{ "summary": { "source": "kev", "catalogVersion": "2026.07.27", "catalogReleased": "2026-07-27T19:00:15.8632Z", "windowDays": 30, "total": 25, "vendors": 16, "ransomware": 0, "withPoc": 16, "multiSource": 21, "builtAt": "2026-07-29T06:01:00.302Z", "unenriched": 24 }, "cves": [ { "cve": "CVE-2025-68686", "title": "Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability", "category": "Fortinet", "vendor": "Fortinet", "product": "FortiOS", "exploited": true, "publiclyDisclosed": false, "faq": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "cvss": 5.9, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "MEDIUM", "impact": null, "products": [ "FortiOS" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-68686", "source": "kev", "kev": { "dateAdded": "2026-07-27", "dueDate": "2026-08-10", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-200" ], "references": [ "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] }, "epss": 0.01264, "epssPercentile": 0.66692, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2026-02-10T16:16:09.630", "corroboration": { "poc": false, "xOrigin": false, "independent": [], "level": "cisa-attributed" }, "research": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "type": "writeup", "source": "Fortinet PSIRT (FG-IR-25-934)", "note": "Official vendor advisory; credits Peter Gabaldon" }, { "url": "https://labs.itresit.es/2026/02/11/fortigate-symlink-persistence-method-patch-bypass-cve-2025-68686/", "type": "writeup", "source": "ITRESIT Labs / Peter Gabaldon", "note": "Origin researcher writeup; double-slash bypass explained" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68686", "type": "detection", "source": "NIST NVD", "note": "Official CVE record; CVSS 5.3 Medium, CWE-200" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686", "type": "detection", "source": "CISA KEV Catalog", "note": "KEV entry added 2026-07-27; patch due 2026-08-10" }, { "url": "https://www.tenable.com/plugins/nessus/298526", "type": "detection", "source": "Tenable Nessus (Plugin #298526)", "note": "Authenticated version check for FG-IR-25-934" }, { "url": "https://github.com/advisories/GHSA-839g-m33x-3w78", "type": "detection", "source": "GitHub Advisory Database", "note": "GHSA advisory; moderate severity, updated Jul 2026", "hasCode": null }, { "url": "https://vulnerability.circl.lu/vuln/CVE-2025-68686", "type": "detection", "source": "CIRCL Vulnerability-Lookup", "note": "KEV correlation; exploited confirmed 2026-07-27" }, { "url": "https://www.sentinelone.com/vulnerability-database/cve-2025-68686/", "type": "writeup", "source": "SentinelOne Vulnerability DB", "note": "Technical breakdown; attack vector & impact analysis" } ], "aliases": [ "Double Slash Technique" ], "researchers": [ "pgj11" ], "x": { "mentions": 91, "engagement": 293, "aliases": [ "Double Slash Technique" ], "posts": [ { "handle": "akaclandestine", "followers": 62546, "likes": 43, "reposts": 9, "quotes": 0, "impressions": 2844, "createdAt": "2026-07-26", "url": "https://x.com/akaclandestine/status/2081485357015842956", "github": [ { "url": "https://github.com/vikasudasi/exfil-scan", "hasCode": true } ], "origin": false }, { "handle": "caglarozenc", "followers": 2271, "likes": 5, "reposts": 0, "quotes": 1, "impressions": 693, "createdAt": "2026-07-27", "url": "https://x.com/caglarozenc/status/2081675163129504152", "github": [ { "url": "http://github.com/dmcteknoloji/sql-server-2025-kitap/releases/tag/v1.0.3", "hasCode": true } ], "origin": false }, { "handle": "CISACyber", "followers": 300107, "likes": 33, "reposts": 20, "quotes": 0, "impressions": 8253, "createdAt": "2026-07-27", "url": "https://x.com/CISACyber/status/2081830202410189130", "github": [], "origin": false }, { "handle": "Cyber_O51NT", "followers": 22531, "likes": 26, "reposts": 7, "quotes": 2, "impressions": 4915, "createdAt": "2026-07-25", "url": "https://x.com/Cyber_O51NT/status/2080807357311799575", "github": [], "origin": false }, { "handle": "MalwareBibleJP", "followers": 7897, "likes": 21, "reposts": 0, "quotes": 0, "impressions": 1902, "createdAt": "2026-07-27", "url": "https://x.com/MalwareBibleJP/status/2081608777875562935", "github": [], "origin": false }, { "handle": "Huntio", "followers": 6704, "likes": 18, "reposts": 1, "quotes": 0, "impressions": 1348, "createdAt": "2026-07-25", "url": "https://x.com/Huntio/status/2081061962557829127", "github": [], "origin": false }, { "handle": "aydinnyunuss", "followers": 1062, "likes": 18, "reposts": 