun 15, 20268.5 highwrite-up soon - CVE-2026-20262 KEV
Cisco Catalyst SD-WAN Manager Path Traversal Exploitation
Detects exploitation attempts targeting CVE-2026-20262, a path traversal vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager. Active exploitation has been confirmed by CISA KEV. Attackers can traverse directory boundaries via crafted HTTP requests to access sensitive files outside the web root, potentially exposing credentials, configuration data, or enabling further compromise of the SD-WAN management plane.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-22 disclosed: Jun 15, 20266.5 mediumwrite-up soon - CVE-2026-35273 KEV
Oracle PeopleSoft PeopleTools Missing Authentication for Critical Function (CVE-2026-35273)
CVE-2026-35273 is a missing authentication vulnerability (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated remote attacker can access critical PeopleSoft functions without authentication, potentially leading to unauthorized data access, privilege escalation, or full system compromise. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: Oracle product: PeopleSoft Enterprise PeopleTools cwe: CWE-306 disclosed: Jun 12, 20269.8 criticalwrite-up soon - CVE-2026-48062 Public PoC PoC
CVE-2026-48062: CodeIgniter4 File Upload Extension Validation Bypass (ext_in Rule)
CVE-2026-48062 affects CodeIgniter4 framework versions prior to 4.7.2. The `ext_in` validation rule fails to properly validate file extensions during upload, allowing attackers to bypass extension restrictions and upload arbitrary files including web shells or malicious executables. This unrestricted file upload vulnerability (CWE-434) has a CVSS score of 9.8 and a public proof-of-concept. Successful exploitation can lead to remote code execution on the hosting server.
vendor: composer product: codeigniter4/framework cwe: CWE-434 disclosed: Jun 11, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-10520 KEV
Ivanti Sentry OS Command Injection Exploitation (CVE-2026-10520)
Detects exploitation attempts targeting CVE-2026-10520, an OS command injection vulnerability (CWE-78) in Ivanti Sentry. This vulnerability is actively exploited in the wild (CISA KEV) and allows unauthenticated or authenticated attackers to inject operating system commands through Ivanti Sentry's administrative or API interfaces, potentially leading to full system compromise. Ivanti Sentry acts as a gateway for enterprise mobile device management, making it a high-value target for threat actors seeking persistent access to corporate infrastructure.
vendor: Ivanti product: Sentry cwe: CWE-78 disclosed: Jun 11, 202610.0 criticalwrite-up soon - CVE-2026-48030 Public PoC PoC
Pheditor OS Command Injection via Unsanitized 'dir' Parameter (CVE-2026-48030)
Detects exploitation of CVE-2026-48030, a critical OS command injection vulnerability in Pheditor versions 2.0.1 through 2.0.3. The terminal handler accepts an unsanitized 'dir' parameter that is passed directly to a shell command, allowing unauthenticated or authenticated attackers to execute arbitrary OS commands on the hosting server. A public proof-of-concept exists, making active exploitation likely.
vendor: composer product: pheditor/pheditor cwe: CWE-78 disclosed: Jun 9, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-11645 KEV
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CVE-2026-11645)
Detects exploitation attempts targeting CVE-2026-11645, an out-of-bounds read and write vulnerability in Google Chromium's V8 JavaScript engine. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation can lead to arbitrary code execution in the context of the browser process, enabling sandbox escape, credential theft, and further compromise.
vendor: Google product: Chromium V8 cwe: CWE-787, CWE-125 disclosed: Jun 9, 20268.8 highwrite-up soon - CVE-2026-20245 KEV
Cisco Catalyst SD-WAN Manager Improper Output Encoding Exploitation
Detects exploitation attempts targeting CVE-2026-20245, an improper encoding or escaping of output vulnerability (CWE-116) in Cisco Catalyst SD-WAN Manager. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to perform privilege escalation or inject malicious content through improperly encoded output. Detection focuses on anomalous authentication patterns, unexpected privilege changes, API abuse, and suspicious management plane activity against SD-WAN Manager instances.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-116 disclosed: Jun 9, 20267.8 highwrite-up soon - CVE-2026-7473 KEV
Arista EOS Incomplete Comparison Authentication Bypass (CVE-2026-7473)
Detects exploitation attempts targeting CVE-2026-7473, an incomplete comparison vulnerability (CWE-1023) in Arista Extensible Operating System (EOS). This flaw allows attackers to bypass authentication or authorization checks due to missing comparison factors, potentially enabling unauthorized access to network device management interfaces. The vulnerability is actively exploited in the wild (CISA KEV). Detection focuses on anomalous management-plane access patterns, unexpected SSH/API sessions, and configuration changes on Arista EOS devices.
vendor: Arista product: Extensible Operating System cwe: CWE-1023 disclosed: Jun 9, 20265.8 mediumwrite-up soon - CVE-2026-47724 Public PoC PoC
nebula-mesh API Ownership Check Bypass — Cross-Operator Privilege Escalation
CVE-2026-47724 is a missing authorization vulnerability (CWE-862) in github.com/juev/nebula-mesh versions prior to 0.3.4. API endpoints fail to validate resource ownership before processing requests, allowing an authenticated operator to access, modify, or delete mesh network resources belonging to other operators. With a CVSS score of 9.9 and a public proof-of-concept, exploitation enables full cross-tenant privilege escalation within a nebula-mesh deployment. Organizations running nebula-mesh as a multi-tenant overlay network orchestrator are at critical risk.
vendor: go product: github.com/juev/nebula-mesh cwe: CWE-862 disclosed: Jun 8, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-50751 KEV
Check Point Security Gateway Improper Authentication (CVE-2026-50751)
Detects exploitation of CVE-2026-50751, an improper authentication vulnerability (CWE-287) in Check Point Security Gateway affecting deprecated IKEv1 VPN protocol. This vulnerability is actively exploited in the wild (CISA KEV) and may allow unauthenticated attackers to bypass authentication controls on the VPN gateway. Detection focuses on anomalous IKEv1 negotiation patterns, authentication bypass indicators, and suspicious gateway access following failed or malformed IKE exchanges.
vendor: Check Point product: Security Gateway cwe: CWE-287 disclosed: Jun 8, 20269.3 criticalwrite-up soon - CVE-2026-42271 KEV
BerriAI LiteLLM Command Injection (CVE-2026-42271)
Detects exploitation of CVE-2026-42271, a command injection vulnerability in BerriAI LiteLLM. An attacker who can reach the LiteLLM API or admin interface may inject OS commands that execute under the LiteLLM process context, leading to remote code execution. The vulnerability is tracked under CWE-78 (OS Command Injection) and CWE-77 (Command Injection) and is listed as actively exploited in CISA KEV.
vendor: BerriAI product: LiteLLM cwe: CWE-78, CWE-77 disclosed: Jun 8, 20268.8 highwrite-up soon - CVE-2026-47744 Public PoC PoC
Shopper Framework Authorization Bypass and RBAC Privilege Escalation in Team Settings
CVE-2026-47744 is a critical authorization bypass and RBAC privilege escalation vulnerability in the Shopper e-commerce framework (composer package shopper/framework) affecting versions prior to 2.8.0. An authenticated low-privileged user can bypass role-based access controls in team settings to escalate privileges or perform unauthorized administrative actions. A public proof-of-concept exists, making active exploitation likely. CVSS score 9.9.
vendor: composer product: shopper/framework cwe: CWE-269, CWE-285 disclosed: Jun 5, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-47668 Public PoC PoC
CVE-2026-47668: DbGate Unauthenticated RCE via JSON Script Runner
Detects exploitation of CVE-2026-47668, a critical unauthenticated remote code execution vulnerability in dbgate-serve <= 7.1.8. The JSON Script Runner endpoint accepts and executes arbitrary JavaScript/JSON payloads without authentication, allowing attackers to achieve full server compromise. A public PoC is available.
vendor: npm product: dbgate-serve cwe: CWE-20, CWE-94 disclosed: Jun 5, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-28318 KEV
SolarWinds Serv-U Uncontrolled Resource Consumption (CVE-2026-28318)
Detects exploitation of CVE-2026-28318, an uncontrolled resource consumption vulnerability (CWE-400) in SolarWinds Serv-U. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to exhaust server resources, leading to denial of service conditions. Detection focuses on abnormal connection patterns, resource exhaustion indicators, and anomalous request volumes targeting Serv-U services.
vendor: SolarWinds product: Serv-U cwe: CWE-400 disclosed: Jun 5, 20267.5 highwrite-up soon - CVE-2026-44180 Public PoC PoC
CVE-2026-44180: Jupyter Enterprise Gateway ContainerProcessProxy._enforce_prohibited_ids Bypass
CVE-2026-44180 is a critical (CVSS 9.8) input validation bypass in Jupyter Enterprise Gateway versions >= 2.0.0rc1 and < 3.3.0. The ContainerProcessProxy._enforce_prohibited_ids method fails to properly validate or enforce restrictions on kernel IDs, allowing an attacker to bypass container process isolation controls. This can enable unauthorized kernel spawning, container escape, or execution of arbitrary workloads within the enterprise gateway environment. A public proof-of-concept exists.
vendor: pip product: jupyter_enterprise_gateway cwe: CWE-20, CWE-180 disclosed: Jun 3, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-45247 KEV
Mirasvit Full Page Cache Warmer Deserialization RCE (CVE-2026-45247)
Detects exploitation of CVE-2026-45247, a deserialization of untrusted data vulnerability in the Mirasvit Full Page Cache Warmer Magento extension. Successful exploitation allows remote attackers to execute arbitrary code by sending crafted serialized PHP objects to vulnerable endpoints. This CVE is listed in CISA KEV, indicating active exploitation in the wild.
vendor: Mirasvit product: Mirasvit Full Page Cache Warmer cwe: CWE-502 disclosed: Jun 3, 20269.8 criticalwrite-up soon - CVE-2022-0492 KEV
Linux Kernel cgroup v1 release_agent Privilege Escalation (CVE-2022-0492)
CVE-2022-0492 is a Linux kernel vulnerability (CWE-287/CWE-862) in the cgroup v1 release_agent mechanism. A local unprivileged user can exploit improper capability checks to write to /sys/fs/cgroup/*/release_agent and execute arbitrary commands as root, enabling container escape and full host compromise. This vulnerability is listed on CISA KEV, indicating active exploitation in the wild.
vendor: Linux product: Kernel cwe: CWE-287, CWE-862 disclosed: Jun 2, 20267.8 highwrite-up soon - CVE-2026-47413 Public PoC PoC
CVE-2026-47413: PraisonAI Platform Unauthorized Workspace Owner Privilege Escalation
Detects exploitation of CVE-2026-47413, a critical privilege escalation vulnerability in praisonai-platform < 0.1.4 where any authenticated workspace member can promote arbitrary users to owner role via POST /workspaces/{id}/members without authorization checks. CVSS 9.6. PoC is publicly available.
vendor: pip product: praisonai-platform cwe: CWE-269, CWE-862 disclosed: Jun 1, 20269.6 criticalVector not yet publishedwrite-up soon - CVE-2026-47428 Public PoC PoC
CVE-2026-47428: Vitest Browser Mode XSS via Unsanitized otelCarrier Query Parameter
CVE-2026-47428 is a reflected Cross-Site Scripting (XSS) vulnerability in @vitest/browser versions >= 4.0.17 < 4.1.6 and >= 5.0.0-beta.0 < 5.0.0-beta.3. The browser mode development server serves the otelCarrier query parameter as unsanitized inline script content in esm-client-injector.js and serverOrchestrator.ts, allowing an attacker to inject arbitrary JavaScript into the test runner's browser context. With a CVSS of 9.6 and public PoC available, this poses a critical risk to CI/CD pipelines and developer workstations running Vitest browser mode tests, potentially enabling credential theft, session hijacking, or supply chain compromise.
vendor: npm product: @vitest/browser cwe: CWE-79 disclosed: Jun 1, 20269.6 criticalVector not yet publishedwrite-up soon - CVE-2026-47429 Public PoC PoC
CVE-2026-47429: Vitest UI Server Arbitrary File Read and Execution
CVE-2026-47429 is a critical missing authorization vulnerability (CWE-862, CVSS 9.8) in the Vitest UI server. When the Vitest UI server is listening, unauthenticated remote attackers can read arbitrary files from the filesystem and execute arbitrary code. Affected versions include Vitest < 3.2.6 and >= 4.0.0, < 4.1.0. A public proof-of-concept exists. Exploitation typically involves sending crafted WebSocket or HTTP requests to the Vitest UI server's RPC endpoint to traverse the filesystem or trigger code execution via the browser plugin's file system command handlers.
vendor: npm product: vitest cwe: CWE-862 disclosed: Jun 1, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2024-21182 KEV
Oracle WebLogic Server CVE-2024-21182 Exploitation Attempt
Detects exploitation attempts targeting CVE-2024-21182, an unspecified vulnerability in Oracle WebLogic Server. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Oracle WebLogic Server is a high-value target for threat actors due to its prevalence in enterprise Java EE environments. Exploitation may enable remote code execution, unauthorized data access, or server compromise.
vendor: Oracle product: WebLogic Server disclosed: Jun 1, 20267.5 highwrite-up soon - CVE-2026-47410 Public PoC PoC
PraisonAI Platform JWT Hardcoded Secret Key Token Forgery
Detects exploitation of CVE-2026-47410, a critical vulnerability in praisonai-platform (<= 0.1.2) where the JWT signing key defaults to the hardcoded value 'dev-secret-change-me' when PLATFORM_ENV is unset. An unauthenticated attacker can forge valid JWTs for any user, including administrators, enabling full platform compromise.
vendor: pip product: praisonai-platform cwe: CWE-321, CWE-798 disclosed: May 29, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-47391 Public PoC PoC
CVE-2026-47391: PraisonAI Unauthenticated A2A LLM eval() Remote Code Execution
CVE-2026-47391 is a critical unauthenticated remote code execution vulnerability in PraisonAI versions <= 4.6.39. The official Agent-to-Agent (A2A) example exposes an endpoint that accepts arbitrary input, passes it through an LLM-driven pipeline, and executes the result via Python's eval() without authentication or input sanitization. An attacker can craft a malicious payload that causes the LLM to emit code executed directly by the server process, achieving full RCE with the privileges of the PraisonAI service.
