unauthenticated RCE Archives • Daily CyberSecurity

Australia Warns of Hackers Exploiting TeamCity Flaw, PoC Public TeamCity CVE-2026-63077 unauthenticated remote code execution vulnerability exploited in the wild with public proof-of-concept

TeamCity CVE-2026-63077 unauthenticated remote code execution vulnerability exploited in the wild with public proof-of-concept

Australia Warns of Hackers Exploiting TeamCity Flaw, PoC Public

Do Son August 24, 2026

Attackers are actively targeting JetBrains TeamCity servers in the wild. The TeamCity CVE-2026-63077 vulnerability allows unauthenticated remote...

SGLang Hit by Six Vulnerabilities, Including Unauthenticated RCE (CVE-2026-15969) SGLang vulnerabilities unauthenticated remote code execution CVE-2026-15969

SGLang vulnerabilities unauthenticated remote code execution CVE-2026-15969

SGLang Hit by Six Vulnerabilities, Including Unauthenticated RCE (CVE-2026-15969)

Do Son August 5, 2026

TL;DR A researcher found six SGLang vulnerabilities, and the worst allow unauthenticated remote code execution. SGLang serves...

TP-Link TL-WR940N CVE-2026-12935 Allows Unauthenticated Remote Code Execution TP-Link TL-WR940N flaw CVE-2026-12935 unauthenticated remote code execution via RTSP stack buffer overflow

TP-Link TL-WR940N flaw CVE-2026-12935 unauthenticated remote code execution via RTSP stack buffer overflow

TP-Link TL-WR940N CVE-2026-12935 Allows Unauthenticated Remote Code Execution

Do Son August 3, 2026

TL;DR TP-Link patched a serious TP-Link TL-WR940N flaw, CVE-2026-12935. The bug allows unauthenticated remote code execution on...

ADAudit Plus Flaw CVE-2026-6516 Allows Unauthenticated Remote Code Execution at CVSS 10 ADAudit Plus vulnerability CVE-2026-6516 enabling unauthenticated remote code execution on Active Directory audit servers

ADAudit Plus vulnerability CVE-2026-6516 enabling unauthenticated remote code execution on Active Directory audit servers

ADAudit Plus Flaw CVE-2026-6516 Allows Unauthenticated Remote Code Execution at CVSS 10

Do Son July 24, 2026

TL;DR ManageEngine patched a critical ADAudit Plus vulnerability tracked as CVE-2026-6516. Two weaknesses in the product’s Agent...

FreePBX Vulnerabilities Enable Unauthenticated RCE and Administrator Takeover FreePBX vulnerabilities enabling unauthenticated RCE and administrator takeover in UCP and missedcall

FreePBX vulnerabilities enabling unauthenticated RCE and administrator takeover in UCP and missedcall

FreePBX Vulnerabilities Enable Unauthenticated RCE and Administrator Takeover

Do Son July 22, 2026

TL;DR Two new FreePBX vulnerabilities each carry a CVSS score of 9.3. One gives unauthenticated remote code...

Critical Langflow Flaws Allow Unauthenticated Remote Code Execution Langflow RCE vulnerability enabling unauthenticated remote code execution

Langflow RCE vulnerability enabling unauthenticated remote code execution

Critical Langflow Flaws Allow Unauthenticated Remote Code Execution

Do Son June 25, 2026

TL;DR IBM disclosed two critical flaws in Langflow OSS, the open-source AI workflow builder. One is a...

Exploited in the Wild: Critical Drupal SQL Injection (CVE-2026-9082) Grants Attacker Root Access CVE-2022-39261 Drupal SQL Injection Vulnerability CVE-2026-9082 PostgreSQL Flaw

CVE-2022-39261 Drupal SQL Injection Vulnerability CVE-2026-9082 PostgreSQL Flaw

Exploited in the Wild: Critical Drupal SQL Injection (CVE-2026-9082) Grants Attacker Root Access

Do Son May 21, 2026

The Drupal Security Team has released an urgent advisory detailing a highly critical vulnerability lurking within the...