2, "quotes": 0, "impressions": 657, "createdAt": "2026-07-25", "url": "https://x.com/aydinnyunuss/status/2080874026226827309", "github": [], "origin": false }, { "handle": "connect24h", "followers": 4782, "likes": 13, "reposts": 2, "quotes": 0, "impressions": 3568, "createdAt": "2026-07-26", "url": "https://x.com/connect24h/status/2081177732558577882", "github": [], "origin": false } ] }, "bsky": { "mentions": 17, "engagement": 5, "posts": [ { "handle": "packetstorm.bsky.social", "displayName": "Packet Storm News", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-02-12", "url": "https://bsky.app/profile/packetstorm.bsky.social/post/3meoqfzzkvq23", "origin": true, "authority": false, "github": [] }, { "handle": "secdb.bsky.social", "displayName": "ZEN SecDB", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-27", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mrnlek5gw62e", "origin": false, "authority": true, "github": [] }, { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-27", "url": "https://bsky.app/profile/thecybermind.co/post/3mrnk7h4ixm24", "origin": false, "authority": true, "github": [] }, { "handle": "threatspotai.bsky.social", "displayName": "ThreatSpot AI", "likes": 1, "reposts": 1, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mrote6zzd725", "origin": false, "authority": false, "github": [] }, { "handle": "hermes71.bsky.social", "displayName": "Some Hermes agent", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3mromz5jumm2h", "origin": false, "authority": false, "github": [] }, { "handle": "o2cloud.bsky.social", "displayName": "CVE by o2Cloud", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-02-11", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3melmw7tvsw2j", "origin": false, "authority": false, "github": [] } ] } }, { "cve": "CVE-2026-16812", "title": "Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability", "category": "Arista", "vendor": "Arista", "product": "VeloCloud Orchestrator", "exploited": true, "publiclyDisclosed": false, "faq": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "cvss": 10, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "VeloCloud Orchestrator" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-16812", "source": "kev", "kev": { "dateAdded": "2026-07-27", "dueDate": "2026-07-30", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-78" ], "references": [ "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16812" ] }, "epss": 0.0098, "epssPercentile": 0.58631, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2026-07-27T16:17:03.640", "corroboration": { "poc": false, "xOrigin": false, "independent": [], "level": "cisa-attributed" }, "research": [ { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "type": "detection", "source": "Arista Networks (official)", "note": "Official advisory; CVSS 10.0, CWE-78, BUG 1901675" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "Added to KEV July 27 2026; patch deadline July 30" }, { "url": "https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/", "type": "writeup", "source": "BleepingComputer", "note": "News writeup; includes 3 attacker IPs shared by Arista" }, { "url": "https://www.securityweek.com/critical-arista-velocloud-orchestrator-vulnerability-exploited-as-zero-day/", "type": "writeup", "source": "SecurityWeek", "note": "Covers zero-day exploitation, patched versions listed" }, { "url": "https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html", "type": "writeup", "source": "The Hacker News", "note": "Active exploitation confirmed; no attrib. to threat actor" }, { "url": "https://www.theregister.com/security/2026/07/28/arista-patches-actively-exploited-velocloud-bug-as-cisa-puts-admins-on-the-clock/5279414", "type": "writeup", "source": "The Register", "note": "Notes VCO exposed by default with no config mitigation" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16812", "type": "detection", "source": "NVD / NIST", "note": "NVD entry; CVSS vectors, affected version ranges" }, { "url": "https://mallory.ai/vulnerabilities/CVE-2026-16812", "type": "detection", "source": "Mallory.ai", "note": "Asset-correlated CVE tracking; KEV status confirmed" } ], "aliases": [], "researchers": [], "x": { "mentions": 2, "engagement": 0, "aliases": [], "posts": [ { "handle": "KaitanSecurity", "followers": 89, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 40, "createdAt": "2026-07-28", "url": "https://x.com/KaitanSecurity/status/2082073597066060177", "github": [], "origin": false }, { "handle": "FrontieraTechIT", "followers": 40, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 48, "createdAt": "2026-07-27", "url": "https://x.com/FrontieraTechIT/status/2081844589011337553", "github": [], "origin": false } ] }, "bsky": { "mentions": 25, "engagement": 2, "posts": [ { "handle": "cyberhub.blog", "displayName": "CyberHub", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-29", "url": "https://bsky.app/profile/cyberhub.blog/post/3mrqtos5qoz26", "origin": false, "authority": false, "github": [] }, { "handle": "alphahunt.io", "displayName": "AlphaHunt Converge", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/alphahunt.io/post/3mrpl2nc4va2n", "origin": false, "authority": false, "github": [] }, { "handle": "yazoul-alerts.bsky.social", "displayName": "Yazoul - Cybersecurity Alerts", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrpeceej5g23", "origin": false, "authority": false, "github": [] }, { "handle": "cybernewsroom.bsky.social", "displayName": "Cyber Newsroom", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrp4iawyac2y", "origin": false, "authority": false, "github": [] }, { "handle": "etairos-ai.bsky.social", "displayName": null, "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mrpldakrc42y", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-27", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mrnnnd5c7p2n", "origin": false, "authority": false, "github": [] } ] } }, { "cve": "CVE-2026-16232", "title": "Check Point SmartConsole Improper Authentication Vulnerability", "category": "Check Point", "vendor": "Check Point", "product": "SmartConsole", "exploited": true, "publiclyDisclosed": false, "faq": "Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.", "cvss": 9.1, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "CRITICAL", "impact": null, "products": [ "SmartConsole" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-16232", "source": "kev", "kev": { "dateAdded": "2026-07-22", "dueDate": "2026-07-25", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-287" ], "references": [ "https://support.checkpoint.com/results/sk/sk185169/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16232" ] }, "epss": 0.12685, "epssPercentile": 0.95846, "pocCount": 1, "pocTopStars": 0, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/sfewer-r7/CVE-2026-16232", "stars": 0, "desc": "A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token.", "createdAt": "2026-07-28", "hasCode": true } ], "published": "2026-07-22T14:17:15.513", "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc" ], "level": "multi-source" }, "research": [ { "url": "https://noise.getoto.net/2026/07/28/check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/", "type": "poc", "source": "Rapid7 Labs", "note": "Root cause analysis + PoC vs R81.20/R82.10; SIC DN replay" }, { "url": "https://www.rapid7.com/blog/post/etr-cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/", "type": "writeup", "source": "Rapid7 Labs", "note": "Full ETR: exploitation details, affected versions, IoCs" }, { "url": "https://support.checkpoint.com/results/sk/sk185169", "type": "detection", "source": "Check Point (vendor advisory sk185169)", "note": "Official advisory; hotfix, IoCs, mitigation steps" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV", "note": "KEV listing; BOD 26-04 deadline Jul 25, 2026" }, { "url": "https://www.bleepingcomputer.com/news/security/check-point-patches-smartconsole-zero-day-exploited-in-attacks/", "type": "writeup", "source": "BleepingComputer", "note": "Zero-day coverage; exploitation context and IoCs" }, { "url": "https://www.helpnetsecurity.com/2026/07/23/check-point-vulnerability-cve-2026-16232/", "type": "writeup", "source": "Help Net Security", "note": "Technical summary incl. CVE-2026-62144/62145 context" }, { "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-checkpoint-smartconsole-cve-2026-16232-202/", "type": "writeup", "source": "Cloud Security Alliance Labs", "note": "Token validation flaw analysis; ZT policy implications" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "KEV catalog entry; forensics triage requirement noted" } ], "aliases": [], "researchers": [], "x": { "mentions": 5, "engagement": 105, "aliases": [], "posts": [ { "handle": "stephenfewer", "followers": 9803, "likes": 17, "reposts": 4, "quotes": 0, "impressions": 887, "createdAt": "2026-07-28", "url": "https://x.com/stephenfewer/status/2082177092934856820", "github": [ { "url": "https://github.com/sfewer-r7/CVE-2026-16232", "hasCode": true } ], "origin": false }, { "handle": "rapid7", "followers": 124620, "likes": 13, "reposts": 4, "quotes": 0, "impressions": 2812, "createdAt": "2026-07-28", "url": "https://x.com/rapid7/status/2082188506063863840", "github": [], "origin": false }, { "handle": "chris_uk2026", "followers": 23, "likes": 1, "reposts": 0, "quotes": 0, "impressions": 5, "createdAt": "2026-07-29", "url": "https://x.com/chris_uk2026/status/2082313416727814290", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12545, "likes": 0, "reposts": 1, "quotes": 0, "impressions": 211, "createdAt": "2026-07-29", "url": "https://x.com/Daily_CyberSec/status/2082291787037598108", "github": [], "origin": false } ] }, "bsky": { "mentions": 23, "engagement": 8, "posts": [ { "handle": "stephenfewer.bsky.social", "displayName": "Stephen Fewer", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/stephenfewer.bsky.social/post/3mrq3idyh3k27", "origin": false, "authority": false, "github": [ { "url": "https://github.com/sfewer-r7/CVE-2026-16232", "hasCode": true } ] }, { "handle": "hendryadrian.bsky.social", "displayName": "Cybersecurity News Everyday", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mronqj26z623", "origin": false, "authority": false, "github": [] }, { "handle": "hackmag.com", "displayName": "HackMag — Top-notch cybersecurity magazine", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-28", "url": "https://bsky.app/profile/hackmag.com/post/3mrqcjspfib2j", "origin": false, "authority": false, "github": [] }, { "handle": "helpnetsecurity.com", "displayName": "Help Net Security", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-23", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mrco2lzm522z", "origin": false, "authority": false, "github": [] }, { "handle": "o2cloud.bsky.social", "displayName": "CVE by o2Cloud", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-23", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrcs2aeery2b", "origin": false, "authority": false, "github": [] }, { "handle": "securityonline.bsky.social", "displayName": "Daily CyberSecurity", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-29", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mrqussutq22l", "origin": false, "authority": false, "github": [] } ] } }, { "cve": "CVE-2026-50522", "title": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ", "category": "Microsoft", "vendor": "Microsoft", "product": "SharePoint", "exploited": true, "publiclyDisclosed": false, "faq": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "SharePoint" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-50522", "source": "kev", "kev": { "dateAdded": "2026-07-22", "dueDate": "2026-07-25", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-502" ], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-50522" ] }, "epss": 0.57101, "epssPercentile": 0.98975, "pocCount": 1, "pocTopStars": 28, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/4minx/CVE-2026-50522", "stars": 28, "desc": "CVE-2026-50522 PoC", "createdAt": "2026-07-25", "hasCode": true }, { "url": "https://github.com/ChPratik/CVE-2026-50522", "stars": 0, "desc": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "createdAt": "2026-07-27", "hasCode": false }, { "url": "https://github.com/darses/CVE-2026-50522", "stars": 0, "desc": "Microsoft SharePoint CVE-2026-50522", "createdAt": "2026-07-28", "hasCode": false } ], "published": "2026-07-14T17:17:01.547", "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc" ], "level": "multi-source" }, "research": [ { "url": "https://github.com/Janggggg/CVE-2026-50522", "type": "poc", "source": "GitHub / Janggggg", "note": "PowerShell PoC; BinaryFormatter via WS-Fed token", "hasCode": null }, { "url": "https://github.com/darses/nuclei-templates/blob/main/other/microsoft/microsoft-sharepoint-layout2sp.yaml", "type": "module", "source": "GitHub / darses (Nuclei template)", "note": "Nuclei scan template for CVE-2026-50522 path", "hasCode": true }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "type": "detection", "source": "Microsoft MSRC", "note": "Official vendor advisory; July 2026 Patch Tuesday" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV", "note": "KEV listing; federal remediation deadline Jul 25" }, { "url": "https://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/", "type": "writeup", "source": "BleepingComputer", "note": "PoC mechanics, machine key theft, exploitation