CVE-2026-39364

Vite Flaw CVE-2026-39364 Exploited to Steal Cloud Keys Vite development server vulnerability CVE-2026-39364 exploited in mass scanning to steal exposed cloud credentials and env files

Vite Flaw CVE-2026-39364 Exploited to Steal Cloud Keys

Do Son September 15, 2026

TL;DR Attackers are mass-scanning the internet for exposed Vite development servers. They abuse the Vite development server...

Frontend Secrets Exposed: Vite Patches Critical Security Bypass in Dev Server Vite Vulnerability Arbitrary File Read

Frontend Secrets Exposed: Vite Patches Critical Security Bypass in Dev Server

Do Son April 9, 2026

Vite has become the “speed demon” of modern frontend development, prized for its lightning-fast Hot Module Replacement...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-86950CVSS 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and...
Admin intel📅 Updated: Sep 29, 2026
CVE-2026-88772
Memory overflow vulnerability leading to remote code execution or denial of service.
Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
CVE-2026-88771
Remote code execution due to improper input validation that can allow an unauthenticated attacker to execute arbitrary commands.
Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
CVE-2026-65660CVSS 8.8
Improper control of generation of code (\'code injection\') in Microsoft Office SharePoint allows an authorized attacker to execute...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 25, 2026
CVE-2026-5430CVSS 10.0
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-71362CVSS 9.1
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-87902
Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 23, 2026

CVE-2026-97359CVSS 10.0
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated...
📅 Updated: Sep 29, 2026
CVE-2026-67231CVSS 9.1
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store...
📅 Updated: Sep 29, 2026
CVE-2026-67404CVSS 9.2
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no...
📅 Updated: Sep 29, 2026
CVE-2026-96759CVSS 9.3
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options...
📅 Updated: Sep 29, 2026
CVE-2026-96754CVSS 9.3
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI...
📅 Updated: Sep 29, 2026
CVE-2026-102240CVSS 10.0
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of...
📅 Updated: Sep 29, 2026
CVE-2026-101354CVSS 9.4
A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of...
📅 Updated: Sep 29, 2026
CVE-2026-102361CVSS 9.3
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to...
📅 Updated: Sep 28, 2026