vendor: pip product: PraisonAI cwe: CWE-95, CWE-306 disclosed: May 29, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-47392 Public PoC PoC
PraisonAI Sandbox Escape via print.__self__ Builtins Leak in execute_code
Detects exploitation of CVE-2026-47392, a critical sandbox escape vulnerability in PraisonAI (praisonaiagents <= 1.6.39, PraisonAI <= 4.6.39). The flaw allows attackers to leak the Python builtins module through `print.__self__` within the `execute_code` subprocess mode, bypassing sandbox restrictions and achieving arbitrary code execution on the host. A public proof-of-concept is available.
vendor: pip product: praisonaiagents, PraisonAI cwe: CWE-184, CWE-693 disclosed: May 29, 20269.9 criticalVector not yet publishedwrite-up soon - CVE-2026-47393 Public PoC PoC
PraisonAI Flask API Server Deployed Without Authentication (CVE-2026-47393)
PraisonAI versions <= 4.6.39, when deployed via `deploy --type api`, expose a Flask HTTP server with authentication disabled by default (CWE-306, CWE-1188). Any unauthenticated actor with network access can invoke the AI agent API, exfiltrate model outputs, or use the endpoint as a proxy for downstream attacks. CVSS 9.8 critical; public PoC available.
vendor: pip product: PraisonAI cwe: CWE-306, CWE-1188 disclosed: May 29, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-47396 Public PoC PoC
PraisonAI Call Server Unauthenticated Agent Access (CVE-2026-47396)
Detects exploitation of CVE-2026-47396, a critical authentication bypass in PraisonAI's call server component. When the CALL_SERVER_TOKEN environment variable is unset, the server exposes unauthenticated endpoints for listing, invoking, and deleting AI agents. An attacker can enumerate available agents, invoke arbitrary agent workflows, or destroy agent configurations without any credentials. CVSS 9.8 (Critical), CWE-284/CWE-306.
vendor: pip product: PraisonAI cwe: CWE-284, CWE-306 disclosed: May 29, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-47140 Public PoC PoC
CVE-2026-47140 — vm2 Builtin Denylist Bypass via process/inspector Leads to Host RCE
Detects exploitation of CVE-2026-47140, a critical sandbox escape in the npm vm2 package (versions <= 3.11.3). Attackers bypass the builtin module denylist using process and inspector/promises references to execute arbitrary code on the host Node.js process. CVSS 10.0. PoC is publicly available.
vendor: npm product: vm2 cwe: CWE-693 disclosed: May 29, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-47210 Public PoC PoC
vm2 Sandbox Escape via JSPI-backed Promise .finally() Species Bypass
Detects exploitation of CVE-2026-47210, a critical sandbox escape vulnerability in the npm vm2 library (versions <= 3.11.3). The vulnerability abuses the JavaScript Promise Integration (JSPI) mechanism and the Promise species pattern in .finally() to escape the vm2 sandbox and execute arbitrary code on the host. A public PoC exists and exploitation grants full host access with the privileges of the Node.js process.
vendor: npm product: vm2 cwe: CWE-913 disclosed: May 29, 20269.8 criticalVector not yet publishedwrite-up soon - CVE-2026-47137 Public PoC PoC
CVE-2026-47137 — vm2 Sandbox Escape via nesting:true Bypass (RCE)
Detects exploitation of CVE-2026-47137, a critical sandbox escape vulnerability in the vm2 Node.js library (<=3.11.3). This bypass circumvents the CVE-2023-37903 patch by abusing the nesting:true configuration option without an explicit require, enabling full remote code execution from within a sandboxed context. CVSS 10.0. A patch is available in vm2 >= 3.11.4.
vendor: npm product: vm2 cwe: CWE-913 disclosed: May 29, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-47208 Public PoC PoC
CVE-2026-47208: vm2 Sandbox Breakout via Promise Species
Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.
vendor: npm product: vm2 cwe: CWE-913 disclosed: May 29, 202610.0 criticalVector not yet publishedwrite-up soon - CVE-2026-0257 KEV
Palo Alto Networks PAN-OS Authentication Bypass (CVE-2026-0257)
Detects exploitation attempts of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS caused by improper reliance on cookies for security decisions (CWE-565). An attacker can manipulate session cookies to bypass authentication controls on PAN-OS management interfaces or VPN endpoints. This vulnerability is confirmed exploited in the wild (CISA KEV).
vendor: Palo Alto Networks product: PAN-OS cwe: CWE-565 disclosed: May 29, 20269.1 criticalwrite-up soon - CVE-2026-0770 KEV PoC
Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829)
Detects exploitation of CVE-2026-0770, an Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow that allows unauthenticated or low-privileged actors to trigger execution of code, components, or custom nodes sourced from an untrusted control sphere. This flaw is listed in CISA KEV with a public exploit-db PoC and is actively exploited. Exploitation typically manifests as unexpected outbound connections from the Langflow host to fetch remote component definitions, followed by anomalous child process spawns from the Langflow server process, or webhook/API calls to Langflow's flow-execution and custom component endpoints from untrusted sources.
vendor: Langflow product: Langflow cwe: CWE-829 disclosed: May 29, 2026unscoredCVSS: Not yet ratedwrite-up soon - CVE-2026-48027 KEV
Nx Console Embedded Malicious Code Execution (CVE-2026-48027)
CVE-2026-48027 describes an embedded malicious code vulnerability (CWE-506) in Nx Console, a popular VS Code and JetBrains IDE extension for managing Nx monorepos. A compromised or trojanized version of Nx Console contains backdoored code that executes at extension load time within the developer IDE process, enabling attacker-controlled behavior including credential harvesting, reverse shells, or supply chain lateral movement into CI/CD pipelines. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Detection focuses on anomalous process spawning from IDE extension host processes, unexpected network connections originating from VS Code or JetBrains runtimes, and suspicious file writes consistent with embedded malicious payloads.
vendor: Nx product: Nx Console cwe: CWE-506 disclosed: May 27, 20269.8 criticalwrite-up soon - CVE-2026-8398 KEV
Daemon Tools Lite Embedded Malicious Code (CVE-2026-8398)
CVE-2026-8398 is a supply chain compromise affecting Daemon Tools Lite, where threat actors embedded malicious code (CWE-506) within the software distribution. Installations of the trojanized version may result in backdoor access, credential theft, or lateral movement from hosts running the compromised software. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Daemon product: Daemon Tools Lite cwe: CWE-506 disclosed: May 27, 20269.8 criticalwrite-up soon - CVE-2026-45321 KEV
TanStack Router Unspecified Vulnerability Exploitation
Detects potential exploitation of CVE-2026-45321, an unspecified vulnerability in TanStack Router that has been added to the CISA Known Exploited Vulnerabilities catalog. TanStack Router is a type-safe routing library for React applications. Given KEV status, active exploitation in the wild is confirmed. Detection focuses on anomalous web application behavior, suspicious client-side routing patterns, unexpected server-side request patterns, and post-exploitation indicators consistent with JavaScript framework exploitation.
vendor: TanStack product: TanStack disclosed: May 27, 20269.6 criticalwrite-up soon - CVE-2026-48172 KEV
LiteSpeed cPanel Plugin Privilege Escalation (CVE-2026-48172)
Detects exploitation of CVE-2026-48172, a privilege escalation vulnerability in the LiteSpeed cPanel Plugin (CWE-266: Incorrect Privilege Assignment). Attackers with low-privileged cPanel access can leverage the plugin's improper privilege handling to elevate to root or administrative system access. This vulnerability is actively exploited in the wild (CISA KEV).
vendor: LiteSpeed product: cPanel Plugin cwe: CWE-266 disclosed: May 26, 20269.8 criticalwrite-up soon - CVE-2026-9082 KEV
Drupal Core SQL Injection Exploitation (CVE-2026-9082)
Detects exploitation attempts targeting CVE-2026-9082, a SQL injection vulnerability in Drupal Core. This KEV-listed vulnerability allows attackers to inject malicious SQL via crafted HTTP requests, potentially leading to unauthorized data access, credential theft, or remote code execution via stacked queries. Active exploitation has been observed in the wild.
vendor: Drupal product: Core cwe: CWE-89 disclosed: May 22, 20269.8 criticalwrite-up soon - CVE-2025-34291 KEV
CVE-2025-34291: Langflow Origin Validation Error Exploitation
Detects exploitation of CVE-2025-34291, an origin validation error (CWE-346) in Langflow that allows attackers to bypass origin checks. This vulnerability is actively exploited in the wild (CISA KEV) and may enable unauthorized access to Langflow API endpoints, flow execution, or administrative functions by bypassing cross-origin restrictions.
vendor: Langflow product: Langflow cwe: CWE-346 disclosed: May 21, 20268.8 highwrite-up soon - CVE-2026-34926 KEV
Trend Micro Apex One Directory Traversal Exploitation (CVE-2026-34926)
Detects exploitation attempts targeting CVE-2026-34926, a directory traversal vulnerability (CWE-23) in Trend Micro Apex One (On-Premise). This KEV-listed vulnerability allows unauthenticated or low-privileged attackers to traverse directory boundaries via crafted HTTP requests to the Apex One management server, potentially enabling arbitrary file read or write operations. Active exploitation has been observed in the wild.
vendor: Trend Micro product: Apex One cwe: CWE-23 disclosed: May 21, 20266.7 mediumwrite-up soon - CVE-2008-4250 KEV
MS08-067 NetAPI Buffer Overflow Exploitation Attempt (CVE-2008-4250)
CVE-2008-4250 is a critical buffer overflow vulnerability in the Windows Server service (netapi32.dll) affecting Microsoft Windows XP, 2000, 2003, Vista, and Server 2008. Exploitation via a specially crafted RPC request to the NetpwPathCanonicalize function allows unauthenticated remote code execution as SYSTEM. This vulnerability was exploited by the Conficker worm and remains listed in CISA's Known Exploited Vulnerabilities catalog. Detection focuses on suspicious SMB/RPC activity, NetAPI service anomalies, and post-exploitation indicators including lateral movement and payload staging.
vendor: Microsoft product: Windows cwe: CWE-94 disclosed: May 20, 20269.8 criticalwrite-up soon - CVE-2009-1537 KEV
Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537)
CVE-2009-1537 is a NULL byte overwrite vulnerability in Microsoft DirectX (quartz.dll) that can be exploited via a maliciously crafted QuickTime media file. Successful exploitation allows remote code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Addressed in MS09-028.
vendor: Microsoft product: DirectX disclosed: May 20, 20268.8 highwrite-up soon - CVE-2009-3459 KEV
Adobe Acrobat and Reader Heap-Based Buffer Overflow (CVE-2009-3459)
Detects exploitation of a heap-based buffer overflow vulnerability in Adobe Acrobat and Reader (CVE-2009-3459). This CISA KEV vulnerability allows attackers to execute arbitrary code via a crafted PDF file. Exploitation typically results in AcroRd32.exe or Acrobat.exe spawning unexpected child processes, making unusual network connections, or writing executable payloads to disk.
vendor: Adobe product: Acrobat and Reader cwe: CWE-119 disclosed: May 20, 20268.8 highwrite-up soon - CVE-2010-0249 KEV
Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2010-0249)
CVE-2010-0249 is a use-after-free vulnerability (CWE-416) in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code via a specially crafted web page. This vulnerability was actively exploited in the wild (Operation Aurora) and is listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation typically involves a malicious HTML/JavaScript page that triggers memory corruption through manipulated DOM objects, enabling arbitrary code execution in the context of the logged-on user.
vendor: Microsoft product: Internet Explorer cwe: CWE-416 disclosed: May 20, 20268.8 highwrite-up soon - CVE-2010-0806 KEV
CVE-2010-0806 Microsoft Internet Explorer Use-After-Free Exploitation
Detects exploitation of CVE-2010-0806, a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability allows remote attackers to execute arbitrary code via a crafted web page. It is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in the wild.
vendor: Microsoft product: Internet Explorer cwe: CWE-399 disclosed: May 20, 20268.8 highwrite-up soon - CVE-2026-41091 KEV
Microsoft Defender Link Following Privilege Escalation (CVE-2026-41091)
Detects exploitation of CVE-2026-41091, a link-following vulnerability (CWE-59) in Microsoft Defender that allows attackers to follow symbolic links or junction points to access or overwrite privileged files. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to privilege escalation or arbitrary file manipulation in the context of the Defender service.
vendor: Microsoft product: Defender cwe: CWE-59 disclosed: May 20, 20267.8 highwrite-up soon - CVE-2026-45498 KEV
Microsoft Defender Denial of Service Vulnerability (CVE-2026-45498)
CVE-2026-45498 is a Denial of Service vulnerability in Microsoft Defender. Exploitation can cause Defender to crash, hang, or become unresponsive, effectively disabling endpoint protection on affected hosts. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may leverage this to disable security tooling prior to follow-on intrusion activity.
vendor: Microsoft product: Defender disclosed: May 20, 20267.5 highwrite-up soon - CVE-2026-42897 KEV
Microsoft Exchange Server Cross-Site Scripting (XSS) Exploitation
Detects exploitation attempts targeting CVE-2026-42897, a Cross-Site Scripting (XSS) vulnerability in Microsoft Exchange Server. This KEV-listed vulnerability allows attackers to inject malicious scripts into Exchange web interfaces, potentially leading to session hijacking, credential theft, or further lateral movement within the environment. Detection focuses on anomalous HTTP requests to Exchange OWA/ECP endpoints containing XSS payloads, unexpected script execution from Exchange processes, and suspicious web request patterns indicative of active exploitation.
vendor: Microsoft product: Microsoft cwe: CWE-79 disclosed: May 15, 20266.1 mediumwrite-up soon - CVE-2026-20182 KEV
Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182)
Detects exploitation attempts of CVE-2026-20182, an authentication bypass vulnerability (CWE-287) in the Cisco Catalyst SD-WAN Controller. This KEV-listed vulnerability allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access to the SD-WAN management plane. Successful exploitation can lead to full network fabric compromise, configuration tampering, and lateral movement across SD-WAN-connected sites.
vendor: Cisco product: Catalyst SD-WAN cwe: CWE-287 disclosed: May 14, 202610.0 criticalwrite-up soon - CVE-2026-42208 KEV
BerriAI LiteLLM SQL Injection Exploitation (CVE-2026-42208)
Detects exploitation attempts targeting a SQL injection vulnerability in BerriAI LiteLLM (CVE-2026-42208, CWE-89). LiteLLM is a widely deployed LLM proxy/gateway; successful exploitation allows unauthenticated or authenticated attackers to manipulate backend database queries, potentially exfiltrating API keys, user data, model configurations, and spend tracking records. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: BerriAI product: LiteLLM cwe: CWE-89 disclosed: May 8, 20269.8 criticalwrite-up soon - CVE-2026-6973 KEV
CVE-2026-6973: Ivanti EPMM Improper Input Validation Exploitation
Detects exploitation attempts targeting CVE-2026-6973, an improper input validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM). This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to bypass authentication or execute unauthorized actions against the EPMM management interface.
