Vulnerability Report Archives • Daily CyberSecurity

CVE-2026-20744: Privilege Escalation in EV Chargers Diagram of CVE-2026-20744 privilege escalation flaw in Hydro-Québec charging stations alongside CVE-2026-42952 and CVE-2026-44383.

Diagram of CVE-2026-20744 privilege escalation flaw in Hydro-Québec charging stations alongside CVE-2026-42952 and CVE-2026-44383.

CVE-2026-20744: Privilege Escalation in EV Chargers

Do Son July 13, 2026

Hydro-Québec recently disclosed a severe privilege escalation flaw impacting its electric vehicle charging network. This critical vulnerability...

Critical Veeam Remote Code Execution Flaw: CVE-2026-44963 Diagram showing Veeam Backup server affected by CVE-2026-44963 and related CVE-2023-27532 remote code execution vulnerabilities.

Diagram showing Veeam Backup server affected by CVE-2026-44963 and related CVE-2023-27532 remote code execution vulnerabilities.

Critical Veeam Remote Code Execution Flaw: CVE-2026-44963

Do Son July 13, 2026

TL;DR Summary WatchTowr researchers disclosed a critical remote code execution flaw in Veeam Backup & Replication. The...

WAGO System I/O Flaw CVE-2026-4769 Leads to Full System Compromise WAGO System I/O field device early-boot flaw CVE-2026-4769 full system compromise

WAGO System I/O field device early-boot flaw CVE-2026-4769 full system compromise

WAGO System I/O Flaw CVE-2026-4769 Leads to Full System Compromise

Do Son July 13, 2026

TL;DR A critical flaw in WAGO System I/O field devices now has a fix. Tracked as CVE-2026-4769,...

CVE-2026-49844: Apache Log4j Emits Invalid JSON Logs Apache Log4j CVE-2026-49844 flaw producing invalid JSON in log4j-api output

CVE-2026-49844: Apache Log4j Emits Invalid JSON Logs

Do Son July 13, 2026

TL;DR Apache has patched a new flaw in Apache Log4j, tracked as CVE-2026-49844. The bug lets an...

decompress npm vulnerability CVE-2026-53486 path traversal in Node.js archive extraction

decompress npm Vulnerability CVE-2026-53486 (CVSS 9.1) Threatens 2.8 Million Weekly Downloads

Do Son July 12, 2026

TL;DR A high-severity decompress npm vulnerability lets crafted archives write files outside the extraction folder. Tracked as...

Apache IoTDB Fixes Path Traversal and Authentication Bypass Flaws (CVE-2026-24014) Apache IoTDB vulnerabilities path traversal and authentication bypass in DataNode RPC

Apache IoTDB vulnerabilities path traversal and authentication bypass in DataNode RPC

Apache IoTDB Fixes Path Traversal and Authentication Bypass Flaws (CVE-2026-24014)

Do Son July 11, 2026

TL;DR Apache IoTDB has patched three flaws in its time-series database. The worst is a critical path...

Apache Camel Vulnerabilities Expose Routes to Header Injection and SSRF Apache Camel vulnerabilities diagram showing header injection and server-side request forgery attack flow across Camel routes

Apache Camel vulnerabilities diagram showing header injection and server-side request forgery attack flow across Camel routes

Apache Camel Vulnerabilities Expose Routes to Header Injection and SSRF

Do Son July 10, 2026

TL;DR The Apache Camel project patched four high-severity flaws across five components. Three Apache Camel vulnerabilities let...

Gardyn IoT Hub Flaw CVE-2026-13768 (CVSS 10) Enables Unauthenticated Remote Code Execution Gardyn IoT Hub advisory graphic showing CVE-2026-13768 remote code execution risk on smart garden devices

Gardyn IoT Hub advisory graphic showing CVE-2026-13768 remote code execution risk on smart garden devices

Gardyn IoT Hub Flaw CVE-2026-13768 (CVSS 10) Enables Unauthenticated Remote Code Execution

Do Son July 10, 2026

TL;DR CISA published an advisory for three flaws in the Gardyn IoT Hub, the controller for Gardyn’s...

FreeBSD Patches Three Kernel Flaws That Enable Local Privilege Escalation FreeBSD privilege escalation advisory chart highlighting a kernel use-after-free and two local root flaws

FreeBSD privilege escalation advisory chart highlighting a kernel use-after-free and two local root flaws

FreeBSD Patches Three Kernel Flaws That Enable Local Privilege Escalation

Do Son July 10, 2026

TL;DR On June 30, 2026, the FreeBSD Project shipped three advisories covering FreeBSD privilege escalation bugs in...

Kafka Authentication Bypass in the OAUTHBEARER JWT Path Kafka authentication bypass through OAUTHBEARER JWT replay on Apache Kafka 4.0.x brokers

Kafka authentication bypass through OAUTHBEARER JWT replay on Apache Kafka 4.0.x brokers

Kafka Authentication Bypass in the OAUTHBEARER JWT Path

Do Son July 10, 2026

TL;DR A researcher disclosed a Kafka authentication bypass in the OAUTHBEARER login path. It affects Apache Kafka...

