Vulnerability Report Archives • Page 28 of 119 • Daily CyberSecurity

TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution TeamCity RCE vulnerability CVE-2026-63077 in TeamCity On-Premises rated CVSS 9.8

TeamCity RCE vulnerability CVE-2026-63077 in TeamCity On-Premises rated CVSS 9.8

TeamCity RCE Flaw CVE-2026-63077 (CVSS 9.8) Enables Unauthenticated Command Execution

Do Son July 28, 2026

TL;DR JetBrains patched a critical TeamCity RCE tracked as CVE-2026-63077. The flaw scores a CVSS of 9.8...

CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released CVE-2026-42533 NGINX heap overflow proof-of-concept enabling an ASLR bypass and RCE

CVE-2026-42533 NGINX heap overflow proof-of-concept enabling an ASLR bypass and RCE

CVE-2026-42533: NGINX Heap Overflow Enables RCE and ASLR Bypass, Public PoC Released

Do Son July 28, 2026

TL;DR: A public proof-of-concept now targets CVE-2026-42533, an NGINX heap overflow rated CVSS 9.2. The bug lets...

Fraggap Linux kernel vulnerability CVE-2026-53362 enabling local privilege escalation through a UDPv6 out-of-bounds write

Fraggap Linux Kernel Vulnerability: Full Details and PoC Exploit Code Now Public

Do Son July 28, 2026

A researcher has published full technical details and working proof-of-concept code for a Linux kernel vulnerability named...

OVSwrap local root vulnerability CVE-2026-64531 in the Linux kernel Open vSwitch datapath

OVSwrap Local Root Vulnerability (CVE-2026-64531): Exploit Details and PoC Publicly Disclosed

Do Son July 28, 2026

TL;DR The OVSwrap local root flaw lets an unprivileged user gain root on many Linux systems. It...

libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory libssh2 vulnerabilities let a malicious SSH server corrupt heap memory in SSH and SFTP clients

libssh2 vulnerabilities let a malicious SSH server corrupt heap memory in SSH and SFTP clients

libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory

Do Son July 28, 2026

TL;DR Four new libssh2 vulnerabilities put SSH and SFTP clients at risk. Each one lets a malicious...

Kemp LoadMaster vulnerabilities warning covering OS command injection and privilege escalation flaws

Progress Patches Five Kemp LoadMaster Vulnerabilities

Do Son July 28, 2026

TL;DR Progress fixed five Kemp LoadMaster vulnerabilities in a July 2026 bulletin. Three allow OS command injection,...

Apache ActiveMQ Patches Authorization Bypass and DoS Flaws Apache ActiveMQ vulnerability alert covering authorization bypass and AMQP denial-of-service flaws

Apache ActiveMQ vulnerability alert covering authorization bypass and AMQP denial-of-service flaws

Apache ActiveMQ Patches Authorization Bypass and DoS Flaws

Do Son July 28, 2026

TL;DR The Apache Software Foundation fixed two Apache ActiveMQ vulnerabilities. One lets a low-privilege user bypass write...

CISA KEV Additions: Arista VeloCloud and FortiOS Flaws Now Exploited CISA KEV additions listing two known exploited vulnerabilities in Arista VeloCloud and FortiOS

CISA KEV additions listing two known exploited vulnerabilities in Arista VeloCloud and FortiOS

CISA KEV Additions: Arista VeloCloud and FortiOS Flaws Now Exploited

Do Son July 27, 2026

TL;DR: On July 27, 2026, CISA made two KEV additions. Both are known exploited vulnerabilities. One is...

CVE-2026-16812: VeloCloud Orchestrator OS Command Injection (CVSS 10) Exploited in the Wild CVE-2026-16812 VeloCloud command injection exploited in the wild affecting VeloCloud Orchestrator

CVE-2026-16812 VeloCloud command injection exploited in the wild affecting VeloCloud Orchestrator

CVE-2026-16812: VeloCloud Orchestrator OS Command Injection (CVSS 10) Exploited in the Wild

Do Son July 27, 2026

TL;DR: Arista confirmed that CVE-2026-16812, a VeloCloud command injection flaw, is under active attack. The bug scores...

Plane authorization bypass CVE-2026-15342 exposing multi-tenant workspace assets

Unpatched Plane Authorization Bypass CVE-2026-15342 Exposes Other Workspaces

Do Son July 27, 2026

TL;DR CERT/CC published an advisory on July 21, 2026 for a Plane authorization bypass. Tracked as CVE-2026-15342,...

Apache Fory Patches Four Deserialization Flaws Across Java, C++, and Rust Apache Fory vulnerabilities in Java, C++, and Rust deserialization fixed in version 1.4.0

Apache Fory vulnerabilities in Java, C++, and Rust deserialization fixed in version 1.4.0

Apache Fory Patches Four Deserialization Flaws Across Java, C++, and Rust

Do Son July 27, 2026

TL;DR The Apache Fory project disclosed four vulnerabilities on July 21, 2026. Three carry an important rating,...

CVE-2026-61511: vBulletin Preauth RCE with Public PoC Disclosed CVE-2026-61511 vBulletin preauth RCE proof-of-concept abusing the runMaths eval for remote code execution

CVE-2026-61511 vBulletin preauth RCE proof-of-concept abusing the runMaths eval for remote code execution

CVE-2026-61511: vBulletin Preauth RCE with Public PoC Disclosed

Do Son July 27, 2026

TL;DR: A public proof-of-concept now targets CVE-2026-61511, a vBulletin preauth RCE. The bug lets an unauthenticated attacker...