vendor: Ivanti product: Endpoint Manager Mobile (EPMM) cwe: CWE-20 disclosed: May 7, 20267.2 highwrite-up soon - CVE-2026-0300 KEV
Palo Alto Networks PAN-OS Out-of-bounds Write (CVE-2026-0300)
Detects exploitation attempts targeting CVE-2026-0300, an out-of-bounds write vulnerability (CWE-787) in Palo Alto Networks PAN-OS. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to execute arbitrary code, crash the device, or escalate privileges on affected PAN-OS appliances. Detection focuses on anomalous management plane activity, unexpected process crashes, memory corruption indicators, and suspicious inbound traffic patterns targeting PAN-OS management interfaces.
vendor: Palo Alto Networks product: PAN-OS cwe: CWE-787 disclosed: May 6, 20269.8 criticalwrite-up soon - CVE-2026-31431 KEV
Linux Kernel Incorrect Resource Transfer Between Spheres (CVE-2026-31431)
CVE-2026-31431 is a Linux Kernel vulnerability classified as CWE-669 (Incorrect Resource Transfer Between Spheres). The flaw allows improper transfer of resources across security boundaries within the kernel, potentially enabling privilege escalation or unauthorized memory access. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers with local access may exploit this to escalate privileges to root or escape container boundaries.
vendor: Linux product: Kernel cwe: CWE-669 disclosed: May 1, 20267.8 highwrite-up soon - CVE-2026-41940 KEV
CVE-2026-41940: WebPros cPanel & WHM / WP2 Missing Authentication for Critical Function
CVE-2026-41940 is an actively exploited missing authentication vulnerability (CWE-306) in WebPros cPanel & WHM and WP2 (WordPress Squared). Unauthenticated remote attackers can invoke critical administrative functions without valid credentials, enabling account takeover, malicious plugin installation, privilege escalation, and full server compromise. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: WebPros product: cPanel & WHM and WP2 (WordPress Squared) cwe: CWE-306 disclosed: Apr 30, 20269.8 criticalwrite-up soon - CVE-2024-1708 KEV
ConnectWise ScreenConnect Path Traversal (CVE-2024-1708)
Detects exploitation of CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8. Attackers can traverse outside the intended directory to read, write, or execute arbitrary files on the host. This vulnerability is actively exploited in the wild and listed on CISA KEV. It is commonly chained with CVE-2024-1709 (authentication bypass) to achieve unauthenticated remote code execution.
vendor: ConnectWise product: ScreenConnect cwe: CWE-22 disclosed: Apr 28, 20268.4 highwrite-up soon - CVE-2026-32202 KEV
CVE-2026-32202 Microsoft Windows Protection Mechanism Failure
Detects exploitation of CVE-2026-32202, a Microsoft Windows Protection Mechanism Failure vulnerability (CWE-693) listed in CISA KEV. This vulnerability allows attackers to bypass security controls in Windows, potentially enabling privilege escalation, defense evasion, or code execution. Detection focuses on anomalous process behavior, security feature bypass indicators, and suspicious Windows API usage patterns consistent with protection mechanism circumvention.
vendor: Microsoft product: Windows cwe: CWE-693 disclosed: Apr 28, 20264.3 mediumwrite-up soon - CVE-2024-57726 KEV
SimpleHelp Missing Authorization Vulnerability (CVE-2024-57726)
CVE-2024-57726 is a missing authorization vulnerability (CWE-862) in SimpleHelp remote support software versions 5.5.7 and earlier. This CISA KEV-listed vulnerability allows unauthenticated or low-privileged attackers to bypass authorization controls, potentially enabling unauthorized access to administrative functions, file system traversal, or remote code execution on systems running the SimpleHelp server. Active exploitation has been observed in the wild.
vendor: SimpleHelp product: SimpleHelp cwe: CWE-862 disclosed: Apr 24, 20269.9 criticalwrite-up soon - CVE-2024-7399 KEV
Samsung MagicINFO 9 Server Path Traversal and Arbitrary File Upload
Detects exploitation of CVE-2024-7399, a path traversal and unrestricted file upload vulnerability in Samsung MagicINFO 9 Server. Successful exploitation allows unauthenticated or low-privileged attackers to upload arbitrary files outside the intended directory, potentially leading to remote code execution. This CVE is actively exploited in the wild (CISA KEV).
vendor: Samsung product: MagicINFO 9 Server cwe: CWE-22, CWE-434 disclosed: Apr 24, 20269.8 criticalwrite-up soon - CVE-2024-57728 KEV
SimpleHelp Path Traversal Vulnerability (CVE-2024-57728)
Detects exploitation of CVE-2024-57728, a path traversal vulnerability (CWE-22) in SimpleHelp remote support software versions 5.5.7 and earlier. Attackers can traverse directory boundaries to read arbitrary files from the server, potentially exposing credentials, configuration files, and sensitive system data. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: SimpleHelp product: SimpleHelp cwe: CWE-22 disclosed: Apr 24, 20267.2 highwrite-up soon - CVE-2026-39987 KEV
Marimo Remote Code Execution via Missing Authentication (CVE-2026-39987)
CVE-2026-39987 is a critical remote code execution vulnerability in the Marimo reactive notebook framework caused by missing authentication (CWE-306) for critical server-side functions. An unauthenticated remote attacker can invoke kernel execution endpoints to run arbitrary Python code in the context of the Marimo server process. This vulnerability is actively exploited in the wild and listed on the CISA KEV catalog.
vendor: Marimo product: Marimo cwe: CWE-306 disclosed: Apr 23, 20269.8 criticalwrite-up soon - CVE-2026-33825 KEV
CVE-2026-33825 - Microsoft Defender Insufficient Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-33825, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Defender. This KEV-listed vulnerability allows attackers to bypass Defender access controls, potentially disabling protections, modifying exclusions, or tampering with security configurations without appropriate privilege levels.
vendor: Microsoft product: Defender cwe: CWE-1220 disclosed: Apr 22, 20267.8 highwrite-up soon - CVE-2025-32975 KEV
Quest KACE SMA Improper Authentication Exploitation Detected
Detects exploitation attempts against CVE-2025-32975, an improper authentication vulnerability (CWE-287) in Quest KACE Systems Management Appliance (SMA). This KEV-listed vulnerability allows attackers to bypass authentication controls, potentially enabling unauthorized access to the SMA management interface and downstream managed endpoints. Successful exploitation could lead to full appliance compromise and lateral movement across managed systems.
vendor: Quest product: KACE Systems Management Appliance (SMA) cwe: CWE-287 disclosed: Apr 20, 202610.0 criticalwrite-up soon - CVE-2023-27351 KEV
CVE-2023-27351 - PaperCut NG/MF Improper Authentication Exploitation
Detects exploitation attempts targeting CVE-2023-27351, an improper authentication vulnerability (CWE-287) in PaperCut NG/MF print management software. This CISA KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls, potentially enabling unauthorized access to the PaperCut administration interface and sensitive print management data. Threat actors have actively exploited PaperCut vulnerabilities in the wild for initial access and lateral movement.
vendor: PaperCut product: NG/MF cwe: CWE-287 disclosed: Apr 20, 20267.5 highwrite-up soon - CVE-2026-20128 KEV
Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format (CVE-2026-20128)
CVE-2026-20128 affects Cisco Catalyst SD-WAN Manager and involves storing passwords in a recoverable format (CWE-257). An attacker with local or network access to the SD-WAN Manager may be able to extract plaintext or weakly-obfuscated credentials from configuration files, databases, or memory. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation could lead to credential theft enabling lateral movement, further network compromise, or full SD-WAN infrastructure takeover.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-257 disclosed: Apr 20, 20267.5 highwrite-up soon - CVE-2026-20133 KEV
Cisco Catalyst SD-WAN Manager Sensitive Information Exposure (CVE-2026-20133)
Detects exploitation attempts targeting CVE-2026-20133, a CWE-200 information disclosure vulnerability in Cisco Catalyst SD-WAN Manager that allows unauthorized actors to access sensitive configuration and credential data. This vulnerability is actively exploited in the wild (CISA KEV) and may be leveraged to pivot into SD-WAN infrastructure.
vendor: Cisco product: Catalyst SD-WAN Manager cwe: CWE-200 disclosed: Apr 20, 20267.5 highwrite-up soon - CVE-2024-27199 KEV
JetBrains TeamCity Relative Path Traversal (CVE-2024-27199)
Detects exploitation of CVE-2024-27199, a relative path traversal vulnerability in JetBrains TeamCity on-premises. Unauthenticated attackers can traverse directory paths in the TeamCity web server to access restricted endpoints and files outside the intended web root, potentially leading to information disclosure or authentication bypass chained with CVE-2024-27198.
vendor: JetBrains product: TeamCity cwe: CWE-23 disclosed: Apr 20, 20267.3 highwrite-up soon - CVE-2025-2749 KEV
Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749)
Detects exploitation of CVE-2025-2749, a path traversal and unrestricted file upload vulnerability in Kentico Xperience CMS. Attackers can traverse directory boundaries to write arbitrary files — including web shells — to locations outside the intended upload path, enabling remote code execution on the hosting server. This CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: Kentico product: Kentico Xperience cwe: CWE-22, CWE-434 disclosed: Apr 20, 20267.2 highwrite-up soon - CVE-2025-48700 KEV
Zimbra Collaboration Suite XSS Exploitation (CVE-2025-48700)
Detects exploitation of a stored or reflected cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). This KEV-listed vulnerability allows attackers to inject malicious scripts into the Zimbra web client, potentially leading to session hijacking, credential theft, or further lateral movement within the organization. XSS in webmail platforms is frequently exploited by threat actors to steal session tokens and pivot to email account compromise.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-79 disclosed: Apr 20, 20266.1 mediumwrite-up soon - CVE-2026-20122 KEV
Cisco Catalyst SD-WAN Manager Privileged API Abuse (CVE-2026-20122)
Detects exploitation of CVE-2026-20122, a critical vulnerability in Cisco Catalyst SD-WAN Manager involving incorrect use of privileged APIs (CWE-648). This KEV-listed flaw allows attackers to invoke privileged API endpoints without proper authorization, potentially enabling unauthorized configuration changes, credential harvesting, or full SD-WAN infrastructure takeover. Active exploitation has been observed in the wild per CISA Emergency Directive ED-26-03.
vendor: Cisco product: Catalyst SD-WAN Manger cwe: CWE-648 disclosed: Apr 20, 20265.4 mediumwrite-up soon - CVE-2026-34197 KEV
Apache ActiveMQ Improper Input Validation (CVE-2026-34197)
Detects exploitation of CVE-2026-34197, an improper input validation vulnerability (CWE-20/CWE-94) in Apache ActiveMQ that has been added to the CISA Known Exploited Vulnerabilities catalog. Successful exploitation may allow remote attackers to execute arbitrary code or inject malicious content via crafted messages or broker connections. ActiveMQ's OpenWire protocol and web console are common attack surfaces for this class of vulnerability.
vendor: Apache product: ActiveMQ cwe: CWE-20, CWE-94 disclosed: Apr 16, 20268.8 highwrite-up soon - CVE-2009-0238 KEV
Microsoft Office Remote Code Execution (CVE-2009-0238)
CVE-2009-0238 is a remote code execution vulnerability in Microsoft Office (addressed in MS09-009) caused by improper handling of specially crafted Excel files, leading to arbitrary code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and has been actively exploited in the wild via malicious Office documents delivered through phishing campaigns.
vendor: Microsoft product: Office cwe: CWE-94 disclosed: Apr 14, 20268.8 highwrite-up soon - CVE-2026-32201 KEV
Microsoft SharePoint Server Improper Input Validation (CVE-2026-32201)
Detects exploitation of CVE-2026-32201, an improper input validation vulnerability in Microsoft SharePoint Server. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to send crafted HTTP requests to SharePoint endpoints to bypass input validation controls, potentially enabling unauthorized access, remote code execution, or data exfiltration. CWE-20 class vulnerabilities in SharePoint have historically been leveraged for initial access and lateral movement in enterprise environments.
vendor: Microsoft product: SharePoint Server cwe: CWE-20 disclosed: Apr 14, 20266.5 mediumwrite-up soon - CVE-2026-21643 KEV
Fortinet FortiClient EMS SQL Injection Exploitation (CVE-2026-21643)
Detects exploitation attempts targeting a SQL injection vulnerability in Fortinet FortiClient EMS (CVE-2026-21643). This KEV-listed vulnerability allows unauthenticated or authenticated attackers to inject malicious SQL statements into FortiClient EMS, potentially enabling data exfiltration, authentication bypass, or remote code execution via database-level commands such as xp_cmdshell.
vendor: Fortinet product: FortiClient EMS cwe: CWE-89 disclosed: Apr 13, 20269.8 criticalwrite-up soon - CVE-2023-21529 KEV
Microsoft Exchange Server Deserialization of Untrusted Data (CVE-2023-21529)
Detects exploitation attempts targeting CVE-2023-21529, a deserialization of untrusted data vulnerability in Microsoft Exchange Server. Successful exploitation may allow remote code execution by sending crafted requests that trigger unsafe deserialization of attacker-controlled objects.
vendor: Microsoft product: Exchange Server cwe: CWE-502 disclosed: Apr 13, 20268.8 highwrite-up soon - CVE-2026-34621 KEV
Adobe Acrobat and Reader Prototype Pollution Vulnerability (CVE-2026-34621)
Detects exploitation of CVE-2026-34621, a prototype pollution vulnerability (CWE-1321) in Adobe Acrobat and Reader. This KEV-listed vulnerability allows attackers to manipulate JavaScript object prototypes within PDF processing, potentially leading to arbitrary code execution, privilege escalation, or sandbox escape. Exploitation typically occurs via malicious PDF documents that trigger prototype chain manipulation during rendering or form processing.
