no patch Archives • Daily CyberSecurity

Academic Exposure: The Unpatched Flaw Siphoning Student Data from DRC INSIGHT

Fortra BoKS vulnerability OS command injection, CVE-2026-9862 Altium Enterprise Server Vulnerability CVE-2026-9129 Path Traversal Patreon OAuth Vulnerability Identity Collision DRC INSIGHT Vulnerability Exam Data Hijacking Horner Automation PLC Industrial Brute Force Honeywell IQ4x Vulnerability CVE-2026-3611 DJI Romo vacuum security flaw Python Cryptography Vulnerability CVE-2026-26007 Open5GS Vulnerability CVE-2026-0622 Vivotek IP7137 Vulnerabilities CVE-2025-66049 Forcepoint DLP Vulnerability CVE-2025-14026 Cellopoint Secure Email Gateway - CVE-2024-9043

Academic Exposure: The Unpatched Flaw Siphoning Student Data from DRC INSIGHT

Do Son April 24, 2026

Unpatched CVE-2026-5756 in DRC INSIGHT allows unauthenticated hijacking of student exam responses and traffic manipulation. Secure your school's network now.

Unpatched and Exposed: Public PoC Released for Critical 9.8 CVSS Xiongmai IP Camera Flaw KMW CCTV vulnerability unauthenticated password reset Xiongmai IP Camera Vulnerability CVE-2025-65856 CVE-2024-8956 (CVSS 9.1): PTZOptics Cameras

KMW CCTV vulnerability unauthenticated password reset Xiongmai IP Camera Vulnerability CVE-2025-65856 CVE-2024-8956 (CVSS 9.1): PTZOptics Cameras

Unpatched and Exposed: Public PoC Released for Critical 9.8 CVSS Xiongmai IP Camera Flaw

Do Son April 24, 2026

Critical 9.8 CVSS auth bypass hits Xiongmai IP cameras. Public PoC is live with NO patch available. Secure your live feeds and isolate your devices now!

Security Alert: Critical Vulnerability Hits Anritsu Remote Spectrum Monitors Ollama Heap Leak CVE-2026-5757 Anritsu Vulnerability Authentication Bypass Gootloader Malware Malformed ZIP Evasion Blender Malware, StealC V2 Lectora, XSS CVE-2025-9125 HFS RCE, Template Injection Arch Linux Malware, CHAOS RAT CVE-2024-56404 - CVE-2024-39327 CVE-2025-2538

Ollama Heap Leak CVE-2026-5757 Anritsu Vulnerability Authentication Bypass Gootloader Malware Malformed ZIP Evasion Blender Malware, StealC V2 Lectora, XSS CVE-2025-9125 HFS RCE, Template Injection Arch Linux Malware, CHAOS RAT CVE-2024-56404 - CVE-2024-39327 CVE-2025-2538

Security Alert: Critical Vulnerability Hits Anritsu Remote Spectrum Monitors

Do Son April 2, 2026

CISA alerts to a 9.8 CVSS flaw in Anritsu Spectrum Monitors (CVE-2026-3356). No patch is coming for this authentication bypass. Secure your network now!

CVSS 9.8: Backend.AI Critical Flaw Allows Account Takeover via PoC, No Patch Available Backend.AI Vulnerability

CVSS 9.8: Backend.AI Critical Flaw Allows Account Takeover via PoC, No Patch Available

Do Son June 11, 2025

A critical CVSS 9.8 flaw (CVE-2025-49653) in Backend.AI allows account takeover via PoC, impacting all versions. Vendor has not issued a patch.

Industrial Systems at Risk: Critical Mitsubishi MELSEC Flaw (CVSS 9.1), No Patch Mitsubishi MELSEC vulnerability Industrial control system DoS

Industrial Systems at Risk: Critical Mitsubishi MELSEC Flaw (CVSS 9.1), No Patch

Do Son May 29, 2025

A critical Mitsubishi MELSEC iQ-F Series CPU module flaw allows remote DoS and info leak. No software patch available.

Tenda Router Flaw (CVSS 9.8): Unauthenticated RCE Flaw (PoC, No Patch) CVE-2023-4498

Tenda Router Flaw (CVSS 9.8): Unauthenticated RCE Flaw (PoC, No Patch)

Do Son May 29, 2025

A critical Tenda W18Ev2 router flaw allows unauthenticated RCE via admin password change. PoC available, no patch yet.

Unpatched & Critical (CVSS 10): TI WooCommerce Wishlist Vulnerability Affects 100K+ Sites

WooCommerce Wishlist vulnerability CVE-2025-47577

Unpatched & Critical (CVSS 10): TI WooCommerce Wishlist Vulnerability Affects 100K+ Sites

Do Son May 27, 2025

Critical (CVSS 10) unpatched flaw in TI WooCommerce Wishlist allows unauthenticated RCE via file upload. Affects 100K+ sites.

Windows Server 2025 “BadSuccessor” Flaw Allows Domain Takeover (PoC Available, No Patch) poc-windser

Windows Server 2025 “BadSuccessor” Flaw Allows Domain Takeover (PoC Available, No Patch)

Do Son May 27, 2025

Exploit BadSuccessor to take over domains with PoC code. No patch, full AD compromise via dMSAs in Windows Server 2025.