Stream Hijacked: Critical Zero-Click Command Injection Flaw Exposed in AVideo-Encoder AVideo-Encoder Vulnerability CVE-2026-29058

Stream Hijacked: Critical Zero-Click Command Injection Flaw Exposed in AVideo-Encoder

Do Son March 6, 2026

Security researchers have uncovered a critical vulnerability in AVideo-Encoder, a key component of the open-source AVideo Platform...

Critical 10.0 CVSS Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls Cisco ISE Root Escalation * Read-Only Admin Exploit Cisco Secure FMC Vulnerability CVE-2026-20131 Cisco Meeting Management Vulnerability CVE-2026-20098 Cisco vulnerability, RCE flaw CVE-2025-20265 Cisco Meraki, VPN Vulnerability Cisco Nexus Dashboard - CVE-2024-20424 CVE-2025-20115 Cisco Vulnerability CVE-2018-0171 Privilege Escalation Cisco Unified Intelligence Center

Cisco ISE Root Escalation * Read-Only Admin Exploit Cisco Secure FMC Vulnerability CVE-2026-20131 Cisco Meeting Management Vulnerability CVE-2026-20098 Cisco vulnerability, RCE flaw CVE-2025-20265 Cisco Meraki, VPN Vulnerability Cisco Nexus Dashboard - CVE-2024-20424 CVE-2025-20115 Cisco Vulnerability CVE-2018-0171 Privilege Escalation Cisco Unified Intelligence Center

Critical 10.0 CVSS Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls

Do Son March 5, 2026

Cybersecurity researchers have identified a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software, the administrative...

CVSS 10.0 Unauthenticated Remote Code Execution in FreeScout (Public Proof-of-Concept Disclosed) FreeScout RCE CVE-2026-28289

CVSS 10.0 Unauthenticated Remote Code Execution in FreeScout (Public Proof-of-Concept Disclosed)

Do Son March 5, 2026

Security researchers have uncovered a maximum-score vulnerability in FreeScout, the popular open-source help desk and shared inbox...

Check Point VPN vulnerability exploited in the wild Check Point VPN exploit CVE-2026-50751 zero-day Checkmarx Breach Supply Chain Attack Ivanti EPMM RCE CVE-2026-1281 Modular DS Vulnerability CVE-2026-23550 D-Link RCE Vulnerability CVE-2026-0625 Christmas 2025 GreyNoise Campaign, Japan-Based Initial Access Broker React2Shell Zero-Day, APT Active Exploitation WordPress vulnerability, authentication bypass FreePBX, zero-day Trend Micro Apex One, Remote Code Execution BitoPro Hack, Crypto Theft UNC5337 - CVE-2022-47945 Safe{Wallet} hack Fortinet vulnerability, CVE-2024-21762, FortiGate attack Balloonfly, Play ransomware Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

Exploited in the Wild: Critical Ivanti EPMM RCE Flaws (CVSS 9.8) Under Attack

Do Son January 30, 2026

Ivanti has issued an urgent security advisory confirming that attackers are actively exploiting critical vulnerabilities in its...

Critical WordPress Flaw (CVE-2025-6389) Under Active Exploitation Allows Unauthenticated RCE WordPress Privilege Escalation CVE-2026-1492 Sneeit Framework RCE, Unauthenticated Code Execution Post SMTP, Account Takeover WordPress Vulnerability, Unpatched XSS WordPress Vulnerability, PHP Object Injection WordPress AI Engine, Privilege Escalation CVE-2024-43153 & CVE-2024-43234

WordPress Privilege Escalation CVE-2026-1492 Sneeit Framework RCE, Unauthenticated Code Execution Post SMTP, Account Takeover WordPress Vulnerability, Unpatched XSS WordPress Vulnerability, PHP Object Injection WordPress AI Engine, Privilege Escalation CVE-2024-43153 & CVE-2024-43234

Critical WordPress Flaw (CVE-2025-6389) Under Active Exploitation Allows Unauthenticated RCE

Do Son December 4, 2025

A critical Remote Code Execution (RCE) vulnerability has been discovered in the Sneeit Framework, a core plugin...