vendor: Adobe product: Acrobat and Reader cwe: CWE-1321 disclosed: Apr 13, 20268.6 highwrite-up soon - CVE-2012-1854 KEV
CVE-2012-1854 - Microsoft VBA Insecure Library Loading (DLL Hijacking)
Detects exploitation of CVE-2012-1854, a DLL hijacking vulnerability in Microsoft Visual Basic for Applications (VBA). Attackers can place a malicious DLL in a directory searched before the legitimate library path, causing Office applications loading VBA to execute attacker-controlled code. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: Visual Basic for Applications (VBA) cwe: CWE-426 disclosed: Apr 13, 20267.8 highwrite-up soon - CVE-2020-9715 KEV
Adobe Acrobat Use-After-Free Exploitation (CVE-2020-9715)
Detects exploitation of CVE-2020-9715, a use-after-free vulnerability in Adobe Acrobat that allows arbitrary code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in the wild. Attackers typically deliver malicious PDF documents that trigger memory corruption upon rendering, leading to code execution in the context of the Acrobat process.
vendor: Adobe product: Acrobat cwe: CWE-416 disclosed: Apr 13, 20267.8 highwrite-up soon - CVE-2023-36424 KEV
CVE-2023-36424 - Microsoft Windows Out-of-Bounds Read Exploitation
Detects exploitation attempts of CVE-2023-36424, a Microsoft Windows out-of-bounds read vulnerability (CWE-125) listed in CISA's Known Exploited Vulnerabilities catalog. Out-of-bounds read vulnerabilities in Windows kernel or system components can be leveraged for privilege escalation, information disclosure, or as a stepping stone in exploit chains. This detection monitors for anomalous process behavior, crash artifacts, and privilege escalation patterns consistent with exploitation of this class of vulnerability.
vendor: Microsoft product: Windows cwe: CWE-125 disclosed: Apr 13, 20267.8 highwrite-up soon - CVE-2025-60710 KEV
Microsoft Windows Link Following Vulnerability (CVE-2025-60710)
CVE-2025-60710 is an actively exploited Microsoft Windows link following vulnerability (CWE-59) that allows an attacker to abuse symbolic links or junction points to redirect file operations to unintended locations. This class of vulnerability is commonly leveraged for privilege escalation, file tampering, or unauthorized access to protected resources. The vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.
vendor: Microsoft product: Windows cwe: CWE-59 disclosed: Apr 13, 20267.8 highwrite-up soon - CVE-2026-1340 KEV
Ivanti EPMM Code Injection Exploitation (CVE-2026-1340)
Detects exploitation attempts targeting CVE-2026-1340, a code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows remote attackers to inject and execute arbitrary code via the EPMM management interface. Successful exploitation may lead to full device management compromise, lateral movement, and data exfiltration from enrolled mobile devices.
vendor: Ivanti product: Endpoint Manager Mobile (EPMM) cwe: CWE-94 disclosed: Apr 8, 20269.8 criticalwrite-up soon - CVE-2026-35616 KEV
CVE-2026-35616 — Fortinet FortiClient EMS Improper Access Control Exploitation
Detects exploitation attempts targeting CVE-2026-35616, an improper access control vulnerability (CWE-284) in Fortinet FortiClient Enterprise Management Server (EMS). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may leverage this flaw to bypass access controls on the EMS server, potentially enabling unauthorized configuration changes, endpoint agent manipulation, or lateral movement through managed endpoints.
vendor: Fortinet product: FortiClient EMS cwe: CWE-284 disclosed: Apr 6, 20269.8 criticalwrite-up soon - CVE-2026-3502 KEV
TrueConf Client Download of Code Without Integrity Check (CVE-2026-3502)
Detects exploitation of CVE-2026-3502, a CWE-494 (Download of Code Without Integrity Check) vulnerability in TrueConf Client. An attacker with a network position to intercept or manipulate TrueConf Client update/download channels can deliver unsigned or tampered code to client systems, enabling arbitrary code execution. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: TrueConf product: Client cwe: CWE-494 disclosed: Apr 2, 20267.8 highwrite-up soon - CVE-2026-5281 KEV
CVE-2026-5281 — Google Dawn Use-After-Free Exploitation
Detects exploitation of CVE-2026-5281, a use-after-free vulnerability in Google Dawn (the WebGPU implementation used by Chrome). Exploitation may result in renderer compromise, sandbox escape, or arbitrary code execution via a malicious web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Google product: Dawn cwe: CWE-416 disclosed: Apr 1, 20268.8 highwrite-up soon - CVE-2026-3055 KEV
Citrix NetScaler Out-of-Bounds Read (CVE-2026-3055)
Detects exploitation attempts targeting CVE-2026-3055, an out-of-bounds read vulnerability (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway. This vulnerability is actively exploited in the wild (CISA KEV) and may allow unauthenticated remote attackers to read sensitive memory contents, potentially leading to information disclosure or enabling further attacks. Detection focuses on anomalous HTTP request patterns, NetScaler management plane access, and memory-related crash indicators.
vendor: Citrix product: NetScaler cwe: CWE-125 disclosed: Mar 30, 20269.8 criticalwrite-up soon - CVE-2025-53521 KEV
F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521)
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
vendor: F5 product: BIG-IP cwe: CWE-121 disclosed: Mar 27, 20269.8 criticalwrite-up soon - CVE-2026-33634 KEV
Aquasecurity Trivy Embedded Malicious Code (CVE-2026-33634)
CVE-2026-33634 describes an embedded malicious code vulnerability (CWE-506) in Aquasecurity Trivy, a widely-used open-source vulnerability scanner. A compromised or trojanized Trivy binary may execute attacker-controlled code during container image scanning, CI/CD pipeline runs, or Kubernetes admission checks. Because Trivy is frequently granted elevated permissions to access container registries, Kubernetes API servers, and cloud credential chains, a backdoored instance poses critical supply-chain risk: exfiltration of secrets, lateral movement into CI/CD infrastructure, and persistent implant installation. This detection monitors for anomalous process behavior, unexpected network egress, and suspicious file activity originating from Trivy processes.
vendor: Aquasecurity product: Trivy cwe: CWE-506 disclosed: Mar 26, 20268.8 highwrite-up soon - CVE-2026-33017 KEV
CVE-2026-33017: Langflow Code Injection Vulnerability
Detects exploitation of CVE-2026-33017, a code injection vulnerability in Langflow that allows unauthenticated or low-privileged attackers to execute arbitrary code via the Langflow API. The vulnerability stems from improper input validation (CWE-94/CWE-95) combined with missing authentication controls (CWE-306), enabling remote code execution against Langflow instances. This CVE is on the CISA KEV list, indicating active exploitation in the wild.
vendor: Langflow product: Langflow cwe: CWE-94, CWE-95 disclosed: Mar 25, 20269.8 criticalwrite-up soon - CVE-2025-32432 KEV
CVE-2025-32432: Craft CMS Remote Code Injection
Detects exploitation of CVE-2025-32432, a critical code injection vulnerability (CWE-94) in Craft CMS that allows remote attackers to execute arbitrary code. This vulnerability is actively exploited in the wild (CISA KEV) and targets Craft CMS installations via malicious template or input injection vectors.
vendor: Craft CMS product: Craft CMS cwe: CWE-94 disclosed: Mar 20, 202610.0 criticalwrite-up soon - CVE-2025-54068 KEV
Laravel Livewire Code Injection (CVE-2025-54068)
Detects exploitation of CVE-2025-54068, a code injection vulnerability in Laravel Livewire. This KEV-listed vulnerability allows attackers to inject and execute arbitrary PHP code through Livewire component handling, potentially leading to remote code execution on affected Laravel applications.
vendor: Laravel product: Livewire cwe: CWE-94 disclosed: Mar 20, 20269.8 criticalwrite-up soon - CVE-2025-31277 KEV
Apple Multiple Products Buffer Overflow Exploitation (CVE-2025-31277)
Detects potential exploitation of CVE-2025-31277, a buffer overflow vulnerability (CWE-119) affecting multiple Apple products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation may allow attackers to execute arbitrary code, escalate privileges, or cause denial of service on affected Apple devices and systems.
vendor: Apple product: Multiple Products cwe: CWE-119 disclosed: Mar 20, 20268.8 highwrite-up soon - CVE-2025-43510 KEV
Apple Multiple Products Improper Locking Vulnerability (CVE-2025-43510)
CVE-2025-43510 is an improper locking vulnerability (CWE-667) affecting multiple Apple products, including macOS, iOS, iPadOS, tvOS, visionOS, and watchOS. This flaw, added to CISA's Known Exploited Vulnerabilities catalog, allows an attacker with local access to potentially exploit race conditions arising from improper mutex or lock management, leading to privilege escalation, memory corruption, or kernel-level code execution. Detection focuses on anomalous kernel panics, unexpected privilege escalations, exploitation of race conditions, and post-exploitation indicators on Apple endpoints.
vendor: Apple product: Multiple Products cwe: CWE-667 disclosed: Mar 20, 20267.8 highwrite-up soon - CVE-2025-43520 KEV
Apple Multiple Products Classic Buffer Overflow Exploitation (CVE-2025-43520)
Detects exploitation attempts targeting CVE-2025-43520, a classic buffer overflow vulnerability (CWE-120) affecting Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Buffer overflow exploitation may manifest as abnormal process crashes, memory corruption signals, unexpected child process spawning from Apple system processes, or anomalous network connections following process exploitation.
vendor: Apple product: Multiple Products cwe: CWE-120 disclosed: Mar 20, 20265.5 mediumwrite-up soon - CVE-2026-20131 KEV
Cisco FMC/SCC Deserialization RCE Exploitation (CVE-2026-20131)
Detects exploitation of CVE-2026-20131, a deserialization of untrusted data vulnerability in Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management. Successful exploitation allows unauthenticated or authenticated remote attackers to execute arbitrary commands on the underlying OS. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Cisco product: Secure Firewall Management Center (FMC) cwe: CWE-502 disclosed: Mar 19, 202610.0 criticalwrite-up soon - CVE-2026-20963 KEV
Microsoft SharePoint Deserialization of Untrusted Data (CVE-2026-20963)
Detects exploitation of CVE-2026-20963, a deserialization of untrusted data vulnerability in Microsoft SharePoint. Attackers can send crafted serialized payloads to SharePoint endpoints, leading to remote code execution in the context of the SharePoint application pool. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: Microsoft product: SharePoint cwe: CWE-502 disclosed: Mar 18, 20269.8 criticalwrite-up soon - CVE-2025-66376 KEV
Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploitation
Detects exploitation attempts targeting CVE-2025-66376, a cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite (ZCS). This KEV-listed vulnerability allows attackers to inject malicious scripts into the Zimbra web interface, potentially leading to session hijacking, credential theft, or further compromise of email infrastructure. Active exploitation has been confirmed by CISA.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-79 disclosed: Mar 18, 20266.1 mediumwrite-up soon - CVE-2025-47813 KEV
Wing FTP Server Information Disclosure via Error Messages (CVE-2025-47813)
Detects potential exploitation of CVE-2025-47813, an information disclosure vulnerability in Wing FTP Server (CWE-209) where detailed error messages expose sensitive server-side information. This vulnerability is actively exploited in the wild (CISA KEV). Attackers may probe the FTP server with malformed or unexpected requests to trigger verbose error responses revealing internal paths, software versions, configuration details, or stack traces.
vendor: Wing FTP Server product: Wing FTP Server cwe: CWE-209 disclosed: Mar 16, 20264.3 mediumwrite-up soon - CVE-2026-3909 KEV
Google Skia Out-of-Bounds Write (CVE-2026-3909)
Detects exploitation attempts targeting CVE-2026-3909, an out-of-bounds write vulnerability in Google Skia graphics library. Skia is embedded in Chrome and other Google products. Exploitation can lead to arbitrary code execution via crafted web content or malicious files. This vulnerability is confirmed exploited in the wild (CISA KEV).
vendor: Google product: Skia cwe: CWE-787 disclosed: Mar 13, 20268.8 highwrite-up soon - CVE-2026-3910 KEV
CVE-2026-3910: Google Chromium V8 Memory Buffer Bounds Violation
Detects exploitation attempts and post-exploitation indicators related to CVE-2026-3910, an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Google Chromium's V8 JavaScript engine. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve remote code execution via a malicious web page, potentially leading to sandbox escape and full system compromise.
vendor: Google product: Chromium V8 cwe: CWE-119 disclosed: Mar 13, 20268.8 highwrite-up soon - CVE-2025-68613 KEV
n8n Improper Control of Dynamically-Managed Code Resources (CVE-2025-68613)
Detects exploitation of CVE-2025-68613, a critical vulnerability in n8n workflow automation platform where improper control of dynamically-managed code resources (CWE-913) allows attackers to execute arbitrary code. This vulnerability is actively exploited in the wild (CISA KEV). Attackers can abuse n8n's Code node or expression evaluation engine to break out of intended sandboxing and execute arbitrary system commands on the underlying host.
vendor: n8n product: n8n cwe: CWE-913 disclosed: Mar 11, 20268.8 highwrite-up soon - CVE-2025-26399 KEV
SolarWinds Web Help Desk Deserialization of Untrusted Data (CVE-2025-26399)
CVE-2025-26399 is a deserialization of untrusted data vulnerability (CWE-502) in SolarWinds Web Help Desk. Exploitation allows remote attackers to execute arbitrary code by sending maliciously crafted serialized Java objects to the application. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. SolarWinds Web Help Desk is widely deployed in enterprise and government environments for IT service management, making this a high-priority target for threat actors seeking privileged network access.
vendor: SolarWinds product: Web Help Desk cwe: CWE-502 disclosed: Mar 9, 20269.8 criticalwrite-up soon - CVE-2021-22054 KEV
Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054)
Detects exploitation of CVE-2021-22054, a Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM. An unauthenticated attacker can send crafted HTTP requests to the UEM server, causing it to make arbitrary outbound HTTP/HTTPS requests to internal or external resources. This can be leveraged to scan internal networks, access cloud metadata services (e.g., AWS IMDS), or pivot to internal services not directly reachable by the attacker. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Omnissa product: Workspace One UEM cwe: CWE-918 disclosed: Mar 9, 20267.5 highwrite-up soon - CVE-2026-1603 KEV
Ivanti Endpoint Manager (EPM) Authentication Bypass (CVE-2026-1603)
CVE-2026-1603 is an authentication bypass vulnerability (CWE-288) in Ivanti Endpoint Manager (EPM). This KEV-listed vulnerability allows unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to the EPM management interface. Successful exploitation may lead to full compromise of managed endpoints, lateral movement, and deployment of malicious software across the enterprise.