timeline" }, { "url": "https://www.threatlocker.com/blog/sharepoint-rce-under-active-exploitation", "type": "writeup", "source": "ThreatLocker", "note": "Root cause: SessionSecurityTokenHandler deserialization" }, { "url": "https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html", "type": "writeup", "source": "The Hacker News", "note": "watchTowr/Defused exploitation details; KEV context" }, { "url": "https://securityaffairs.com/195760/security/public-poc-triggers-active-exploitation-of-critical-sharepoint-rce-vulnerability-cve-2026-50522.html", "type": "writeup", "source": "Security Affairs", "note": "Pwn2Own Berlin demo noted; paired with CVE-2026-58644" } ], "aliases": [], "researchers": [ "Janggggg", "splitline" ], "x": { "mentions": 75, "engagement": 340, "aliases": [], "posts": [ { "handle": "_aircorridor", "followers": 13267, "likes": 202, "reposts": 43, "quotes": 0, "impressions": 9698, "createdAt": "2026-07-27", "url": "https://x.com/_aircorridor/status/2081742293610955170", "github": [ { "url": "https://github.com/4minx/CVE-2026-50522", "hasCode": true } ], "origin": false }, { "handle": "Netomize", "followers": 3, "likes": 2, "reposts": 2, "quotes": 0, "impressions": 94, "createdAt": "2026-07-28", "url": "https://x.com/Netomize/status/2082218611939119334", "github": [ { "url": "https://github.com/Netomize/RFiles/tree/main/cve_2026_16723", "hasCode": false } ], "origin": false }, { "handle": "ridvanyagli", "followers": 1199, "likes": 1, "reposts": 0, "quotes": 0, "impressions": 114, "createdAt": "2026-07-28", "url": "https://x.com/ridvanyagli/status/2082174936857055312", "github": [ { "url": "https://github.com/4minx/CVE-2026-50522", "hasCode": true } ], "origin": false }, { "handle": "Ronin66Official", "followers": 24, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 57, "createdAt": "2026-07-28", "url": "https://x.com/Ronin66Official/status/2082039266008551774", "github": [ { "url": "https://github.com/4minx/CVE-2026-50522", "hasCode": true } ], "origin": false }, { "handle": "The_Cyber_News", "followers": 69003, "likes": 42, "reposts": 9, "quotes": 2, "impressions": 2765, "createdAt": "2026-07-28", "url": "https://x.com/The_Cyber_News/status/2082236910727241950", "github": [], "origin": false }, { "handle": "connect24h", "followers": 4782, "likes": 8, "reposts": 4, "quotes": 0, "impressions": 642, "createdAt": "2026-07-28", "url": "https://x.com/connect24h/status/2082242104533934106", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7590, "likes": 6, "reposts": 1, "quotes": 0, "impressions": 653, "createdAt": "2026-07-28", "url": "https://x.com/__kokumoto/status/2082246008810209291", "github": [], "origin": false }, { "handle": "YogSoth0", "followers": 1658, "likes": 4, "reposts": 0, "quotes": 0, "impressions": 134, "createdAt": "2026-07-29", "url": "https://x.com/YogSoth0/status/2082302760498643434", "github": [], "origin": false } ] }, "bsky": { "mentions": 25, "engagement": 36, "posts": [ { "handle": "bleepingcomputer.com", "displayName": "BleepingComputer", "likes": 5, "reposts": 4, "replies": 0, "createdAt": "2026-07-21", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mr6mctnonp2l", "origin": false, "authority": true, "github": [] }, { "handle": "shadowserver.bsky.social", "displayName": "The Shadowserver Foundation", "likes": 4, "reposts": 1, "replies": 1, "createdAt": "2026-07-24", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3mrfsm7kii22x", "origin": false, "authority": true, "github": [] }, { "handle": "intelnightowl.bsky.social", "displayName": "Intel Night OWL 🦉🇺🇸", "likes": 1, "reposts": 1, "replies": 0, "createdAt": "2026-07-22", "url": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mrajdoi4ky2c", "origin": false, "authority": true, "github": [] }, { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-25", "url": "https://bsky.app/profile/thecybermind.co/post/3mrh5j6xdot24", "origin": false, "authority": true, "github": [] }, { "handle": "cert-fr.bsky.social", "displayName": "CERT-FR", "likes": 2, "reposts": 3, "replies": 0, "createdAt": "2026-07-22", "url": "https://bsky.app/profile/cert-fr.bsky.social/post/3mrals3c2ua2y", "origin": false, "authority": false, "github": [] }, { "handle": "ifin-intel.org", "displayName": "IFIN", "likes": 3, "reposts": 1, "replies": 0, "createdAt": "2026-07-23", "url": "https://bsky.app/profile/ifin-intel.org/post/3mrd5hpeii32o", "origin": false, "authority": false, "github": [] } ] } }, { "cve": "CVE-2026-60137", "title": "WordPress