Vulnerability Report

Public PoC Released for CVE-2026-42980 Windows Privilege Escalation Flaw

• Vulnerability Report

Public PoC Released for CVE-2026-42980 Windows Privilege Escalation Flaw

Do Son July 21, 2026 0

TL;DR A public proof-of-concept now targets CVE-2026-42980, a Windows privilege escalation flaw in the NT kernel. The...

Read More Read more about Public PoC Released for CVE-2026-42980 Windows Privilege Escalation Flaw

Three SQL Injection Flaws Patched in Apache Fineract Core Banking Platform

• Vulnerability Report

Three SQL Injection Flaws Patched in Apache Fineract Core Banking Platform

Do Son July 21, 2026 0

TL;DR Apache has patched three SQL injection flaws in Fineract, the open-source core banking platform. The Apache...

Read More Read more about Three SQL Injection Flaws Patched in Apache Fineract Core Banking Platform

Zimbra 10.1.20 Patches an SNMP Command Injection Flaw and Multiple XSS Bugs

• Vulnerability Report

Zimbra 10.1.20 Patches an SNMP Command Injection Flaw and Multiple XSS Bugs

Do Son July 21, 2026 0

TL;DR Zimbra released Collaboration Suite 10.1.20 on July 20, 2026. The update fixes several Zimbra vulnerabilities, including...

Read More Read more about Zimbra 10.1.20 Patches an SNMP Command Injection Flaw and Multiple XSS Bugs

CVE-2026-50522 SharePoint RCE Flaw Exploited in the Wild With Public PoC Exploit

• Vulnerability Report

CVE-2026-50522 SharePoint RCE Flaw Exploited in the Wild With Public PoC Exploit

Do Son July 21, 2026 0

TL;DR CVE-2026-50522 is a critical SharePoint RCE flaw rated CVSS 9.8. Researchers report active exploitation attempts, and...

Read More Read more about CVE-2026-50522 SharePoint RCE Flaw Exploited in the Wild With Public PoC Exploit

CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials

• Vulnerability Report

CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials

Do Son July 21, 2026 0

TL;DR Apache has patched a critical OpenMeetings vulnerability tracked as CVE-2026-49488. The path traversal flaw grants arbitrary...

Read More Read more about CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials

OVH Patches CVE-2026-53359 KVM Flaw Across a Million VMs

• Vulnerability Report

OVH Patches CVE-2026-53359 KVM Flaw Across a Million VMs

Do Son July 21, 2026 0

European cloud provider OVH just published a candid retrospective on its emergency patch campaign. The post explains...

Read More Read more about OVH Patches CVE-2026-53359 KVM Flaw Across a Million VMs

wp2shell: WordPress Core RCE Exploited in the Wild as Public PoC Code Circulates

• Vulnerability Report

wp2shell: WordPress Core RCE Exploited in the Wild as Public PoC Code Circulates

Do Son July 21, 2026 0

Attackers are already dropping webshells on WordPress sites through a flaw in WordPress Core itself. The bug...

Read More Read more about wp2shell: WordPress Core RCE Exploited in the Wild as Public PoC Code Circulates

CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed

• Vulnerability Report

CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed

Do Son July 20, 2026 0

TL;DR A critical Gitea vulnerability, CVE-2026-58443 (CVSS 9.6), lets a public-only token push commits into a private...

Read More Read more about CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed

Critical Apache Doris Flaw (CVE-2026-58319) Exposes Admin APIs to Unauthenticated Attackers

• Vulnerability Report

Critical Apache Doris Flaw (CVE-2026-58319) Exposes Admin APIs to Unauthenticated Attackers

Do Son July 20, 2026 0

TL;DR The Apache Doris project has patched a critical Apache Doris vulnerability, tracked as CVE-2026-58319. Some Frontend...

Read More Read more about Critical Apache Doris Flaw (CVE-2026-58319) Exposes Admin APIs to Unauthenticated Attackers

CVE-2026-56451: CVSS 10 Siemens Opcenter X Flaw Grants Full Unauthorized Access

• Vulnerability Report

CVE-2026-56451: CVSS 10 Siemens Opcenter X Flaw Grants Full Unauthorized Access

Do Son July 20, 2026 0

TL;DR Siemens has patched a maximum-severity Opcenter X authentication bypass, tracked as CVE-2026-56451. The flaw scores 10.0...

Read More Read more about CVE-2026-56451: CVSS 10 Siemens Opcenter X Flaw Grants Full Unauthorized Access

CVE-2026-52824: Default Docker Secret in Kimai Enables Account Takeover of Super Admin Accounts

• Vulnerability Report

CVE-2026-52824: Default Docker Secret in Kimai Enables Account Takeover of Super Admin Accounts

Do Son July 20, 2026 0

TL;DR A critical Kimai vulnerability, CVE-2026-52824 (CVSS 9.1), affects the open-source time-tracking app’s official Docker image. The...

Read More Read more about CVE-2026-52824: Default Docker Secret in Kimai Enables Account Takeover of Super Admin Accounts

OpenSSL HollowByte Vulnerability Causes Memory Exhaustion

• Vulnerability Report

OpenSSL HollowByte Vulnerability Causes Memory Exhaustion

Do Son July 20, 2026 0

TL;DR The Okta Red Team recently found a severe crash flaw in a core secure library. A...