vendor: Ivanti product: Endpoint Manager (EPM) cwe: CWE-288 disclosed: Mar 9, 20267.5 highwrite-up soon - CVE-2017-7921 KEV
Hikvision Improper Authentication Exploitation (CVE-2017-7921)
Detects exploitation attempts targeting CVE-2017-7921, an improper authentication vulnerability (CWE-287) in Hikvision IP cameras and multiple products. This vulnerability allows unauthenticated attackers to bypass authentication and gain unauthorized access to camera streams, configurations, and credentials by manipulating URL parameters. Listed on CISA KEV, indicating active exploitation in the wild. Attackers commonly use this to gain persistent access to surveillance infrastructure, pivot within networks, or exfiltrate sensitive footage.
vendor: Hikvision product: Multiple Products cwe: CWE-287 disclosed: Mar 5, 20269.8 criticalwrite-up soon - CVE-2021-22681 KEV
Rockwell Automation Logix Controllers Insufficient Credential Protection (CVE-2021-22681)
CVE-2021-22681 is an insufficient protection of credentials vulnerability (CWE-522) affecting Rockwell Automation multiple products including Logix controllers. An attacker can intercept or obtain weakly protected credentials used to authenticate with Logix controllers, enabling authentication bypass. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and poses critical risk in OT/ICS environments where unauthorized controller access could cause process disruption or physical damage.
vendor: Rockwell product: Multiple Products cwe: CWE-522 disclosed: Mar 5, 20269.8 criticalwrite-up soon - CVE-2023-43000 KEV
Apple Multiple Products Use-After-Free Vulnerability (CVE-2023-43000)
Detects exploitation of CVE-2023-43000, a use-after-free vulnerability (CWE-416) affecting multiple Apple products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Use-after-free conditions in Apple system components can allow attackers to execute arbitrary code, escalate privileges, or achieve kernel-level compromise on affected macOS, iOS, and related platforms.
vendor: Apple product: Multiple Products cwe: CWE-416 disclosed: Mar 5, 20268.8 highwrite-up soon - CVE-2021-30952 KEV
CVE-2021-30952: Apple Multiple Products Integer Overflow Exploitation
Detects exploitation attempts of CVE-2021-30952, an integer overflow vulnerability in Apple Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Integer overflow conditions in Apple platform components can lead to memory corruption, arbitrary code execution, or privilege escalation.
vendor: Apple product: Multiple Products cwe: CWE-190 disclosed: Mar 5, 20267.8 highwrite-up soon - CVE-2023-41974 KEV
Apple iOS/iPadOS Use-After-Free Exploitation (CVE-2023-41974)
Detects exploitation attempts and post-exploitation activity related to CVE-2023-41974, a use-after-free vulnerability in Apple iOS and iPadOS. This vulnerability allows an attacker to achieve arbitrary code execution, potentially leading to full device compromise. It is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Detection focuses on mobile device management telemetry, abnormal process behavior on managed Apple devices, and network indicators associated with mobile exploit frameworks.
vendor: Apple product: iOS and iPadOS cwe: CWE-416 disclosed: Mar 5, 20267.8 highwrite-up soon - CVE-2026-22719 KEV
CVE-2026-22719: VMware Aria Operations Command Injection
Detects exploitation of CVE-2026-22719, a command injection vulnerability (CWE-77) in Broadcom VMware Aria Operations. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through unsanitized input, potentially leading to full host compromise, lateral movement, and persistence within virtualized environments.
vendor: Broadcom product: VMware Aria Operations cwe: CWE-77 disclosed: Mar 3, 20268.1 highwrite-up soon - CVE-2026-20127 KEV
Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass (CVE-2026-20127)
CVE-2026-20127 is an authentication bypass vulnerability (CWE-287) affecting Cisco Catalyst SD-WAN Controller and Manager. A remote, unauthenticated attacker may exploit improper authentication mechanisms to gain unauthorized access to the management plane. This vulnerability is actively exploited in the wild per CISA KEV and is subject to Emergency Directive ED-26-03.
vendor: Cisco product: Catalyst SD-WAN Controller and Manager cwe: CWE-287 disclosed: Feb 25, 202610.0 criticalwrite-up soon - CVE-2022-20775 KEV
CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt
Detects exploitation attempts targeting CVE-2022-20775, a path traversal vulnerability (CWE-25, CWE-282) in Cisco SD-WAN software. Successful exploitation may allow an authenticated attacker to read or write arbitrary files on the underlying operating system, potentially leading to privilege escalation or persistent access. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Cisco product: SD-WAN cwe: CWE-25, CWE-282 disclosed: Feb 25, 20267.8 highwrite-up soon - CVE-2026-25108 KEV
Soliton FileZen OS Command Injection Exploitation (CVE-2026-25108)
Detects exploitation of CVE-2026-25108, an OS command injection vulnerability (CWE-78) in Soliton Systems K.K FileZen file-sharing appliance. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog and allows unauthenticated or authenticated attackers to inject arbitrary OS commands through vulnerable input fields, potentially leading to full system compromise.
vendor: Soliton Systems K.K product: FileZen cwe: CWE-78 disclosed: Feb 24, 20268.8 highwrite-up soon - CVE-2025-49113 KEV
RoundCube Webmail Deserialization of Untrusted Data (CVE-2025-49113)
CVE-2025-49113 is an actively exploited deserialization of untrusted data vulnerability (CWE-502) in Roundcube Webmail. When exploited, an attacker can send a specially crafted serialized PHP object via the web interface, leading to remote code execution on the underlying server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and requires immediate patching to versions 1.5.10 or 1.6.11.
vendor: Roundcube product: Webmail cwe: CWE-502 disclosed: Feb 20, 20268.8 highwrite-up soon - CVE-2025-68461 KEV
RoundCube Webmail Cross-Site Scripting (XSS) Exploitation Attempt
Detects exploitation attempts targeting CVE-2025-68461, a stored/reflected cross-site scripting vulnerability in RoundCube Webmail. This vulnerability, listed in CISA's Known Exploited Vulnerabilities catalog, allows attackers to inject malicious scripts via email content, potentially leading to session hijacking, credential theft, or further compromise of the mail server environment. Affected versions include RoundCube Webmail prior to 1.5.12 and 1.6.12.
vendor: Roundcube product: Webmail cwe: CWE-79 disclosed: Feb 20, 20266.1 mediumwrite-up soon - CVE-2026-22769 KEV
Dell RecoverPoint for Virtual Machines (RP4VMs) Hard-coded Credentials Exploitation
Detects exploitation of CVE-2026-22769, a hard-coded credentials vulnerability in Dell RecoverPoint for Virtual Machines (RP4VMs). Threat actors (including UNC6201) have actively exploited this zero-day to gain unauthorized access to RP4VMs appliances, enabling lateral movement, data exfiltration, and ransomware deployment within virtualized environments. The hard-coded credentials allow unauthenticated remote access to RP4VMs management interfaces.
vendor: Dell product: RecoverPoint for Virtual Machines (RP4VMs) cwe: CWE-798 disclosed: Feb 18, 202610.0 criticalwrite-up soon - CVE-2021-22175 KEV
GitLab SSRF Exploitation (CVE-2021-22175)
Detects exploitation of CVE-2021-22175, a Server-Side Request Forgery (SSRF) vulnerability in GitLab. An attacker can craft requests that cause the GitLab server to make HTTP requests to internal or external resources, potentially exposing cloud metadata endpoints, internal services, or facilitating lateral movement. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: GitLab product: GitLab cwe: CWE-918 disclosed: Feb 18, 20269.8 criticalwrite-up soon - CVE-2020-7796 KEV
Zimbra Collaboration Suite SSRF Exploitation (CVE-2020-7796)
Detects exploitation attempts targeting CVE-2020-7796, a Server-Side Request Forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). This vulnerability allows unauthenticated remote attackers to make the Zimbra server issue arbitrary HTTP requests to internal or external resources, potentially enabling internal network scanning, credential theft, or pivoting to internal services.
vendor: Synacor product: Zimbra Collaboration Suite cwe: CWE-918 disclosed: Feb 17, 20269.8 criticalwrite-up soon - CVE-2008-0015 KEV
Microsoft Windows Video ActiveX Control Remote Code Execution (CVE-2008-0015)
Detects exploitation attempts targeting the Microsoft Windows Video ActiveX Control vulnerability (CVE-2008-0015), addressed in MS09-032. The msvidctl.dll ActiveX control contains a memory corruption flaw that allows remote attackers to execute arbitrary code via a crafted web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in drive-by download campaigns.
vendor: Microsoft product: Windows disclosed: Feb 17, 20268.8 highwrite-up soon - CVE-2026-2441 KEV
CVE-2026-2441: Google Chromium CSS Use-After-Free Exploitation
Detects exploitation of CVE-2026-2441, a use-after-free vulnerability in the CSS engine of Google Chromium. This vulnerability is actively exploited in the wild (CISA KEV) and can allow remote code execution via a malicious web page. Detection focuses on abnormal Chromium renderer process behavior, suspicious child process spawning, and memory corruption indicators consistent with UAF exploitation.
vendor: Google product: Chromium cwe: CWE-416 disclosed: Feb 17, 20268.8 highwrite-up soon - CVE-2024-7694 KEV
TeamT5 ThreatSonar Anti-Ransomware Unrestricted File Upload (CVE-2024-7694)
CVE-2024-7694 is an unrestricted file upload vulnerability (CWE-434) in TeamT5 ThreatSonar Anti-Ransomware. An attacker can upload files with dangerous types to the ThreatSonar management interface, potentially achieving remote code execution on the host running the security product. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation of a security product creates a high-impact scenario where the attacker may gain privileged access to the endpoint security management plane.
vendor: TeamT5 product: ThreatSonar Anti-Ransomware cwe: CWE-434 disclosed: Feb 17, 20267.2 highwrite-up soon - CVE-2024-43468 KEV
CVE-2024-43468: Microsoft Configuration Manager SQL Injection Exploitation
Detects exploitation attempts targeting CVE-2024-43468, a SQL injection vulnerability in Microsoft Configuration Manager (SCCM/ConfigMgr). This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands against the ConfigMgr site database, potentially leading to remote code execution, credential theft, and lateral movement within the environment. Listed in CISA KEV indicating active exploitation in the wild.
vendor: Microsoft product: Configuration Manager cwe: CWE-89 disclosed: Feb 12, 20269.8 criticalwrite-up soon - CVE-2025-40536 KEV
SolarWinds Web Help Desk Security Control Bypass (CVE-2025-40536)
Detects exploitation of CVE-2025-40536, a security control bypass vulnerability (CWE-693) in SolarWinds Web Help Desk. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass authentication or authorization controls within the Web Help Desk application. Successful exploitation may enable unauthorized access to ticketing data, credential stores, or administrative functions.
vendor: SolarWinds product: Web Help Desk cwe: CWE-693 disclosed: Feb 12, 20269.8 criticalwrite-up soon - CVE-2026-20700 KEV
Apple Multiple Products Buffer Overflow Exploitation (CVE-2026-20700)
Detects exploitation attempts and post-exploitation activity related to CVE-2026-20700, a buffer overflow vulnerability (CWE-119) affecting multiple Apple products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Buffer overflow exploitation against Apple platforms may result in arbitrary code execution, privilege escalation, or sandbox escape.
vendor: Apple product: Multiple Products cwe: CWE-119 disclosed: Feb 12, 20267.8 highwrite-up soon - CVE-2025-15556 KEV
Notepad++ Download of Code Without Integrity Check (CVE-2025-15556)
CVE-2025-15556 is a CWE-494 (Download of Code Without Integrity Check) vulnerability in Notepad++ that has been added to CISA's Known Exploited Vulnerabilities catalog. The vulnerability allows an attacker to deliver malicious code through Notepad++'s update or plugin mechanism without cryptographic integrity verification, enabling arbitrary code execution in the context of the user running Notepad++. This is actively exploited in the wild and should be treated as high-priority for endpoint detection and response.
vendor: Notepad++ product: Notepad++ cwe: CWE-494 disclosed: Feb 12, 20267.5 highwrite-up soon - CVE-2026-21510 KEV
CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure
Detects exploitation of CVE-2026-21510, a Microsoft Windows Shell protection mechanism failure (CWE-693) that allows attackers to bypass security controls enforced by the Windows Shell. This vulnerability is actively exploited in the wild (CISA KEV). Attackers may abuse this flaw to execute unauthorized code, bypass security prompts, or escalate privileges via crafted shell interactions.
vendor: Microsoft product: Windows cwe: CWE-693 disclosed: Feb 10, 20268.8 highwrite-up soon - CVE-2026-21513 KEV
CVE-2026-21513 — Microsoft MSHTML Framework Protection Mechanism Failure
Detects exploitation of CVE-2026-21513, a protection mechanism failure (CWE-693) in the Microsoft MSHTML framework on Windows. This KEV-listed vulnerability allows attackers to bypass security controls implemented in MSHTML, potentially enabling code execution via crafted web content processed by Internet Explorer compatibility components, Microsoft Office documents embedding web content, or applications using the WebBrowser control. Active exploitation has been confirmed by CISA.
vendor: Microsoft product: Windows cwe: CWE-693 disclosed: Feb 10, 20268.8 highwrite-up soon - CVE-2026-21514 KEV
Microsoft Office Word Reliance on Untrusted Inputs in Security Decision (CVE-2026-21514)
Detects exploitation of CVE-2026-21514, a Microsoft Office Word vulnerability classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This flaw allows attackers to manipulate security-relevant decisions in Word by supplying crafted untrusted input, potentially bypassing security controls such as Protected View, macro policy enforcement, or document trust decisions. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
vendor: Microsoft product: Office cwe: CWE-807 disclosed: Feb 10, 20267.8 highwrite-up soon - CVE-2026-21519 KEV
Microsoft Windows Type Confusion Vulnerability (CVE-2026-21519)
Detects exploitation of CVE-2026-21519, a type confusion vulnerability (CWE-843) in Microsoft Windows. Type confusion vulnerabilities occur when code allocates or initializes a resource using one type but accesses it using an incompatible type, leading to out-of-bounds memory access, arbitrary code execution, or privilege escalation. This CVE is listed on the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: Microsoft product: Windows cwe: CWE-843 disclosed: Feb 10, 20267.8 highwrite-up soon - CVE-2026-21533 KEV
Microsoft Windows Improper Privilege Management (CVE-2026-21533)
Detects exploitation of CVE-2026-21533, a Microsoft Windows Improper Privilege Management vulnerability (CWE-269) listed in CISA's Known Exploited Vulnerabilities catalog. Successful exploitation allows a local attacker to elevate privileges on a compromised Windows system. Detection focuses on anomalous privilege token manipulation, unexpected service/process privilege escalation, and suspicious access patterns consistent with local privilege escalation techniques.