Core SQL Injection Vulnerability", "category": "WordPress", "vendor": "WordPress", "product": "Core", "exploited": true, "publiclyDisclosed": false, "faq": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.", "cvss": 5.9, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "MEDIUM", "impact": null, "products": [ "Core" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "source": "kev", "kev": { "dateAdded": "2026-07-21", "dueDate": "2026-08-04", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-89" ], "references": [ "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-60137" ] }, "epss": 0.77974, "epssPercentile": 0.99527, "pocCount": 3, "pocTopStars": 9, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/codeb0ssx/Ultimate-wp2shell", "stars": 9, "desc": "wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for ", "createdAt": "2026-07-18", "hasCode": true }, { "url": "https://github.com/h4cd0c/wp2shell", "stars": 0, "desc": "wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for ", "createdAt": "2026-07-18", "hasCode": true }, { "url": "https://github.com/northsia/CVE-2026-60137-With-Skip-SSL", "stars": 0, "desc": "Adding --insecure to skip ssl", "createdAt": "2026-07-26", "hasCode": true } ], "published": "2026-07-17T20:17:27.790", "research": [ { "url": "https://github.com/Icex0/wp2shell-poc", "type": "poc", "source": "GitHub / Icex0", "note": "Full RCE chain PoC; most widely referenced", "hasCode": true }, { "url": "https://github.com/0xsha/wp2shell", "type": "poc", "source": "GitHub / 0xsha", "note": "Unified stdlib-only PoC merging 6 public chains", "hasCode": true }, { "url": "https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core", "type": "writeup", "source": "Searchlight Cyber / Adam Kues", "note": "Original discoverer advisory; no full technicals yet" }, { "url": "https://github.com/ZephrFish/wp2shell-scanner", "type": "module", "source": "GitHub / ZephrFish", "note": "Scanner + Nuclei YAML: wp2shell-exposure.yaml", "hasCode": false }, { "url": "https://labs.eye.security/wp2shell-defenders-guide/", "type": "writeup", "source": "Eye Security Research", "note": "Defender guide; verified Icex0 PoC end-to-end" }, { "url": "https://www.vulncheck.com/blog/wp2shell", "type": "writeup", "source": "VulnCheck", "note": "Technical chain breakdown; 24+ PoCs confirmed" }, { "url": "https://blog.zsec.uk/wp2shell-code-trace-deep-dive/", "type": "writeup", "source": "ZephrFish / ZephrSec", "note": "Deep-dive code trace; linked from scanner repo" }, { "url": "https://wp2shell.com/", "type": "detection", "source": "Searchlight Cyber (wp2shell.com)", "note": "Official exposure checker; no exploit payload sent" } ], "x": { "mentions": 102, "aliases": [ "WP2Shell", "wp2shell" ], "posts": [ { "handle": "elhackernet", "followers": 140895, "likes": 10, "createdAt": "2026-07-20", "url": "https://x.com/elhackernet/status/2079297919677857809", "github": [], "origin": true }, { "handle": "connect24h", "followers": 4416, "likes": 8, "createdAt": "2026-07-20", "url": "https://x.com/connect24h/status/2079284178823344328", "github": [], "origin": true }, { "handle": "Racer_Kamira", "followers": 11440, "likes": 5, "createdAt": "2026-07-20", "url": "https://x.com/Racer_Kamira/status/2079298320045056275", "github": [], "origin": true }, { "handle": "siennawebdesign", "followers": 292, "likes": 3, "createdAt": "2026-07-20", "url": "https://x.com/siennawebdesign/status/2079342484493156445", "github": [], "origin": true }, { "handle": "snyff", "followers": 20667, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/snyff/status/2079336372310249667", "github": [], "origin": true }, { "handle": "__kokumoto", "followers": 7585, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/__kokumoto/status/2079345020709265478", "github": [], "origin": true }, { "handle": "Horizon3ai", "followers": 2894, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/Horizon3ai/status/2079336182480257029", "github": [], "origin": true }, { "handle": "eSecurityPlanet", "followers": 6841, "likes": 0, "createdAt": "2026-07-20", "url": "https://x.com/eSecurityPlanet/status/2079268552884772897", "github": [], "origin": true } ] }, "bsky": { "mentions": 44, "posts": [ { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mqwsmwum3c22", "origin": true, "authority": true, "github": [] }, { "handle": "raptor.infosec.exchange.ap.brid.gy", "displayName": "raptor", "likes": 1, "reposts": 1, "replies": 1, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mqvtnm45ddy2", "origin": true, "authority": false, "github": [ { "url": "https://github.com/Icex0/wp2shell-poc", "hasCode": true } ] }, { "handle": "r-blueteamsec.bsky.social", "displayName": "r/blueteamsec bot", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mqw7fxlakd2e", "origin": true, "authority": false, "github": [ { "url": "https://github.com/Icex0/wp2shell-poc", "hasCode": true } ] }, { "handle": "goodtech.info", "displayName": "Goodtech - L'actu open source 🇫🇷🐧🇪🇺", "likes": 2, "reposts": 2, "replies": 0, "createdAt": "2026-07-20", "url": "https://bsky.app/profile/goodtech.info/post/3mr24wwys63ec", "origin": true, "authority": false, "github": [] }, { "handle": "ninjaowl.ai", "displayName": "Ninja Owl", "likes": 3, "reposts": 0, "replies": 0, "createdAt": "2026-07-19", "url": "https://bsky.app/profile/ninjaowl.ai/post/3mqxim6htkn2o", "origin": true, "authority": false, "github": [] }, { "handle": "r-netsec.bsky.social", "displayName": "r/netsec bot", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqxa34s4rl2o", "origin": true, "authority": false, "github": [] } ] }, "telegram": { "mentions": 8, "reach": 40169, "posts": [ { "channel": "thehackernews", "channelTitle": "The Hacker News", "tier": "news", "date": "2026-07-18", "views": 9527, "forwards": 78, "url": "https://t.me/thehackernews/9544", "text": "⚡ UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public. > CVE-2026-63030 breaks REST batch routing > CVE-2026-60137 injects SQL Chained, they give an anonymous attacker code execution on affected WordPress sites. How the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "github": [], "origin": false } ] }, "aliases": [ "WP2Shell", "wp2shell" ], "researchers": [ "TF1T", "dtro", "haongo", "adamkues" ], "corroboration": { "poc": true, "xOrigin": true, "independent": [ "poc", "x" ], "level": "multi-source" } }, { "cve": "CVE-2026-63030", "title": "WordPress Core Interpretation Conflict Vulnerability", "category": "WordPress", "vendor": "WordPress", "product": "Core", "exploited": true, "publiclyDisclosed": false, "faq": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "Core" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "source": "kev", "kev": { "dateAdded": "2026-07-21", "dueDate": "2026-07-24", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-436" ], "references": [ "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-63030" ] }, "epss": 0.98051, "epssPercentile": 0.99907, "pocCount": 8, "pocTopStars": 634, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/Icex0/wp2shell-poc", "stars": 634, "desc": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain", "createdAt": "2026-07-17", "hasCode": true }, { "url": "https://github.com/0xsha/wp2shell", "stars": 79, "desc": "CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core", "createdAt": "2026-07-18", "hasCode": true }, { "url": "https://github.com/dinosn/wp2shell-lab", "stars": 46, "desc": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-", "createdAt": "2026-07-18", "hasCode": true }, { "url": "https://github.com/mcipekci/wp2shell", "stars": 15, "desc": "Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenti", "createdAt": "2026-07-22", "hasCode": true }, { "url": "https://github.com/47Cid/wp2shell-lab", "stars": 13, "desc": "Educational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion", "createdAt": "2026-07-18", "hasCode": true }, { "url": "https://github.com/NULL200OK/WP2Shell", "stars": 12, "desc": "WP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, all", "createdAt": "2026-07-18", "hasCode": true } ], "published": "2026-07-17T20:17:28.490", "research": [ { "url": "https://github.com/Icex0/wp2shell-poc", "type": "poc", "source": "Icex0 / GitHub", "note": "Full RCE chain: SQLi→admin forge→webshell plugin", "hasCode": true }, { "url": "https://github.com/0xsha/wp2shell", "type": "poc", "source": "0xsha / GitHub", "note": "Unified stdlib-only RCE; credits Icex0/sergiointel techniques", "hasCode": true }, { "url": "https://github.com/sergiointel/wp2shell-poc", "type": "poc", "source": "sergiointel / GitHub", "note": "Crack-free pre-auth admin creation via oEmbed/customizer", "hasCode": true }, { "url": "https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/", "type": "writeup", "source": "Adam Kues / Searchlight Cyber (Assetnote)", "note": "Original discoverer writeup; authoritative disclosure" }, { "url": "https://labs.eye.security/wp2shell-defenders-guide/", "type": "writeup", "source": "Eye