Vulnerability Report

Red Hat ACM Fixes Five Critical Flaws, Including CVE-2026-72526 RCE Bug (CVSS 9.9)

• Vulnerability Report

Red Hat ACM Fixes Five Critical Flaws, Including CVE-2026-72526 RCE Bug (CVSS 9.9)

Do Son August 17, 2026 0

Red Hat patched five critical bugs in Advanced Cluster Management this week. Two of them allow RHACM...

Read More Read more about Red Hat ACM Fixes Five Critical Flaws, Including CVE-2026-72526 RCE Bug (CVSS 9.9)

CVE-2026-19188: Haiwell HMI Gateway Flaw Lets Attackers Execute Arbitrary OS Commands With Root Privileges (CVSS 10.0)

• Vulnerability Report

CVE-2026-19188: Haiwell HMI Gateway Flaw Lets Attackers Execute Arbitrary OS Commands With Root Privileges (CVSS 10.0)

Do Son August 17, 2026 0

TL;DR A critical Haiwell HMI Gateway flaw threatens industrial control systems worldwide. Specifically, this vulnerability allows unauthenticated...

Read More Read more about CVE-2026-19188: Haiwell HMI Gateway Flaw Lets Attackers Execute Arbitrary OS Commands With Root Privileges (CVSS 10.0)

Linux AF_PACKET Race (03390aa): PoC Exploit Enables Local Privilege Escalation

• Vulnerability Report

Linux AF_PACKET Race (03390aa): PoC Exploit Enables Local Privilege Escalation

Do Son August 17, 2026 0

TL;DR A researcher published a proof-of-concept exploit for a Linux kernel AF_PACKET race condition. The flaw enables...

Read More Read more about Linux AF_PACKET Race (03390aa): PoC Exploit Enables Local Privilege Escalation

Citrix NetScaler Pre-Auth RCE CVE-2026-8452 Gets Public Exploit Code

• Vulnerability Report

Citrix NetScaler Pre-Auth RCE CVE-2026-8452 Gets Public Exploit Code

Do Son August 17, 2026 0

Researchers at watchTowr published a working exploit for a Citrix NetScaler RCE flaw this week. The bug,...

Read More Read more about Citrix NetScaler Pre-Auth RCE CVE-2026-8452 Gets Public Exploit Code

Apache Struts Patches Five Flaws Including Unauthenticated DoS Bugs

• Vulnerability Report

Apache Struts Patches Five Flaws Including Unauthenticated DoS Bugs

Do Son August 15, 2026 0

Apache patched five bugs in Struts 2 this week. Three of them count as Apache Struts DoS...

Read More Read more about Apache Struts Patches Five Flaws Including Unauthenticated DoS Bugs

Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3

• Vulnerability Report

Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3

Do Son August 15, 2026 0

Roundcube shipped two security updates this week. Also, versions 1.6.18 and 1.7.3 close eleven separate bugs. The...

Read More Read more about Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3

CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)

• Vulnerability Report

CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)

Do Son August 15, 2026 0

TL;DR: A critical User Profile Builder vulnerability, carrying a maximum CVSS score of 9.8 and tracked as...

Read More Read more about CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)

CVE-2025-41771: SQL Injection Flaw Hits Phoenix Contact PLCnext

• Vulnerability Report

CVE-2025-41771: SQL Injection Flaw Hits Phoenix Contact PLCnext

Do Son August 14, 2026 0

TL;DR Phoenix Contact disclosed three vulnerabilities in PLCnext firmware on August 12, 2026. One flaw, CVE-2025-41771, lets...

Read More Read more about CVE-2025-41771: SQL Injection Flaw Hits Phoenix Contact PLCnext

CVE-2026-68067 (CVSS 9.8): Mira Monitor Flaw Lets Attackers Control User Accounts

• Vulnerability Report

CVE-2026-68067 (CVSS 9.8): Mira Monitor Flaw Lets Attackers Control User Accounts

Do Son August 14, 2026 0

TL;DR CISA disclosed eight vulnerabilities in the Mira Hormone Monitor and its Android app. The worst, CVE-2026-68067,...

Read More Read more about CVE-2026-68067 (CVSS 9.8): Mira Monitor Flaw Lets Attackers Control User Accounts

TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices

• Vulnerability Report

TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices

Do Son August 14, 2026 0

TL;DR TP-Link disclosed five vulnerabilities across its ISP-managed networking gear. The flaws hit mesh systems, routers, PON...

Read More Read more about TP-Link Patches 5 Flaws in ISP-Managed Routers and Mesh Devices

CVE-2026-64582: PoC Exploit Published for Kernel LPE

• Vulnerability Report

CVE-2026-64582: PoC Exploit Published for Kernel LPE

Do Son August 14, 2026 0

TL;DR A researcher published full technical details and working proof-of-concept exploit code for CVE-2026-64582. The flaw is...

Read More Read more about CVE-2026-64582: PoC Exploit Published for Kernel LPE

CVE-2026-63455: EdgeConnect Orchestrator Web Authentication Bypass Rated CVSS 9.8

• Vulnerability Report

CVE-2026-63455: EdgeConnect Orchestrator Web Authentication Bypass Rated CVSS 9.8

Do Son August 13, 2026 0

TL;DR HPE Aruba Networking patched two critical flaws in its SD-WAN EdgeConnect Orchestrator. Both carry a CVSS...