Critical WordPress Flaw (CVE-2025-6389, CVSS 9.8) Under Active Exploitation Allows Unauthenticated RCE Sneeit Framework RCE, Unauthenticated RCE

Sneeit Framework RCE, Unauthenticated RCE

Critical WordPress Flaw (CVE-2025-6389, CVSS 9.8) Under Active Exploitation Allows Unauthenticated RCE

Do Son November 25, 2025

A newly disclosed critical vulnerability in the Sneeit Framework — a widely used WordPress plugin powering premium...

Weaver E-cology RCE CVE-2026-22679 CVE-2026-20127 Cisco SD-WAN Exploitation AI-Driven Cyberattack ARXON Malware React Server Components Vulnerability CVE-2025-55182 FortiWeb Auth Bypass, Unauthenticated Admin Takeover RayInitiator Bootkit, LINE VIPER CVE-2025-59689 Department of the Treasury cybersecurity - CVE-2025-0108 PoC CVE-2025-31103 Dior Data Breach SK Telecom data breach, long-term intrusion

ZERO-DAY ATTACK WARNING: Fortinet FortiWeb Exploit Grants Unauthenticated Admin Access!

Do Son November 14, 2025

Cybersecurity firms are sounding the alarm over a critical vulnerability in Fortinet FortiWeb, the company’s Web Application...

Critical Zoho Analytics Plus Flaw (CVE-2025-8324, CVSS 9.8) Allows Unauthenticated SQL Injection and Data Takeover Zoho Analytics Plus RCE, Unauthenticated SQLi

Zoho Analytics Plus RCE, Unauthenticated SQLi

Critical Zoho Analytics Plus Flaw (CVE-2025-8324, CVSS 9.8) Allows Unauthenticated SQL Injection and Data Takeover

Do Son November 14, 2025

Zoho Corporation has released an urgent security advisory addressing a critical severity SQL injection vulnerability affecting Analytics...

Two Critical Oracle Marketing Flaws (CVE-2025-53072, CVE-2025-62481) — Patch Immediately or Risk Full Takeover IRGC Oracle Cloud Dubai strike Oracle global layoffs 2026 Oracle Fusion Middleware Vulnerability CVE-2026-21992 Oracle Edge Cloud Vulnerability CVE-2026-21994 Oracle Critical RCE, EBS Marketing Flaws CVE-2024-21182 PoC Exploit Oracle EBS Auth Bypass, CVE-2025-61884

IRGC Oracle Cloud Dubai strike Oracle global layoffs 2026 Oracle Fusion Middleware Vulnerability CVE-2026-21992 Oracle Edge Cloud Vulnerability CVE-2026-21994 Oracle Critical RCE, EBS Marketing Flaws CVE-2024-21182 PoC Exploit Oracle EBS Auth Bypass, CVE-2025-61884

Two Critical Oracle Marketing Flaws (CVE-2025-53072, CVE-2025-62481) — Patch Immediately or Risk Full Takeover

Do Son October 22, 2025

Oracle has released its October 2025 Critical Patch Update (CPU), fixing a massive 374 security vulnerabilities and...

CVE-2024-7399: Samsung MagicINFO Vulnerability Now Actively Exploited in the Wild Samsung MagicINFO, remote code execution

CVE-2024-7399: Samsung MagicINFO Vulnerability Now Actively Exploited in the Wild

Do Son May 5, 2025

A critical security vulnerability, CVE-2024-7399, is being actively exploited in the wild in Samsung MagicINFO 9 Server,...