vendor: Microsoft product: Windows cwe: CWE-269 disclosed: Feb 10, 20267.8 highwrite-up soon - CVE-2026-21525 KEV
CVE-2026-21525 - Microsoft Windows NULL Pointer Dereference Exploitation
Detects exploitation attempts and post-exploitation activity related to CVE-2026-21525, a NULL pointer dereference vulnerability in Microsoft Windows. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve privilege escalation or code execution via memory corruption techniques targeting Windows kernel or user-mode components.
vendor: Microsoft product: Windows cwe: CWE-476 disclosed: Feb 10, 20266.2 mediumwrite-up soon - CVE-2026-1731 KEV PoC
BeyondTrust Remote Support Pre-Auth RCE (CVE-2026-1731)
Detects exploitation of CVE-2026-1731, a pre-authentication remote code execution vulnerability (CWE-78, OS command injection) in BeyondTrust Remote Support and Privileged Remote Access. CVSS 9.8. Actively exploited in the wild (CISA KEV). Attackers can execute arbitrary OS commands without authentication via crafted HTTP requests to the appliance web interface.
vendor: BeyondTrust product: Remote Support, Privileged Remote Access cwe: CWE-78 disclosed: Feb 6, 20269.8 criticalwrite-up soon - CVE-2025-11953 KEV
React Native Community CLI OS Command Injection (CVE-2025-11953)
Detects exploitation of CVE-2025-11953, an OS command injection vulnerability (CWE-78) in the React Native Community CLI. An attacker who can influence arguments or configuration consumed by the React Native CLI can inject arbitrary OS commands that execute with the privileges of the developer or CI/CD process invoking the CLI. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: React Native Community product: CLI cwe: CWE-78 disclosed: Feb 5, 20269.8 criticalwrite-up soon - CVE-2026-24423 KEV
SmarterMail Missing Authentication for Critical Function (CVE-2026-24423)
Detects exploitation of CVE-2026-24423, a missing authentication vulnerability (CWE-306) in SmarterTools SmarterMail. This KEV-listed vulnerability allows unauthenticated attackers to access critical functions in SmarterMail, potentially enabling unauthorized administrative access, data exfiltration, or further lateral movement. Detection focuses on unauthenticated access patterns to administrative and critical API endpoints.
vendor: SmarterTools product: SmarterMail cwe: CWE-306 disclosed: Feb 5, 20269.8 criticalwrite-up soon - CVE-2019-19006 KEV
Sangoma FreePBX Remote Admin Authentication Bypass (CVE-2019-19006)
CVE-2019-19006 is an improper authentication vulnerability (CWE-287) in Sangoma FreePBX that allows remote unauthenticated attackers to bypass administrative authentication controls. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation grants attackers full administrative access to the FreePBX VoIP management interface, enabling call interception, configuration tampering, toll fraud, and potential lateral movement into the broader network.
vendor: Sangoma product: FreePBX cwe: CWE-287 disclosed: Feb 3, 20269.8 criticalwrite-up soon - CVE-2025-40551 KEV
CVE-2025-40551 — SolarWinds Web Help Desk Deserialization RCE
Detects exploitation of CVE-2025-40551, a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. Successful exploitation allows unauthenticated or low-privileged attackers to achieve remote code execution on the WHD server. This CVE is listed in CISA KEV, indicating active exploitation in the wild.
vendor: SolarWinds product: Web Help Desk cwe: CWE-502 disclosed: Feb 3, 20269.8 criticalwrite-up soon - CVE-2021-39935 KEV
GitLab SSRF via Import Feature (CVE-2021-39935)
CVE-2021-39935 is a Server-Side Request Forgery (SSRF) vulnerability in GitLab Community and Enterprise Editions. An attacker can abuse GitLab's project import or integration features to cause the server to issue arbitrary HTTP requests to internal network resources, enabling reconnaissance, metadata service access, and potential lateral movement within cloud-hosted or on-premises GitLab deployments. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: GitLab product: Community and Enterprise Editions cwe: CWE-918 disclosed: Feb 3, 20267.5 highwrite-up soon - CVE-2025-64328 KEV
Sangoma FreePBX OS Command Injection (CVE-2025-64328)
Detects exploitation of an OS command injection vulnerability in Sangoma FreePBX. An authenticated or unauthenticated attacker may inject arbitrary OS commands through vulnerable FreePBX web interfaces or API endpoints, leading to remote code execution on the underlying Linux host. This vulnerability is tracked as CVE-2025-64328 and is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Sangoma product: FreePBX cwe: CWE-78 disclosed: Feb 3, 20267.2 highwrite-up soon - CVE-2026-1281 KEV
CVE-2026-1281 — Ivanti EPMM Code Injection Exploitation
Detects exploitation of CVE-2026-1281, a code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM). This KEV-listed vulnerability allows remote attackers to inject and execute arbitrary code via the EPMM management interface. Detection focuses on anomalous process execution, suspicious web shell activity, and unexpected outbound connections from EPMM server infrastructure.
vendor: Ivanti product: Endpoint Manager Mobile (EPMM) cwe: CWE-94 disclosed: Jan 29, 20269.8 criticalwrite-up soon - CVE-2026-24858 KEV
Fortinet Multiple Products Authentication Bypass via Alternate Path or Channel (CVE-2026-24858)
Detects exploitation of CVE-2026-24858, an authentication bypass vulnerability (CWE-288) affecting multiple Fortinet products. Attackers abuse an alternate authentication path or channel — specifically SSO abuse on FortiOS — to bypass normal authentication controls and gain unauthorized access. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: Fortinet product: Multiple Products cwe: CWE-288 disclosed: Jan 27, 20269.8 criticalwrite-up soon - CVE-2025-52691 KEV
SmarterMail Unrestricted File Upload Exploitation (CVE-2025-52691)
Detects exploitation of CVE-2025-52691, an unrestricted file upload vulnerability in SmarterTools SmarterMail. This vulnerability allows attackers to upload files with dangerous types (e.g., web shells, executables) to the mail server, potentially enabling remote code execution. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: SmarterTools product: SmarterMail cwe: CWE-434 disclosed: Jan 26, 202610.0 criticalwrite-up soon - CVE-2026-23760 KEV
SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760)
Detects exploitation of CVE-2026-23760, an authentication bypass vulnerability (CWE-288) in SmarterTools SmarterMail. Attackers can access protected functionality through an alternate path or channel without valid credentials, potentially leading to unauthorized mailbox access, data exfiltration, or lateral movement. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: SmarterTools product: SmarterMail cwe: CWE-288 disclosed: Jan 26, 20269.8 criticalwrite-up soon - CVE-2026-24061 KEV
GNU InetUtils Argument Injection Vulnerability (CVE-2026-24061)
CVE-2026-24061 is an argument injection vulnerability (CWE-88) in GNU InetUtils affecting utilities such as telnet, ftp, rsh, rcp, and related tools. An attacker who can control arguments passed to InetUtils binaries may inject additional command-line options, potentially enabling unauthorized network access, privilege escalation, or lateral movement. This vulnerability is listed on the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
vendor: GNU product: InetUtils cwe: CWE-88 disclosed: Jan 26, 20269.8 criticalwrite-up soon - CVE-2018-14634 KEV
Linux Kernel Integer Overflow in create_elf_tables (CVE-2018-14634)
CVE-2018-14634 is an integer overflow vulnerability in the Linux kernel's create_elf_tables() function, triggered during process execution via the execve syscall. A local unprivileged attacker can exploit this flaw to achieve privilege escalation to root by crafting a binary with an extremely large argument list. This vulnerability exists in Linux kernel versions 2.6.x through 4.14.x and is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Linux product: Kernel cwe: CWE-190 disclosed: Jan 26, 20267.8 highwrite-up soon - CVE-2026-21509 KEV
Microsoft Office Security Feature Bypass (CVE-2026-21509)
Detects exploitation of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass security controls within Office applications, potentially enabling malicious document execution without expected security warnings or Protected View enforcement.
vendor: Microsoft product: Office cwe: CWE-807 disclosed: Jan 26, 20267.8 highwrite-up soon - CVE-2024-37079 KEV
VMware vCenter Server Out-of-bounds Write (CVE-2024-37079)
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
vendor: Broadcom product: VMware vCenter Server cwe: CWE-787 disclosed: Jan 23, 20269.8 criticalwrite-up soon - CVE-2025-68645 KEV
Synacor Zimbra Collaboration Suite PHP Remote File Inclusion (CVE-2025-68645)
Detects exploitation of CVE-2025-68645, a PHP Remote File Inclusion (RFI) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CWE-98 class vulnerabilities allow attackers to inject and execute remote PHP files via unsanitized user-controlled input passed to PHP file inclusion functions, enabling arbitrary code execution in the context of the web server process. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
vendor: Synacor product: Zimbra Collaboration Suite (ZCS) cwe: CWE-98 disclosed: Jan 22, 20268.8 highwrite-up soon - CVE-2025-31125 KEV
CVE-2025-31125: Vite Dev Server Improper Access Control
Detects exploitation of CVE-2025-31125, an improper access control vulnerability in Vite (Vitejs) dev server. The vulnerability allows unauthorized access to sensitive files outside the intended serve root, classified under CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.
vendor: Vite product: Vitejs cwe: CWE-200, CWE-284 disclosed: Jan 22, 20267.5 highwrite-up soon - CVE-2025-34026 KEV
Versa Concerto Improper Authentication (CVE-2025-34026)
Detects exploitation attempts targeting CVE-2025-34026, an improper authentication vulnerability (CWE-288) in Versa Concerto SD-WAN orchestration platform. This vulnerability allows attackers to bypass authentication controls, potentially enabling unauthorized access to the Concerto management interface. Listed as a CISA KEV, indicating active exploitation in the wild.
vendor: Versa product: Concerto cwe: CWE-288 disclosed: Jan 22, 20267.5 highwrite-up soon - CVE-2025-54313 KEV
Prettier eslint-config-prettier Embedded Malicious Code (CVE-2025-54313)
Detects exploitation indicators related to CVE-2025-54313, a supply chain compromise affecting the eslint-config-prettier npm package (Prettier). The package was trojanized with embedded malicious code (CWE-506), enabling arbitrary code execution during npm install or build processes. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Prettier product: eslint-config-prettier cwe: CWE-506 disclosed: Jan 22, 20267.5 highwrite-up soon - CVE-2026-20045 KEV
CVE-2026-20045: Cisco Unified Communications Manager Code Injection
Detects exploitation attempts targeting CVE-2026-20045, a code injection vulnerability (CWE-94) in Cisco Unified Communications Manager. This KEV-listed vulnerability allows remote attackers to inject and execute arbitrary code. Detection focuses on anomalous process execution, unexpected web shell activity, and suspicious outbound connections originating from CUCM processes.
vendor: Cisco product: Unified Communications Manager cwe: CWE-94 disclosed: Jan 21, 20269.8 criticalwrite-up soon - CVE-2026-20805 KEV
Microsoft Windows Information Disclosure (CVE-2026-20805)
Detects exploitation of CVE-2026-20805, a Microsoft Windows information disclosure vulnerability (CWE-200) that allows attackers to access sensitive memory or kernel data. This vulnerability is actively exploited in the wild (CISA KEV). Successful exploitation may expose credentials, memory contents, or system information that enables privilege escalation or lateral movement.
vendor: Microsoft product: Windows cwe: CWE-200 disclosed: Jan 13, 20265.5 mediumwrite-up soon - CVE-2025-8110 KEV
Gogs Path Traversal Vulnerability (CVE-2025-8110)
Detects exploitation attempts targeting CVE-2025-8110, a path traversal vulnerability (CWE-22) in Gogs self-hosted Git service. Attackers can craft malicious HTTP requests containing directory traversal sequences to read arbitrary files outside the intended web root, potentially exposing sensitive configuration files, SSH keys, or repository data. This vulnerability is listed in the CISA KEV catalog indicating active exploitation in the wild.
vendor: Gogs product: Gogs cwe: CWE-22 disclosed: Jan 12, 20268.8 highwrite-up soon - CVE-2025-37164 KEV
HPE OneView Code Injection Exploitation (CVE-2025-37164)
Detects exploitation of CVE-2025-37164, a code injection vulnerability (CWE-94) in Hewlett Packard Enterprise OneView. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and allows attackers to inject and execute arbitrary code through the OneView management platform, potentially compromising datacenter infrastructure management.
vendor: Hewlett Packard Enterprise (HPE) product: OneView cwe: CWE-94 disclosed: Jan 7, 20269.8 criticalwrite-up soon - CVE-2009-0556 KEV
Microsoft Office PowerPoint Code Injection (CVE-2009-0556)
Detects exploitation attempts of CVE-2009-0556, a code injection vulnerability in Microsoft Office PowerPoint. Attackers can exploit this vulnerability via crafted PowerPoint files to execute arbitrary code in the context of the logged-in user. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: Office cwe: CWE-94 disclosed: Jan 7, 20268.8 highwrite-up soon - CVE-2025-14847 KEV
MongoDB Improper Handling of Length Parameter Inconsistency (CVE-2025-14847)
Detects exploitation attempts targeting CVE-2025-14847, an improper handling of length parameter inconsistency vulnerability (CWE-130) in MongoDB and MongoDB Server. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may craft malformed requests with inconsistent length parameters to cause unexpected server behavior, potentially leading to denial of service, data corruption, or unauthorized access.
vendor: MongoDB product: MongoDB and MongoDB Server cwe: CWE-130 disclosed: Dec 29, 20257.5 highwrite-up soon - CVE-2023-52163 KEV
Digiever DS-2105 Pro Missing Authorization Exploitation (CVE-2023-52163)
Detects exploitation of CVE-2023-52163, a missing authorization vulnerability (CWE-862) in Digiever DS-2105 Pro NVR devices. This KEV-listed vulnerability allows unauthenticated attackers to access restricted functionality or administrative interfaces without proper credential validation. Threat actors actively exploit exposed NVR devices for initial access, lateral movement, and persistence in OT/IoT environments.