Read More Read more about CVE-2026-63455: EdgeConnect Orchestrator Web Authentication Bypass Rated CVSS 9.8

CVE-2026-43723: Apple mediaremoted Flaw Lets Apps Gain Root Privileges, PoC Exploit Code Publicly Disclosed

• Vulnerability Report

CVE-2026-43723: Apple mediaremoted Flaw Lets Apps Gain Root Privileges, PoC Exploit Code Publicly Disclosed

Do Son August 13, 2026 0

TL;DR Apple patched a flaw that let a local app gain root privileges through the mediaremoted service....

Read More Read more about CVE-2026-43723: Apple mediaremoted Flaw Lets Apps Gain Root Privileges, PoC Exploit Code Publicly Disclosed

Zero-Click File Drop Hits Xiaomi ShareMe: PoC Public

• Vulnerability Report

Zero-Click File Drop Hits Xiaomi ShareMe: PoC Public

Do Son August 13, 2026 0

TL;DR A researcher at ByteriaLab found a zero-click flaw in Xiaomi ShareMe, also shipped as MiDrop. An...

Read More Read more about Zero-Click File Drop Hits Xiaomi ShareMe: PoC Public

CVE-2026-65640: WordPress 7.0.4 Fixes Remote Code Execution

• Vulnerability Report

CVE-2026-65640: WordPress 7.0.4 Fixes Remote Code Execution

Do Son August 13, 2026 0

TL;DR WordPress released version 7.0.4 on August 12, 2026, as a security-only update. It fixes CVE-2026-65640, an...

Read More Read more about CVE-2026-65640: WordPress 7.0.4 Fixes Remote Code Execution

MariaDB Low-Privilege Remote Code Execution Chain: Full Details and PoC Exploit Code Publicly Disclosed

• Vulnerability Report

MariaDB Low-Privilege Remote Code Execution Chain: Full Details and PoC Exploit Code Publicly Disclosed

Do Son August 13, 2026 0

TL;DR Researchers at V12 Security published a MariaDB remote code execution chain. It runs commands as the...

Read More Read more about MariaDB Low-Privilege Remote Code Execution Chain: Full Details and PoC Exploit Code Publicly Disclosed

GitLab Patch Release Fixes 13 Flaws, Including High-Severity XSS Bugs

• Vulnerability Report

GitLab Patch Release Fixes 13 Flaws, Including High-Severity XSS Bugs

Do Son August 12, 2026 0

TL;DR GitLab shipped a new patch release on August 12, 2026. Versions 19.2.2, 19.1.4, and 19.0.6 fix...

Read More Read more about GitLab Patch Release Fixes 13 Flaws, Including High-Severity XSS Bugs

CVE-2026-67261: Dell VSI RCE Flaw Scores CVSS 9.8

• Vulnerability Report

CVE-2026-67261: Dell VSI RCE Flaw Scores CVSS 9.8

Do Son August 12, 2026 0

TL;DR Dell patched two critical flaws in Virtual Storage Integrator (VSI) for VMware vSphere Client. The worst,...

Read More Read more about CVE-2026-67261: Dell VSI RCE Flaw Scores CVSS 9.8

CVE-2026-71319: Nuxt DevTools Flaw With 7.3 Million Monthly Downloads Allows Arbitrary Command Execution, CVSS 9.6

• Vulnerability Report

CVE-2026-71319: Nuxt DevTools Flaw With 7.3 Million Monthly Downloads Allows Arbitrary Command Execution, CVSS 9.6

Do Son August 12, 2026 0

TL;DR A critical Nuxt DevTools vulnerability lets an attacker run arbitrary commands on a developer’s machine. Tracked...

Read More Read more about CVE-2026-71319: Nuxt DevTools Flaw With 7.3 Million Monthly Downloads Allows Arbitrary Command Execution, CVSS 9.6

CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed

• Vulnerability Report

CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed

Do Son August 12, 2026 0

TL;DR Two critical Puwell IP Camera vulnerabilities now have public details and proof-of-concept exploit code. Both score...

Read More Read more about CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed

CVE-2026-58115: CVSS 10 Node-RED RCE Hits SIMATIC IoT2050

• Vulnerability Report

CVE-2026-58115: CVSS 10 Node-RED RCE Hits SIMATIC IoT2050

Do Son August 12, 2026 0

TL;DR Siemens has disclosed CVE-2026-58115, a maximum-severity flaw in SIMATIC IoT2050 Advanced devices. The bug scores a...

Read More Read more about CVE-2026-58115: CVSS 10 Node-RED RCE Hits SIMATIC IoT2050

CVE-2026-55040 PoC Released for SharePoint Authentication Bypass

• Vulnerability Report

CVE-2026-55040 PoC Released for SharePoint Authentication Bypass

Do Son August 12, 2026 0

TL;DR Rapid7 has published a technical analysis and a working proof-of-concept for CVE-2026-55040. The flaw is a...

Read More Read more about CVE-2026-55040 PoC Released for SharePoint Authentication Bypass