Vulnerability Report Archives • Daily CyberSecurity

PoC Releases for CVE-2026-63077: TeamCity RCE Exploited in the Wild JetBrains TeamCity CVE-2026-63077 unauthenticated remote code execution exploited in the wild with public PoC exploit code

JetBrains TeamCity CVE-2026-63077 unauthenticated remote code execution exploited in the wild with public PoC exploit code

PoC Releases for CVE-2026-63077: TeamCity RCE Exploited in the Wild

Do Son August 10, 2026

TL;DR CVE-2026-63077 is a critical unauthenticated remote code execution flaw in JetBrains TeamCity. An attacker who reaches...

Metabase SQL Injection Zero-Day (CVSS 10) Exploited

Metabase SQL injection zero-day vulnerability CVSS 10 exploited in the wild unauthenticated admin access advisory

Metabase SQL Injection Zero-Day (CVSS 10) Exploited

Do Son August 8, 2026

TL;DR Metabase disclosed a critical SQL injection zero-day rated CVSS 10. An unauthenticated remote attacker can gain...

Multiple ClamAV Flaws Let Remote Attackers Cause DoS ClamAV vulnerability multiple denial of service flaws in Cisco Secure Endpoint remote attacker crafted file scanning

ClamAV vulnerability multiple denial of service flaws in Cisco Secure Endpoint remote attacker crafted file scanning

Multiple ClamAV Flaws Let Remote Attackers Cause DoS

Do Son August 8, 2026

TL;DR Cisco disclosed seven ClamAV vulnerabilities on August 7, 2026. Each lets an unauthenticated remote attacker crash...

CryptoJS randomness vulnerability Ill Bloom crypto wallet seed phrase attack draining funds across multiple chains

CryptoJS Randomness Vulnerability Drains Crypto Wallets

Do Son August 7, 2026

TL;DR A weak random number generator inside CryptoJS produced predictable wallet seed phrases for over a decade....

CVE-2026-5430: WSO2 Account Takeover Flaws Rated Up to CVSS 10 WSO2 account takeover flaws CVE-2026-5430 and CVE-2026-1728 rated up to CVSS 10

CVE-2026-5430: WSO2 Account Takeover Flaws Rated Up to CVSS 10

Do Son August 7, 2026

TL;DR WSO2 disclosed four critical vulnerabilities across its API and identity products. Several are WSO2 account takeover...

Zbtlink router backdoor ENDLESSDOORS CVE-2026-66747 enabling unauthenticated remote code execution as root

CVE-2026-66747: Zbtlink Router Backdoor ENDLESSDOORS Enables Unauthenticated Remote Code Execution as Root

Do Son August 7, 2026

TL;DR VulnCheck found a Zbtlink router backdoor in every published firmware build across the product line. Named...

CVE-2026-64561: Zapscape KVM Escape Runs Commands With Kernel Root Privilege, PoC Exploit Code Publicly Disclosed KVM escape vulnerability Zapscape CVE-2026-64561 running commands with kernel root privilege, with public PoC exploit code

KVM escape vulnerability Zapscape CVE-2026-64561 running commands with kernel root privilege, with public PoC exploit code

CVE-2026-64561: Zapscape KVM Escape Runs Commands With Kernel Root Privilege, PoC Exploit Code Publicly Disclosed

Do Son August 7, 2026

TL;DR Security researcher Hyunwoo Kim (@v4bel) disclosed a KVM escape vulnerability named Zapscape. Tracked as CVE-2026-64561, it...

CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution WordPress security update 7.0.3 fixing CVE-2026-64638 pre-auth XSS that can lead to remote code execution

WordPress security update 7.0.3 fixing CVE-2026-64638 pre-auth XSS that can lead to remote code execution

CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution

Do Son August 7, 2026

TL;DR WordPress 7.0.3 is out as a security release. This WordPress security update fixes about a dozen...

Chrome Security Update Patches 41 Vulnerabilities, Including 6 Critical Flaws Chrome security update patching 41 vulnerabilities including critical CVE-2026-19137 and CVE-2026-19170

Chrome security update patching 41 vulnerabilities including critical CVE-2026-19137 and CVE-2026-19170

Chrome Security Update Patches 41 Vulnerabilities, Including 6 Critical Flaws

Do Son August 7, 2026

TL;DR Google shipped a Chrome security update for the stable desktop channel. It fixes 41 vulnerabilities in...

Cisco IMC Argument Injection Flaw CVE-2026-20200 Enables Root RCE, PoC Exploit Code Publicly Available Cisco IMC vulnerabilities CVE-2026-20200 and CVE-2026-20288 enabling remote code execution as root

Cisco IMC vulnerabilities CVE-2026-20200 and CVE-2026-20288 enabling remote code execution as root

Cisco IMC Argument Injection Flaw CVE-2026-20200 Enables Root RCE, PoC Exploit Code Publicly Available

Do Son August 7, 2026

TL;DR Cisco disclosed two Cisco IMC vulnerabilities in the web-based management interface. The more serious one, CVE-2026-20200,...

Phoenix Contact CHARX vulnerabilities affecting EV charging controller firmware

Phoenix Contact CHARX Vulnerabilities Expose EV Charging Controllers

Do Son August 6, 2026

TL;DR: Phoenix Contact CHARX vulnerabilities now number 20 across the SEC-3xxx EV charging controllers. Several rate critical,...

CVE-2026-39868: Public PoC Discloses a macOS and iOS Kernel Memory Corruption Flaw macOS kernel vulnerability CVE-2026-39868 in DTrace DOF parsing with public proof-of-concept exploit code

macOS kernel vulnerability CVE-2026-39868 in DTrace DOF parsing with public proof-of-concept exploit code

CVE-2026-39868: Public PoC Discloses a macOS and iOS Kernel Memory Corruption Flaw

Do Son August 6, 2026

TL;DR Apple has patched a serious macOS kernel vulnerability tracked as CVE-2026-39868. An unprivileged app can corrupt...