vendor: Digiever product: DS-2105 Pro cwe: CWE-862 disclosed: Dec 22, 20258.8 highwrite-up soon - CVE-2025-14733 KEV
CVE-2025-14733: WatchGuard Firebox Out-of-Bounds Write Exploitation
Detects exploitation attempts targeting CVE-2025-14733, an out-of-bounds write vulnerability (CWE-787) in WatchGuard Firebox devices. This vulnerability is actively exploited in the wild (CISA KEV) and may allow remote code execution or device compromise. Detection focuses on anomalous management interface activity, unexpected process crashes, and network indicators consistent with exploitation.
vendor: WatchGuard product: Firebox cwe: CWE-787 disclosed: Dec 19, 20259.8 criticalwrite-up soon - CVE-2025-20393 KEV
CVE-2025-20393 — Cisco Multiple Products Improper Input Validation (KEV)
Detects exploitation attempts targeting CVE-2025-20393, an improper input validation vulnerability (CWE-20) affecting Cisco Multiple Products. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active in-the-wild exploitation. Attackers may leverage this flaw to bypass security controls, execute unauthorized commands, or gain elevated access to affected Cisco appliances.
vendor: Cisco product: Multiple Products cwe: CWE-20 disclosed: Dec 17, 202510.0 criticalwrite-up soon - CVE-2025-59374 KEV
ASUS Live Update Embedded Malicious Code (CVE-2025-59374)
Detects indicators of compromise related to CVE-2025-59374, a supply chain attack where ASUS Live Update software contained embedded malicious code (CWE-506). This mirrors the ShadowHammer operation pattern where threat actors compromised the ASUS software update infrastructure to deliver backdoored updates to endpoints. Detection focuses on suspicious child processes spawned by ASUS Live Update, anomalous network connections, and staging activity consistent with backdoor execution.
vendor: ASUS product: Live Update cwe: CWE-506 disclosed: Dec 17, 20259.8 criticalwrite-up soon - CVE-2025-40602 KEV
CVE-2025-40602 - SonicWall SMA1000 Missing Authorization Exploitation
Detects exploitation attempts targeting CVE-2025-40602, a missing authorization vulnerability (CWE-862) combined with execution with unnecessary privileges (CWE-250) in SonicWall SMA1000 appliances. This KEV-listed vulnerability allows unauthenticated or insufficiently privileged attackers to access restricted resources or execute privileged operations. Detection focuses on anomalous HTTP requests to SMA1000 management interfaces, unexpected authentication bypass patterns, and post-exploitation activity indicative of privilege escalation on SMA gateway infrastructure.
vendor: SonicWall product: SMA1000 appliance cwe: CWE-862, CWE-250 disclosed: Dec 17, 20256.6 mediumwrite-up soon - CVE-2025-59718 KEV
Fortinet Multiple Products Improper Verification of Cryptographic Signature (CVE-2025-59718)
Detects exploitation of CVE-2025-59718, an improper verification of cryptographic signature vulnerability (CWE-347) affecting multiple Fortinet products. This vulnerability, listed in CISA's Known Exploited Vulnerabilities catalog, allows attackers to bypass signature validation checks, potentially enabling unsigned firmware/software installation, man-in-the-middle attacks on update channels, or code execution with elevated privileges on affected Fortinet appliances.
vendor: Fortinet product: Multiple Products cwe: CWE-347 disclosed: Dec 16, 20259.8 criticalwrite-up soon - CVE-2025-14611 KEV
Gladinet CentreStack and Triofox Hard-Coded Cryptographic Key Exploitation
Detects exploitation of CVE-2025-14611, a hard-coded cryptographic key vulnerability (CWE-798) in Gladinet CentreStack and Triofox. Attackers who obtain the static machineKey or cryptographic seed can forge ASP.NET ViewState tokens or authentication artifacts, enabling remote code execution via deserialization attacks without valid credentials. This vulnerability is actively exploited and listed on CISA KEV.
vendor: Gladinet product: CentreStack and Triofox cwe: CWE-798 disclosed: Dec 15, 20259.8 criticalwrite-up soon - CVE-2025-43529 KEV
Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529)
Detects exploitation attempts targeting CVE-2025-43529, a use-after-free vulnerability in Apple's WebKit browser engine affecting multiple Apple products. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to arbitrary code execution when a user visits a maliciously crafted webpage. Attackers may leverage this flaw to achieve initial access or privilege escalation on macOS, iOS, and iPadOS devices.
vendor: Apple product: Multiple Products cwe: CWE-416 disclosed: Dec 15, 20258.8 highwrite-up soon - CVE-2018-4063 KEV
Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation
Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.
vendor: Sierra Wireless product: AirLink ALEOS cwe: CWE-434 disclosed: Dec 12, 20258.8 highwrite-up soon - CVE-2025-14174 KEV
CVE-2025-14174: Google Chromium Out of Bounds Memory Access Exploitation
Detects exploitation of CVE-2025-14174, an out-of-bounds memory access vulnerability in Google Chromium. This vulnerability is actively exploited in the wild (CISA KEV) and can allow attackers to execute arbitrary code or escape the browser sandbox via a crafted web page. Detection focuses on abnormal Chromium process behavior including child process spawning, memory anomalies, and post-exploitation indicators.
vendor: Google product: Chromium disclosed: Dec 12, 20258.8 highwrite-up soon - CVE-2025-58360 KEV
OSGeo GeoServer XXE Injection Exploitation Attempt
Detects exploitation attempts targeting CVE-2025-58360, an Improper Restriction of XML External Entity (XXE) Reference vulnerability in OSGeo GeoServer. Attackers can submit malicious XML payloads to GeoServer endpoints to perform server-side request forgery, read local files, or exfiltrate data via out-of-band DNS/HTTP channels. This CVE is listed on CISA's Known Exploited Vulnerabilities catalog.
vendor: OSGeo product: GeoServer cwe: CWE-611 disclosed: Dec 11, 20259.8 criticalwrite-up soon - CVE-2025-6218 KEV
CVE-2025-6218: RARLAB WinRAR Path Traversal Exploitation
Detects exploitation of CVE-2025-6218, a path traversal vulnerability in RARLAB WinRAR. Attackers can craft malicious archive files that, when extracted, write files outside the intended extraction directory, enabling arbitrary file placement on the victim system. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to code execution, persistence, or privilege escalation by dropping malicious files to sensitive locations such as startup folders, system directories, or application data paths.
vendor: RARLAB product: WinRAR cwe: CWE-22 disclosed: Dec 9, 20257.8 highwrite-up soon - CVE-2025-62221 KEV
CVE-2025-62221 Microsoft Windows Use After Free Exploitation
Detects exploitation attempts of CVE-2025-62221, a use-after-free vulnerability in Microsoft Windows. This class of memory corruption flaw allows attackers to execute arbitrary code by manipulating freed memory objects. As a CISA KEV entry, active exploitation in the wild has been confirmed. Detection focuses on anomalous process behavior, kernel-mode memory corruption indicators, crash telemetry, and privilege escalation patterns consistent with UAF exploitation chains.
vendor: Microsoft product: Windows cwe: CWE-416 disclosed: Dec 9, 20257.8 highwrite-up soon - CVE-2022-37055 KEV
CVE-2022-37055 D-Link Router Buffer Overflow Exploitation
Detects exploitation attempts targeting CVE-2022-37055, a buffer overflow vulnerability (CWE-120) in D-Link routers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may exploit this vulnerability to achieve remote code execution on affected D-Link routers, potentially enabling network pivoting, persistent access, or botnet enrollment.
vendor: D-Link product: Routers cwe: CWE-120 disclosed: Dec 8, 20259.8 criticalwrite-up soon - CVE-2025-66644 KEV
Array Networks ArrayOS AG OS Command Injection (CVE-2025-66644)
Detects exploitation of CVE-2025-66644, an OS command injection vulnerability in Array Networks ArrayOS AG. This vulnerability allows remote attackers to execute arbitrary operating system commands through the Array Networks SSL VPN/ZTNA gateway. The flaw is tracked by CISA as a Known Exploited Vulnerability (KEV), indicating active in-the-wild exploitation. Attackers may leverage this to gain initial access, establish persistence, or pivot laterally within the network.
vendor: Array Networks product: ArrayOS AG cwe: CWE-78 disclosed: Dec 8, 20259.8 criticalwrite-up soon - CVE-2025-55182 KEV
CVE-2025-55182 — Meta React Server Components Remote Code Execution
Detects exploitation of CVE-2025-55182, a critical remote code execution vulnerability in Meta React Server Components. This vulnerability allows attackers to achieve server-side code execution by abusing the React Server Components protocol, potentially leading to full server compromise. The vulnerability is actively exploited in the wild (CISA KEV).
vendor: Meta product: React Server Components disclosed: Dec 5, 202510.0 criticalwrite-up soon - CVE-2021-26828 KEV
CVE-2021-26828: OpenPLC ScadaBR Unrestricted File Upload RCE
Detects exploitation of CVE-2021-26828, an unrestricted file upload vulnerability in OpenPLC ScadaBR that allows authenticated attackers to upload files with dangerous types (e.g., JSP, PHP, WAR) to the server, leading to remote code execution. ScadaBR is a SCADA/HMI web application widely used in industrial control systems. This vulnerability is actively exploited in the wild and listed in CISA KEV.
vendor: OpenPLC product: ScadaBR cwe: CWE-434 disclosed: Dec 3, 20258.8 highwrite-up soon - CVE-2021-26829 KEV
OpenPLC ScadaBR Cross-Site Scripting (XSS) Exploitation Detected
Detects exploitation attempts targeting CVE-2021-26829, a stored or reflected cross-site scripting vulnerability in OpenPLC ScadaBR. ScadaBR is a SCADA/HMI platform used in industrial control environments. Successful exploitation allows attackers to inject malicious scripts into the web interface, potentially enabling session hijacking, credential theft, or lateral movement within OT/ICS environments. This CVE is listed on CISA's Known Exploited Vulnerabilities catalog.
vendor: OpenPLC product: ScadaBR cwe: CWE-79 disclosed: Nov 28, 20255.4 mediumwrite-up soon - CVE-2025-13223 KEV
Google Chromium V8 Type Confusion Exploitation (CVE-2025-13223)
Detects exploitation attempts targeting CVE-2025-13223, a type confusion vulnerability (CWE-843) in Google Chromium's V8 JavaScript engine. This KEV-listed vulnerability allows remote attackers to execute arbitrary code via a crafted HTML page. Exploitation typically involves a malicious web page triggering memory corruption through confused object type handling in V8, leading to sandbox escape or remote code execution within the browser process.
vendor: Google product: Chromium V8 cwe: CWE-843 disclosed: Nov 19, 20258.8 highwrite-up soon - CVE-2025-68670 Public PoC PoC
xrdp Unauthenticated Stack Buffer Overflow via RDP Connection Sequence (CVE-2025-68670)
CVE-2025-68670 is a critical unauthenticated stack buffer overflow (CWE-121) in xrdp versions prior to 0.10.5. During the RDP connection sequence, a remote unauthenticated attacker can send a specially crafted packet that overflows a stack buffer, potentially enabling remote code execution as the xrdp process user. CVSS 9.1. A public PoC exists. Patch to xrdp >= 0.10.5 immediately.
vendor: neutrinolabs, xrdp product: xrdp cwe: CWE-121 disclosed: Nov 18, 20259.1 criticalwrite-up soon - CVE-2025-58034 KEV
Fortinet FortiWeb OS Command Injection (CVE-2025-58034)
Detects exploitation of CVE-2025-58034, an OS command injection vulnerability (CWE-78) in Fortinet FortiWeb. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through FortiWeb's management or inspection interfaces, potentially leading to full appliance compromise, lateral movement, and persistent access to network segmentation points.
vendor: Fortinet product: FortiWeb cwe: CWE-78 disclosed: Nov 18, 20257.2 highwrite-up soon - CVE-2025-64446 KEV
CVE-2025-64446: Fortinet FortiWeb Path Traversal Exploitation
Detects exploitation attempts targeting CVE-2025-64446, a path traversal vulnerability (CWE-23) in Fortinet FortiWeb. This vulnerability allows attackers to traverse directory boundaries and access files outside the intended web root, potentially exposing sensitive configuration files, credentials, or system files. The vulnerability is listed in CISA KEV indicating active exploitation in the wild.
vendor: Fortinet product: FortiWeb cwe: CWE-23 disclosed: Nov 14, 20259.8 criticalwrite-up soon - CVE-2025-9242 KEV
WatchGuard Firebox Out-of-Bounds Write Exploitation (CVE-2025-9242)
Detects exploitation attempts targeting CVE-2025-9242, an out-of-bounds write vulnerability (CWE-787) in WatchGuard Firebox appliances. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation may allow remote code execution or denial of service on affected Firebox devices.
vendor: WatchGuard product: Firebox cwe: CWE-787 disclosed: Nov 12, 20259.8 criticalwrite-up soon - CVE-2025-12480 KEV
Gladinet Triofox Improper Access Control Exploitation Detected
Detects exploitation attempts targeting CVE-2025-12480, an improper access control vulnerability (CWE-284) in Gladinet Triofox. This vulnerability allows attackers to bypass access controls, potentially gaining unauthorized access to file storage and collaboration resources. Listed as a CISA Known Exploited Vulnerability, active exploitation has been observed in the wild.
vendor: Gladinet product: Triofox cwe: CWE-284 disclosed: Nov 12, 20259.1 criticalwrite-up soon - CVE-2025-62215 KEV
CVE-2025-62215 Microsoft Windows Race Condition Exploitation
Detects exploitation attempts of CVE-2025-62215, a race condition vulnerability (CWE-362) in Microsoft Windows. This KEV-listed vulnerability can be abused by attackers to gain elevated privileges or execute arbitrary code by winning a time-of-check to time-of-use (TOCTOU) race condition. Detection focuses on suspicious process creation patterns, handle manipulation, and abnormal thread timing indicative of race condition exploitation.
vendor: Microsoft product: Windows cwe: CWE-362 disclosed: Nov 12, 20257.0 highwrite-up soon - CVE-2025-48703 KEV
CVE-2025-48703 - CWP Control Web Panel OS Command Injection
Detects exploitation of CVE-2025-48703, an OS command injection vulnerability (CWE-78) in CWP Control Web Panel. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through the web panel interface, potentially leading to full server compromise.