CVE-2026-13753: HP Missing Authorization Vulnerability HP Deskjet missing authorization vulnerability CVE-2026-13753 exposing printer API security flaw

HP Deskjet missing authorization vulnerability CVE-2026-13753 exposing printer API security flaw

CVE-2026-13753: HP Missing Authorization Vulnerability

Do Son July 10, 2026

TL;DR Security researchers discovered an HP Deskjet missing authorization vulnerability in the 2800 printer series. This flaw,...

Linux kernel FUSE local privilege escalation via CVE-2026-31694 page cache overflow

Public PoC Discloses CVE-2026-31694, a Linux Kernel FUSE Local Privilege Escalation

Do Son July 10, 2026

TL;DR Researchers have published full details and working exploit code for CVE-2026-31694. This Linux kernel FUSE bug...

GNU Guix Vulnerabilities Expose guix substitute and guix pull GNU Guix vulnerabilities in guix substitute and guix pull enabling remote privilege escalation

GNU Guix vulnerabilities in guix substitute and guix pull enabling remote privilege escalation

GNU Guix Vulnerabilities Expose guix substitute and guix pull

Do Son July 10, 2026

TL;DR The GNU Guix project disclosed four GNU Guix vulnerabilities in early July 2026. Three affect the...

Django SQL Injection Flaw CVE-2026-1207 Is Being Exploited in the Wild Django SQL injection CVE-2026-1207 exploited in the wild via PostGIS RasterField raster lookups

Django SQL injection CVE-2026-1207 exploited in the wild via PostGIS RasterField raster lookups

Django SQL Injection Flaw CVE-2026-1207 Is Being Exploited in the Wild

Do Son July 10, 2026

TL;DR CVE-2026-1207 is a high-severity Django SQL injection flaw, scored 8.3. It affects RasterField lookups when Django...

Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433 Roundcube zero-click XSS warning showing CVE-2026-54433 stored XSS in plain-text email rendering

Roundcube zero-click XSS warning showing CVE-2026-54433 stored XSS in plain-text email rendering

Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433

Do Son July 9, 2026

TL;DR Roundcube shipped versions 1.7.2 and 1.6.17 to fix six security bugs. The headline flaw is a...

Apache Lucene.NET vulnerability advisory showing a Lucene.Net.Replicator path traversal risk

Apache Lucene.NET Vulnerability Trio Fixed in Beta 18

Do Son July 9, 2026

The Apache project patched three Apache Lucene.NET vulnerability issues in the 4.8.0-beta00018 release. Two of the flaws...

Feast Feature Server Flaw Lets Unauthenticated Attackers Write Files Feast Feature Server arbitrary file write vulnerability advisory graphic

Feast Feature Server arbitrary file write vulnerability advisory graphic

Feast Feature Server Flaw Lets Unauthenticated Attackers Write Files

Do Son July 9, 2026

A critical flaw in the Feast Feature Server carries a CVSS score of 9.1. The bug, tracked...

OPNsense Root RCE Flaw CVE-2026-57155 (CVSS 9.9): Details and PoC Publicly Disclosed OPNsense root RCE advisory graphic showing an arbitrary file write chain to root on the firewall

OPNsense root RCE advisory graphic showing an arbitrary file write chain to root on the firewall

OPNsense Root RCE Flaw CVE-2026-57155 (CVSS 9.9): Details and PoC Publicly Disclosed

Do Son July 9, 2026

TL;DR A researcher from Hacking Cult published full technical details and proof-of-concept code for three OPNsense firewall...

Linux kernel privilege escalation CVE-2026-46215 DRM GEM use-after-free root exploit diagram

Linux Kernel Privilege Escalation Flaw CVE-2026-46215: PoC and Full Write-Up Public

Do Son July 9, 2026

TL;DR A researcher has published a full technical write-up and proof-of-concept exploit for a Linux kernel privilege...

MOVEit Transfer Fixes Stored XSS and Two Other Vulnerabilities MOVEit Transfer stored XSS vulnerability CVE-2026-11903 patched in version 2026.0.1

MOVEit Transfer stored XSS vulnerability CVE-2026-11903 patched in version 2026.0.1

MOVEit Transfer Fixes Stored XSS and Two Other Vulnerabilities

Do Son July 9, 2026

TL;DR Progress released a MOVEit Transfer security bulletin on July 8, 2026. It fixes three flaws, and...

Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access Microsoft Defender zero-day RoguePlanet CVE-2026-50656 patched via Malware Protection Engine update

Microsoft Defender zero-day RoguePlanet CVE-2026-50656 patched via Malware Protection Engine update

Microsoft Patches RoguePlanet Defender Zero-Day That Grants SYSTEM Access

Do Son July 9, 2026

TL;DR Microsoft patched a Microsoft Defender zero-day named RoguePlanet, tracked as CVE-2026-50656. The flaw is a race...

HPLIP Vulnerability CVE-2026-14544 (CVSS 9.8) Allows Arbitrary Code Execution HPLIP vulnerability advisory graphic showing CVE-2026-14544 arbitrary code execution via crafted print data

HPLIP vulnerability advisory graphic showing CVE-2026-14544 arbitrary code execution via crafted print data

HPLIP Vulnerability CVE-2026-14544 (CVSS 9.8) Allows Arbitrary Code Execution

Do Son July 9, 2026

TL;DR Red Hat disclosed a critical HPLIP vulnerability, tracked as CVE-2026-14544, with a CVSS score of 9.8....

Critical Alert 1 Active Exploit Detected Today