CVE-2026-63077: TeamCity RCE Flaw Exploited in the Wild, CISA Warns JetBrains TeamCity vulnerability CVE-2026-63077 remote code execution alert added to CISA KEV catalog

JetBrains TeamCity vulnerability CVE-2026-63077 remote code execution alert added to CISA KEV catalog

CVE-2026-63077: TeamCity RCE Flaw Exploited in the Wild, CISA Warns

Do Son August 6, 2026

TL;DR CISA added the TeamCity vulnerability CVE-2026-63077 to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated...

CVE-2026-70426: Critical Jenkins RCE Flaw Bypasses Deserialization Filter Critical Jenkins vulnerability CVE-2026-70426 lets attackers bypass the JEP-200 filter and run code on the controller. Patch now.

Critical Jenkins vulnerability CVE-2026-70426 lets attackers bypass the JEP-200 filter and run code on the controller. Patch now.

CVE-2026-70426: Critical Jenkins RCE Flaw Bypasses Deserialization Filter

Do Son August 6, 2026

TL;DR Jenkins patched a critical Jenkins vulnerability, CVE-2026-70426, that bypasses the JEP-200 deserialization filter. Attackers with Agent/Connect...

CVE-2026-20303 & CVE-2026-20304: Cisco SD-WAN Flaws Hit CVSS 9.9 Cisco Catalyst SD-WAN vulnerability dashboard showing CVE-2026-20303 and CVE-2026-20304 critical CVSS 9.9 advisory

Cisco Catalyst SD-WAN vulnerability dashboard showing CVE-2026-20303 and CVE-2026-20304 critical CVSS 9.9 advisory

CVE-2026-20303 & CVE-2026-20304: Cisco SD-WAN Flaws Hit CVSS 9.9

Do Son August 5, 2026

TL;DR Cisco patched five Cisco SD-WAN vulnerability issues in Catalyst SD-WAN Software. Three are Critical, with two...

SGLang Hit by Six Vulnerabilities, Including Unauthenticated RCE (CVE-2026-15969) SGLang vulnerabilities unauthenticated remote code execution CVE-2026-15969

SGLang vulnerabilities unauthenticated remote code execution CVE-2026-15969

SGLang Hit by Six Vulnerabilities, Including Unauthenticated RCE (CVE-2026-15969)

Do Son August 5, 2026

TL;DR A researcher found six SGLang vulnerabilities, and the worst allow unauthenticated remote code execution. SGLang serves...

CVE-2026-9044: TP-Link Command Injection Hits Archer AXE75 TP-Link command injection vulnerability CVE-2026-9044 in Archer AXE75 OpenVPN module

CVE-2026-9044: TP-Link Command Injection Hits Archer AXE75

Do Son August 5, 2026

TL;DR: TP-Link patched a TP-Link command injection flaw in the Archer AXE75 V1 router. Tracked as CVE-2026-9044,...

IBM Patches Three CVSS 9.8 Flaws, Including CVE-2026-12943 Command Execution IBM critical vulnerabilities CVE-2026-12943 arbitrary command execution at CVSS 9.8

IBM critical vulnerabilities CVE-2026-12943 arbitrary command execution at CVSS 9.8

IBM Patches Three CVSS 9.8 Flaws, Including CVE-2026-12943 Command Execution

Do Son August 5, 2026

TL;DR IBM has disclosed three critical vulnerabilities across three products, each rated CVSS 9.8. The flaws affect...

Linux suTrap Local Privilege Escalation Flaw PoC Exploit Disclosed Diagram demonstrating the Linux suTrap LPE flaw and the interactive su TIOCSTI bug attack flow

Diagram demonstrating the Linux suTrap LPE flaw and the interactive su TIOCSTI bug attack flow

Linux suTrap Local Privilege Escalation Flaw PoC Exploit Disclosed

Do Son August 5, 2026

TL;DR Security researchers have detailed a critical Linux suTrap local privilege escalation flaw. This interactive su TIOCSTI...

CVE-2026-20272 & CVE-2026-20267: Cisco IOS XE Flaws Hit CVSS 9.8 Cisco IOS XE vulnerability dashboard showing CVE-2026-20272 and CVE-2026-20267 critical CVSS 9.8 security advisory

Cisco IOS XE vulnerability dashboard showing CVE-2026-20272 and CVE-2026-20267 critical CVSS 9.8 security advisory

CVE-2026-20272 & CVE-2026-20267: Cisco IOS XE Flaws Hit CVSS 9.8

Do Son August 5, 2026

TL;DR Cisco patched seven Cisco IOS XE vulnerability issues in an August 2026 hardening release. Two are...

NVIDIA Dynamo Code Execution Flaw CVE-2026-24254 CVSS 9.8 NVIDIA Dynamo flaw diagram explaining the code execution attack vector and CVE-2026-24254 CVSS score

NVIDIA Dynamo flaw diagram explaining the code execution attack vector and CVE-2026-24254 CVSS score

NVIDIA Dynamo Code Execution Flaw CVE-2026-24254 CVSS 9.8

Do Son August 5, 2026

TL;DR NVIDIA recently published an urgent software update for NVIDIA Dynamo for Linux. This update patches several...

Django vulnerability CVE-2026-15307 server-side file write and remote code execution via spatial lookups security release

Django Vulnerability CVE-2026-15307 Can Enable Remote Code Execution

Do Son August 5, 2026

TL;DR The Django team shipped security releases 6.0.8 and 5.2.17 on August 4, 2026. They fix four...