CVE-2026-49176 Windows WalletService elevation of privilege exploit escalating to SYSTEM

CVE-2026-49176 Windows WalletService Elevation of Privilege Flaw Gets Public PoC Exploit

Do Son July 27, 2026

TL;DR CVE-2026-49176 is an elevation of privilege flaw in Windows WalletService. It lets a standard user gain...

FastJson RCE CVE-2026-16723 Exploited in the Wild as Details and PoC Exploit Code Go Public FastJson RCE vulnerability CVE-2026-16723 remote code execution attacks by industry pie chart across financial services and healthcare

FastJson RCE vulnerability CVE-2026-16723 remote code execution attacks by industry pie chart across financial services and healthcare

FastJson RCE CVE-2026-16723 Exploited in the Wild as Details and PoC Exploit Code Go Public

Do Son July 25, 2026

TL;DR A critical FastJson RCE vulnerability, CVE-2026-16723, carries a CVSS score of 9.0. Full technical details and...

CVE-2026-50454: Public PoC Shows Windows AppResolver Elevation of Privilege to SYSTEM Windows AppResolver LPE CVE-2026-50454 UAC bypass chain to a SYSTEM shell and Elevation of Privilege

Windows AppResolver LPE CVE-2026-50454 UAC bypass chain to a SYSTEM shell and Elevation of Privilege

CVE-2026-50454: Public PoC Shows Windows AppResolver Elevation of Privilege to SYSTEM

Do Son July 24, 2026

TL;DR A researcher has published a write-up and proof-of-concept code for the Windows AppResolver LPE. The chain...

Konnectivity Vulnerability Lets Unauthenticated Attackers Intercept Control-Plane Traffic Konnectivity vulnerability CVE-2026-16242 letting an unauthenticated agent join the routing pool and intercept control-plane traffic

Konnectivity vulnerability CVE-2026-16242 letting an unauthenticated agent join the routing pool and intercept control-plane traffic

Konnectivity Vulnerability Lets Unauthenticated Attackers Intercept Control-Plane Traffic

Do Son July 24, 2026

A critical Konnectivity vulnerability lets a remote attacker slip into a cluster without any credentials. Tracked as...

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8 Tycon authentication bypass CVE-2026-61884 in TPDIN-Monitor-WEB2 rated CVSS 9.8

Tycon authentication bypass CVE-2026-61884 in TPDIN-Monitor-WEB2 rated CVSS 9.8

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8

Do Son July 24, 2026

TL;DR CISA published advisory ICSA-26-202-01 on July 21, 2026. It covers a critical Tycon authentication bypass in...

ADAudit Plus Flaw CVE-2026-6516 Allows Unauthenticated Remote Code Execution at CVSS 10 ADAudit Plus vulnerability CVE-2026-6516 enabling unauthenticated remote code execution on Active Directory audit servers

ADAudit Plus vulnerability CVE-2026-6516 enabling unauthenticated remote code execution on Active Directory audit servers

ADAudit Plus Flaw CVE-2026-6516 Allows Unauthenticated Remote Code Execution at CVSS 10

Do Son July 24, 2026

TL;DR ManageEngine patched a critical ADAudit Plus vulnerability tracked as CVE-2026-6516. Two weaknesses in the product’s Agent...

Public Exploit Code Released for Knot Resolver DNS-over-QUIC Remote Code Execution Flaw Knot Resolver RCE through a DNS-over-QUIC heap overflow with publicly disclosed PoC exploit code

Knot Resolver RCE through a DNS-over-QUIC heap overflow with publicly disclosed PoC exploit code

Public Exploit Code Released for Knot Resolver DNS-over-QUIC Remote Code Execution Flaw

Do Son July 24, 2026

TL;DR A researcher published full technical details and working proof-of-concept exploit code for a Knot Resolver RCE...

CERT/CC Warns of Six Logto Vulnerabilities in SSO and MFA Handling Logto vulnerabilities enabling SSO authentication bypass across OIDC, OAuth 2.1, and SAML sign-in flows

Logto vulnerabilities enabling SSO authentication bypass across OIDC, OAuth 2.1, and SAML sign-in flows

CERT/CC Warns of Six Logto Vulnerabilities in SSO and MFA Handling

Do Son July 24, 2026

TL;DR CERT/CC published vulnerability note VU#492466 on 23 July 2026, covering six flaws in the Logto identity...

Google Ships Chrome 150 Update Fixing Four High-Severity Memory Bugs Chrome security update patching a Codecs sandbox escape and use-after-free flaws in Chrome 150

Chrome security update patching a Codecs sandbox escape and use-after-free flaws in Chrome 150

Google Ships Chrome 150 Update Fixing Four High-Severity Memory Bugs

Do Son July 24, 2026

TL;DR Google pushed Chrome 150.0.7871.186/.187 to the Stable channel on 23 July 2026. This Chrome security update...

HTTP/2 DoS Vulnerability Lets Attackers Exhaust Server Memory via Stalled Flow Control HTTP/2 DoS vulnerability caused by stalled flow control exhausting server memory across multiple HTTP/2 implementations

HTTP/2 DoS vulnerability caused by stalled flow control exhausting server memory across multiple HTTP/2 implementations

HTTP/2 DoS Vulnerability Lets Attackers Exhaust Server Memory via Stalled Flow Control

Do Son July 23, 2026

A newly disclosed HTTP/2 DoS vulnerability affects several server implementations at once. A remote, unauthenticated attacker can...