Unauthenticated Attack Archives • Daily CyberSecurity

Metabase SQL Injection Zero-Day (CVSS 10) Exploited

Metabase SQL injection zero-day vulnerability CVSS 10 exploited in the wild unauthenticated admin access advisory

Metabase SQL Injection Zero-Day (CVSS 10) Exploited

Do Son August 8, 2026

A critical Metabase SQL injection zero-day (CVSS 10) is exploited in the wild. Unauthenticated attackers gain admin access. Patch now.

PeopleSoft RCE Security Bug: New Oracle Fix PeopleSoft RCE security bug, unauthenticated HTTP exploit, CVE-2026-35273 Oracle security patch updates critical software vulnerabilities

PeopleSoft RCE security bug, unauthenticated HTTP exploit, CVE-2026-35273 Oracle security patch updates critical software vulnerabilities

PeopleSoft RCE Security Bug: New Oracle Fix

Do Son June 11, 2026

A critical PeopleSoft RCE security bug allows an unauthenticated HTTP exploit to execute code. Learn how to patch CVE-2026-35273 immediately.

MongoDB Flaw Allows Unauthenticated Attackers to Crash Database Servers MongoDB Vulnerability CVE-2026-25611 MongoDB zlib vulnerability, CVE-2025-14847 MongoDB Vulnerabilities, Data Access CVE-2024-6376 CVE-2025-0755

MongoDB Vulnerability CVE-2026-25611 MongoDB zlib vulnerability, CVE-2025-14847 MongoDB Vulnerabilities, Data Access CVE-2024-6376 CVE-2025-0755

MongoDB Flaw Allows Unauthenticated Attackers to Crash Database Servers

Do Son February 12, 2026

MongoDB patches high-severity flaw CVE-2026-25611. Unauthenticated attackers can crash servers via memory exhaustion. Update to v8.2.4 or v8.0.18 now.

Critical ACF Extended Flaw (CVE-2025-13486, CVSS 9.8) Allows Unauthenticated RCE on 100K WordPress Sites ACF Extended RCE, Unauthenticated Code Execution

ACF Extended RCE, Unauthenticated Code Execution

Critical ACF Extended Flaw (CVE-2025-13486, CVSS 9.8) Allows Unauthenticated RCE on 100K WordPress Sites

Do Son December 3, 2025

A Critical (CVSS 9.8) RCE flaw in ACF Extended allows unauthenticated attackers to run arbitrary code via the prepare_form function, risking 100K+ WordPress sites. Update to v0.9.2.

CISA Warns: Critical Longwatch RCE Flaw (CVE-2025-13658, CVSS 9.8) Allows Unauthenticated SYSTEM Takeover of OT Surveillance Longwatch Unauthenticated RCE, Industrial Video & Control

Longwatch Unauthenticated RCE, Industrial Video & Control

CISA Warns: Critical Longwatch RCE Flaw (CVE-2025-13658, CVSS 9.8) Allows Unauthenticated SYSTEM Takeover of OT Surveillance

Do Son December 3, 2025

CISA warned of a Critical RCE flaw (CVE-2025-13658, CVSS 9.8) in Longwatch video surveillance. Unauthenticated attackers can execute arbitrary code with SYSTEM privileges on OT environments. Update to v6.335.

Critical Elementor Plugin Flaw (CVE-2025-8489, CVSS 9.8) Under Active Exploitation Allows Unauthenticated Admin Takeover Elementor Unauthenticated EoP, CVE-2025-8489 Exploitation WordPress Privilege Escalation, WP Freeio WordPress backdoor Jupiter X Core - CVE-2024-7781 & CVE-2024-7782

Elementor Unauthenticated EoP, CVE-2025-8489 Exploitation WordPress Privilege Escalation, WP Freeio WordPress backdoor Jupiter X Core - CVE-2024-7781 & CVE-2024-7782

Critical Elementor Plugin Flaw (CVE-2025-8489, CVSS 9.8) Under Active Exploitation Allows Unauthenticated Admin Takeover

Do Son December 3, 2025

A Critical (CVSS 9.8) flaw (CVE-2025-8489) in King Addons for Elementor is actively exploited. The bug allows unauthenticated attackers to register as administrators by injecting user_role. 48,400+ attacks blocked.

URGENT PATCH REQUIRED: Zenitel TCIV-3+ Intercoms Hit by Multiple Critical Flaws (CVSS 9.8) Gardyn Home Kit Vulnerabilities IoT Command Injection Vivotek Vulnerability CVE-2026-22755 Command Injection Ofuji Fishing data breach

Gardyn Home Kit Vulnerabilities IoT Command Injection Vivotek Vulnerability CVE-2026-22755 Command Injection Ofuji Fishing data breach

URGENT PATCH REQUIRED: Zenitel TCIV-3+ Intercoms Hit by Multiple Critical Flaws (CVSS 9.8)

Do Son November 26, 2025

Zenitel TCIV-3+ intercoms face critical, unauthenticated command injection and XSS flaws (CVSS 9.8). Update to v9.3.3.0 immediately to patch.

Critical W3 Total Cache Flaw (CVE-2025-9501, CVSS 9.0) Risks Unauthenticated RCE on 1 Million WordPress Sites W3 Total Cache RCE, Unauthenticated Command Injection

W3 Total Cache RCE, Unauthenticated Command Injection

Critical W3 Total Cache Flaw (CVE-2025-9501, CVSS 9.0) Risks Unauthenticated RCE on 1 Million WordPress Sites

Do Son November 18, 2025

A Critical (CVSS 9.0) flaw in W3 Total Cache (CVE-2025-9501) allows unauthenticated attackers to execute arbitrary PHP code via a crafted comment. 1M+ sites are at risk. Update to v2.8.13.

Critical WordPress Plugin Flaw (CVE-2025-8489, CVSS 9.8) Allows Unauthenticated Admin Takeover CVE-2024-11972 - Hunk Companion

Critical WordPress Plugin Flaw (CVE-2025-8489, CVSS 9.8) Allows Unauthenticated Admin Takeover

Do Son November 1, 2025

A critical security vulnerability has been identified and is being actively exploited in the King Addons for...

Critical WordPress RCE Flaws Resurface: Over 8.7 Million Attacks Exploit GutenKit & Hunk Companion

Do Son October 25, 2025

Wordfence warned of a massive RCE campaign (8.7M+ attacks) exploiting flaws in GutenKit/Hunk Companion plugins. Unauthenticated attackers can install malicious plugins via vulnerable REST API endpoints.