Read More Read more about OpenSSL HollowByte Vulnerability Causes Memory Exhaustion

Active Exploitation and Public PoC Disclosed for CVE-2026-6875 ServiceNow Sandbox Escape Remote Code Execution

• Vulnerability Report

Active Exploitation and Public PoC Disclosed for CVE-2026-6875 ServiceNow Sandbox Escape Remote Code Execution

Do Son July 18, 2026 0

TL;DR A critical flaw in the ServiceNow AI platform allows unauthenticated users to run arbitrary commands. DefusedCyber...

Read More Read more about Active Exploitation and Public PoC Disclosed for CVE-2026-6875 ServiceNow Sandbox Escape Remote Code Execution

Cloudflare Blocks Critical WordPress wp2shell Vulnerability

• Vulnerability Report

Cloudflare Blocks Critical WordPress wp2shell Vulnerability

Do Son July 18, 2026 0

Network provider Cloudflare recently published a blog post about emergency Web Application Firewall (WAF) rules. These new...

Read More Read more about Cloudflare Blocks Critical WordPress wp2shell Vulnerability

Ubuntu Pro Client Flaw CVE-2026-11386 Allows Arbitrary Code Execution With Root Privileges

• Vulnerability Report

Ubuntu Pro Client Flaw CVE-2026-11386 Allows Arbitrary Code Execution With Root Privileges

Do Son July 18, 2026 0

TL;DR Canonical shipped fixes for CVE-2026-11386 in USN-8555-1 on July 16, 2026. This Ubuntu Pro Client vulnerability...

Read More Read more about Ubuntu Pro Client Flaw CVE-2026-11386 Allows Arbitrary Code Execution With Root Privileges

WordPress Pre-Auth RCE CVE-2026-63030: Vulnerability Details and PoC Exploit Code Now Public

• Vulnerability Report

WordPress Pre-Auth RCE CVE-2026-63030: Vulnerability Details and PoC Exploit Code Now Public

Do Son July 18, 2026 0

TL;DR WordPress shipped 7.0.2 on July 17, 2026 to fix a critical flaw chain. The bug is...

Read More Read more about WordPress Pre-Auth RCE CVE-2026-63030: Vulnerability Details and PoC Exploit Code Now Public

CVE-2026-54523 (CVSS 9.6): Public PoC Exploit Enables Kyverno Privilege Escalation to Admin in Any Namespace

• Vulnerability Report

CVE-2026-54523 (CVSS 9.6): Public PoC Exploit Enables Kyverno Privilege Escalation to Admin in Any Namespace

Do Son July 17, 2026 0

TL;DR A critical Kyverno vulnerability, CVE-2026-54523 (CVSS 9.6), has been publicly disclosed with full technical details and...

Read More Read more about CVE-2026-54523 (CVSS 9.6): Public PoC Exploit Enables Kyverno Privilege Escalation to Admin in Any Namespace

Citrix Secure Access Vulnerability Lets Local Users Gain SYSTEM Privileges

• Vulnerability Report

Citrix Secure Access Vulnerability Lets Local Users Gain SYSTEM Privileges

Do Son July 17, 2026 0

TL;DR Cloud Software Group published bulletin CTX696734 for two flaws in Citrix Windows clients. CVE-2026-53565, a Citrix...

Read More Read more about Citrix Secure Access Vulnerability Lets Local Users Gain SYSTEM Privileges

Chrome Security Update Patches Three Critical Use-After-Free Flaws in CameraCapture, GPU, and Network

• Vulnerability Report

Chrome Security Update Patches Three Critical Use-After-Free Flaws in CameraCapture, GPU, and Network

Do Son July 17, 2026 0

TL;DR Google pushed Chrome 150.0.7871.128/.129 to the Stable channel on July 16, 2026. The release fixes seven...

Read More Read more about Chrome Security Update Patches Three Critical Use-After-Free Flaws in CameraCapture, GPU, and Network

CVE-2026-9770: Information Disclosure Vulnerability Exposes Admin Credentials on TP-Link Kasa Cameras

• Vulnerability Report

CVE-2026-9770: Information Disclosure Vulnerability Exposes Admin Credentials on TP-Link Kasa Cameras

Do Son July 17, 2026 0

TL;DR TP-Link has patched two information disclosure flaws in Kasa EC70 v4 and EC71 v4 cameras. The...

Read More Read more about CVE-2026-9770: Information Disclosure Vulnerability Exposes Admin Credentials on TP-Link Kasa Cameras

CISA Adds FortiSandbox and SharePoint Flaws to KEV Catalog After Confirming Active Exploitation

• Vulnerability Report

CISA Adds FortiSandbox and SharePoint Flaws to KEV Catalog After Confirming Active Exploitation

Do Son July 17, 2026 0

TL;DR CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on July 16, 2026. Two affect...

Read More Read more about CISA Adds FortiSandbox and SharePoint Flaws to KEV Catalog After Confirming Active Exploitation

7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution Through Crafted XZ Data

• Vulnerability Report

7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution Through Crafted XZ Data

Do Son July 16, 2026 0

TL;DR The Zero Day Initiative published advisory ZDI-26-444 on July 15, 2026. It covers a 7-Zip vulnerability...

Read More Read more about 7-Zip Vulnerability CVE-2026-14266 Allows Remote Code Execution Through Crafted XZ Data