vendor: CWP product: Control Web Panel cwe: CWE-78 disclosed: Nov 4, 20259.0 criticalwrite-up soon - CVE-2025-11371 KEV
Gladinet CentreStack/Triofox Unauthorized File/Directory Access (CVE-2025-11371)
Detects exploitation of CVE-2025-11371, a CWE-552 vulnerability in Gladinet CentreStack and Triofox where files or directories are accessible to external parties without proper authorization. This CISA KEV-listed vulnerability allows unauthenticated or unauthorized actors to access sensitive files and directories exposed by the affected file-sharing platform.
vendor: Gladinet product: CentreStack and Triofox cwe: CWE-552 disclosed: Nov 4, 20257.5 highwrite-up soon - CVE-2025-24893 KEV
CVE-2025-24893 XWiki Platform Eval Injection Exploitation
Detects exploitation of CVE-2025-24893, an eval injection vulnerability (CWE-95) in XWiki Platform that allows remote code execution via server-side template injection. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers can craft malicious wiki content or URLs containing Groovy/Velocity template expressions that are evaluated server-side, leading to arbitrary code execution under the XWiki process context.
vendor: XWiki product: Platform cwe: CWE-95 disclosed: Oct 30, 20259.8 criticalwrite-up soon - CVE-2025-41244 KEV
CVE-2025-41244 - VMware Aria Operations & VMware Tools Privilege Escalation via Unsafe Actions
Detects exploitation of CVE-2025-41244, a privilege escalation vulnerability in Broadcom VMware Aria Operations and VMware Tools caused by privileges defined with unsafe actions (CWE-267). This KEV-listed vulnerability allows attackers with lower-privileged access to escalate privileges by abusing overly permissive or unsafe role/action definitions within VMware Aria Operations or VMware Tools components. Indicators include anomalous administrative API calls, unexpected privilege changes in VMware management interfaces, and suspicious process activity from VMware Tools guest utilities.
vendor: Broadcom product: VMware Aria Operations and VMware Tools cwe: CWE-267 disclosed: Oct 30, 20257.8 highwrite-up soon - CVE-2025-6205 KEV
Dassault Systèmes DELMIA Apriso Missing Authorization (CVE-2025-6205)
Detects exploitation attempts targeting CVE-2025-6205, a missing authorization vulnerability (CWE-862) in Dassault Systèmes DELMIA Apriso. This vulnerability allows unauthenticated or low-privileged attackers to access protected resources or perform actions without proper authorization checks. Listed as a CISA KEV, indicating active exploitation in the wild.
vendor: Dassault Systèmes product: DELMIA Apriso cwe: CWE-862 disclosed: Oct 28, 20259.1 criticalwrite-up soon - CVE-2025-6204 KEV
CVE-2025-6204 — Dassault Systèmes DELMIA Apriso Code Injection
Detects exploitation of CVE-2025-6204, a code injection vulnerability (CWE-94) in Dassault Systèmes DELMIA Apriso. This vulnerability allows attackers to inject and execute arbitrary code through the Apriso application layer. It is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation can lead to remote code execution, lateral movement, and full compromise of manufacturing execution system (MES) environments.
vendor: Dassault Systèmes product: DELMIA Apriso cwe: CWE-94 disclosed: Oct 28, 20258.0 highwrite-up soon - CVE-2025-59287 KEV
Microsoft WSUS Deserialization of Untrusted Data (CVE-2025-59287)
Detects exploitation of CVE-2025-59287, a deserialization of untrusted data vulnerability in Microsoft Windows Server Update Services (WSUS). Successful exploitation allows an attacker to execute arbitrary code in the context of the WSUS service by sending a crafted serialized object. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.
vendor: Microsoft product: Windows cwe: CWE-502 disclosed: Oct 24, 20259.8 criticalwrite-up soon - CVE-2025-54236 KEV
Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236)
Detects exploitation of CVE-2025-54236, an improper input validation vulnerability in Adobe Commerce and Magento. This KEV-listed vulnerability allows attackers to submit maliciously crafted input to Commerce/Magento endpoints, potentially leading to remote code execution, unauthorized data access, or store compromise. Detection focuses on anomalous HTTP request patterns to Magento/Commerce endpoints, unexpected PHP execution, and indicators of post-exploitation activity.
vendor: Adobe product: Commerce and Magento cwe: CWE-20 disclosed: Oct 24, 20259.1 criticalwrite-up soon - CVE-2025-61932 KEV
Motex LANSCOPE Endpoint Manager - Improper Verification of Communication Channel Source (CVE-2025-61932)
CVE-2025-61932 is an Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Motex LANSCOPE Endpoint Manager. This flaw allows an attacker to send commands or data through a communication channel without proper verification of the channel's origin, potentially enabling unauthorized control over managed endpoints. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may abuse this to impersonate the LANSCOPE management server and push malicious instructions to endpoint agents.
vendor: Motex product: LANSCOPE Endpoint Manager cwe: CWE-940 disclosed: Oct 22, 20259.8 criticalwrite-up soon - CVE-2025-2746 KEV
CVE-2025-2746: Kentico Xperience CMS Authentication Bypass
Detects exploitation of CVE-2025-2746, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS that allows attackers to access protected resources via alternate paths or channels without valid credentials. This vulnerability is actively exploited in the wild (CISA KEV).
vendor: Kentico product: Xperience CMS cwe: CWE-288 disclosed: Oct 20, 20259.8 criticalwrite-up soon - CVE-2025-2747 KEV
Kentico Xperience CMS Authentication Bypass (CVE-2025-2747)
Detects exploitation of CVE-2025-2747, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS. Attackers can access protected administrative or content management endpoints via alternate paths or channels without valid credentials, enabling unauthorized access to sensitive CMS functionality. This vulnerability is actively exploited in the wild and listed in CISA KEV.
vendor: Kentico product: Xperience CMS cwe: CWE-288 disclosed: Oct 20, 20259.8 criticalwrite-up soon - CVE-2022-48503 KEV
CVE-2022-48503 Apple Multiple Products Unspecified Vulnerability Exploitation
Detects potential exploitation of CVE-2022-48503, an unspecified vulnerability affecting Apple multiple products. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Detection focuses on suspicious process activity, network connections, and crash telemetry from Apple ecosystem processes that may indicate exploitation attempts.
vendor: Apple product: Multiple Products disclosed: Oct 20, 20258.8 highwrite-up soon - CVE-2025-21589 Theoretical
Juniper Session Smart Router Authentication Bypass (CVE-2025-21589)
CVE-2025-21589 is a critical authentication bypass vulnerability (CWE-288, CVSS 9.8) in Juniper Networks Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router. An unauthenticated remote attacker can bypass authentication mechanisms to gain administrative access to the management interface without valid credentials. Affected versions include SSR 5.6.7–5.6.16, 6.0.x before 6.0.8, 6.1.x before 6.1.12-lts, 6.2.x before 6.2.8-lts, and 6.3.x before 6.3.3-r2. Exploitation grants full control of affected routers and conductors, enabling lateral movement, traffic interception, configuration tampering, and persistent backdoor establishment.
vendor: Juniper Networks product: Session Smart Router, Session Smart Conductor… cwe: CWE-288 disclosed: Sep 10, 20259.8 criticalwrite-up soon - CVE-2025-24054 KEV PoC
Windows NTLM Credential Leak via File Download Interaction
CVE-2025-24054 is a Windows NTLM hash disclosure vulnerability triggered when a user interacts with a specially crafted file (e.g., .library-ms, .url, .lnk) that forces an outbound NTLM authentication attempt to an attacker-controlled server. Exploitation requires minimal user interaction — simply downloading or viewing a malicious file in Explorer can suffice. The leaked Net-NTLMv2 hash can be cracked offline or relayed for lateral movement. This vulnerability is actively exploited in the wild and listed in CISA's KEV catalog.
vendor: Microsoft product: Windows cwe: CWE-73 disclosed: Mar 11, 20256.5 mediumwrite-up soon - CVE-2025-21298 Public PoC PoC
CVE-2025-21298: Windows OLE RCE via Malicious RTF Document
Detects exploitation of CVE-2025-21298, a use-after-free (CWE-416) vulnerability in Windows OLE that allows remote code execution when a user opens a specially crafted RTF document. With a CVSS score of 9.8 and public PoC availability, this is a critical-severity vulnerability affecting Windows 10, 11, and Server 2008-2025. Exploitation typically involves phishing emails with RTF attachments that trigger the OLE subsystem to execute attacker-controlled code in the context of the victim user.
vendor: Microsoft product: Windows, Windows OLE cwe: CWE-416 disclosed: Jan 14, 20259.8 criticalwrite-up soon - CVE-2024-43451 KEV
CVE-2024-43451: Windows NTLM Hash Disclosure via File Interaction
CVE-2024-43451 is a Windows NTLM hash disclosure vulnerability (NTLMv2 spoofing) affecting Windows 10, Windows 11, and Windows Server 2008-2025. Minimal user interaction with a malicious file (right-click, open, or preview) triggers an outbound NTLM authentication request to an attacker-controlled server, leaking the victim's NTLMv2 hash. The hash can be cracked offline or used in relay attacks. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
vendor: Microsoft product: Windows cwe: CWE-73 disclosed: Nov 12, 20246.5 mediumwrite-up soon - CVE-2024-38112 KEV
CVE-2024-38112 - Windows MSHTML Spoofing via .url File Phishing (Void Banshee)
Detects exploitation of CVE-2024-38112, a Windows MSHTML spoofing vulnerability actively exploited by the Void Banshee threat group. Attackers deliver crafted .url files that invoke the legacy Internet Explorer MSHTML engine (mhtml: or ms-its: URI handlers) to load remote malicious content, bypassing modern browser security controls. Patch released July 2024; in CISA KEV catalog.
vendor: Microsoft product: Windows, MSHTML Platform cwe: CWE-668 disclosed: Jul 9, 20247.5 highwrite-up soon - CVE-2024-30078 Theoretical
CVE-2024-30078: Windows Wi-Fi Driver Remote Code Execution via Adjacent Network
Detects exploitation attempts of CVE-2024-30078, a critical Windows Wi-Fi Driver vulnerability (CWE-591: Sensitive Data Storage in Improperly Locked Memory) that allows unauthenticated remote code execution from an adjacent network. An attacker within Wi-Fi range can send specially crafted network packets to trigger memory corruption in the Windows Wi-Fi driver (nwifi.sys), potentially gaining SYSTEM-level code execution without user interaction. Affected platforms include Windows 10, Windows 11, and Windows Server 2008 through 2022.
vendor: Microsoft product: Windows, Windows Wi-Fi Driver cwe: CWE-591 disclosed: Jun 11, 20248.8 highwrite-up soon - CVE-2024-3400 KEV
Palo Alto PAN-OS GlobalProtect Command Injection (CVE-2024-3400)
CVE-2024-3400 is a critical unauthenticated remote code execution vulnerability (CVSS 10.0) in Palo Alto Networks PAN-OS GlobalProtect gateway. A command injection flaw in the GlobalProtect feature allows an unauthenticated attacker to execute arbitrary OS commands as root by sending specially crafted HTTPS requests. Actively exploited in the wild as part of Operation MidnightEclipse by threat actor UTA0218, attackers have deployed a Python-based backdoor (UPSTYLE) and conducted lateral movement. Affected versions include PAN-OS 10.2.x < 10.2.9-h1, 11.0.x < 11.0.4-h1, and 11.1.x < 11.1.2-h3.
vendor: Palo Alto Networks product: PAN-OS, GlobalProtect cwe: CWE-77 disclosed: Apr 12, 202410.0 criticalwrite-up soon - CVE-2024-26234 Weaponized PoC
CVE-2024-26234 — Windows Proxy Driver Spoofing via Malicious Signed Driver
Detects exploitation of CVE-2024-26234, a Windows Proxy Driver Spoofing vulnerability where threat actors abuse Microsoft's WHQL signing process to load a malicious signed kernel driver. The driver installs a proxy component enabling persistent backdoor access. Severity is elevated given weaponized exploit status and kernel-level code execution potential.
vendor: Microsoft product: Windows cwe: CWE-284 disclosed: Apr 9, 20246.7 mediumwrite-up soon - CVE-2024-21413 KEV
CVE-2024-21413: Microsoft Outlook RCE via Moniker Link (MonikerLink)
CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook caused by improper input validation of hyperlinks using the 'file://' moniker protocol combined with an exclamation mark suffix. When a victim previews or opens a crafted email, Outlook follows the malicious link without the usual Protected View warning, leaking NTLM credentials via an outbound SMB connection and potentially enabling remote code execution. CVSS 9.8. Actively exploited in the wild (CISA KEV).
vendor: Microsoft product: Outlook, Microsoft 365 Apps… cwe: CWE-20 disclosed: Feb 13, 20249.8 criticalwrite-up soon - CVE-2024-23897 KEV PoC
CVE-2024-23897: Jenkins Arbitrary File Read via CLI Argument Parser (Pre-Auth RCE Chain)
CVE-2024-23897 is a critical path traversal vulnerability (CWE-22) in Jenkins' built-in CLI argument parser (args4j). The parser expands file contents prefixed with '@' as command arguments, allowing unauthenticated attackers to read arbitrary files from the Jenkins controller filesystem — including secrets, credentials, and SSH keys. When combined with additional weaknesses (e.g., exposed Remember Me tokens or cryptographic keys), this chain enables unauthenticated remote code execution. CVSS 9.8. Actively exploited (CISA KEV). Affects Jenkins <= 2.441 and LTS <= 2.426.2.
vendor: Jenkins product: Jenkins cwe: CWE-22 disclosed: Jan 24, 20249.8 criticalwrite-up soon - CVE-2024-21887 KEV
Ivanti Connect Secure Authenticated Command Injection (CVE-2024-21887)
CVE-2024-21887 is a critical authenticated command injection vulnerability (CVSS 9.1) in Ivanti Connect Secure and Policy Secure web components. When chained with the authentication bypass CVE-2023-46805, unauthenticated remote attackers can execute arbitrary commands on the appliance as root. Nation-state threat actors (UNC5221) exploited this as a zero-day to deploy LIGHTWIRE, WIREFIRE, and FRAMESTING web shells and conduct credential harvesting and lateral movement. CISA added this to the KEV catalog in January 2024.
vendor: Ivanti product: Connect Secure, Policy Secure cwe: CWE-77 disclosed: Jan 12, 20249.1 criticalwrite-up soon
Related tactics
227 vulnerability detections
163 vulnerability detections