Security Research", "note": "Deep defender guide; verified end-to-end chain independently" }, { "url": "https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/", "type": "writeup", "source": "Rapid7 ETR", "note": "ETR with CVSS analysis; InsightVM/Nexpose coverage noted" }, { "url": "https://github.com/projectdiscovery/nuclei-templates/pull/16595", "type": "module", "source": "mielverkerken / ProjectDiscovery nuclei-templates", "note": "Official Nuclei detection template PR; merged 2026-07-17", "hasCode": true }, { "url": "https://github.com/Senanfurkan/wordpress-cve-2026-63030", "type": "detection", "source": "Senanfurkan / GitHub", "note": "Safe detection-only PoC: route confusion + time-based SQLi", "hasCode": true } ], "x": { "mentions": 133, "aliases": [ "wp2shell" ], "posts": [ { "handle": "elhackernet", "followers": 140895, "likes": 10, "createdAt": "2026-07-20", "url": "https://x.com/elhackernet/status/2079297919677857809", "github": [], "origin": true }, { "handle": "connect24h", "followers": 4416, "likes": 8, "createdAt": "2026-07-20", "url": "https://x.com/connect24h/status/2079284178823344328", "github": [], "origin": true }, { "handle": "Racer_Kamira", "followers": 11440, "likes": 5, "createdAt": "2026-07-20", "url": "https://x.com/Racer_Kamira/status/2079298320045056275", "github": [], "origin": true }, { "handle": "siennawebdesign", "followers": 292, "likes": 3, "createdAt": "2026-07-20", "url": "https://x.com/siennawebdesign/status/2079342484493156445", "github": [], "origin": true }, { "handle": "snyff", "followers": 20667, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/snyff/status/2079336372310249667", "github": [], "origin": true }, { "handle": "__kokumoto", "followers": 7585, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/__kokumoto/status/2079345020709265478", "github": [], "origin": true }, { "handle": "Horizon3ai", "followers": 2894, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/Horizon3ai/status/2079336182480257029", "github": [], "origin": true }, { "handle": "__su888", "followers": 853, "likes": 2, "createdAt": "2026-07-20", "url": "https://x.com/__su888/status/2079325728181518491", "github": [], "origin": true } ] }, "bsky": { "mentions": 35, "posts": [ { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mqwsmwum3c22", "origin": true, "authority": true, "github": [] }, { "handle": "raptor.infosec.exchange.ap.brid.gy", "displayName": "raptor", "likes": 1, "reposts": 1, "replies": 1, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mqvtnm45ddy2", "origin": true, "authority": false, "github": [ { "url": "https://github.com/Icex0/wp2shell-poc", "hasCode": true } ] }, { "handle": "r-blueteamsec.bsky.social", "displayName": "r/blueteamsec bot", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mqw7fxlakd2e", "origin": true, "authority": false, "github": [ { "url": "https://github.com/Icex0/wp2shell-poc", "hasCode": true } ] }, { "handle": "goodtech.info", "displayName": "Goodtech - L'actu open source 🇫🇷🐧🇪🇺", "likes": 2, "reposts": 2, "replies": 0, "createdAt": "2026-07-20", "url": "https://bsky.app/profile/goodtech.info/post/3mr24wwys63ec", "origin": true, "authority": false, "github": [] }, { "handle": "ninjaowl.ai", "displayName": "Ninja Owl", "likes": 3, "reposts": 0, "replies": 0, "createdAt": "2026-07-19", "url": "https://bsky.app/profile/ninjaowl.ai/post/3mqxim6htkn2o", "origin": true, "authority": false, "github": [] }, { "handle": "lobsters-feed.bsky.social", "displayName": "The Lobste.rs RSS feed", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mqwvioehke2o", "origin": true, "authority": false, "github": [] } ] }, "telegram": { "mentions": 12, "reach": 50074, "posts": [ { "channel": "thehackernews", "channelTitle": "The Hacker News", "tier": "news", "date": "2026-07-18", "views": 9529, "forwards": 78, "url": "https://t.me/thehackernews/9544", "text": "⚡ UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public. > CVE-2026-63030 breaks REST batch routing > CVE-2026-60137 injects SQL Chained, they give an anonymous attacker code execution on affected WordPress sites. How the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "github": [], "origin": false } ] }, "aliases": [ "wp2shell" ], "researchers": [ "adamkues", "Icex0", "0xsha", "sergiointel", "attackercan" ], "corroboration": { "poc": true, "xOrigin": true, "independent": [ "poc", "x" ], "level": "multi-source" } }, { "cve": "CVE-2026-0770", "title": "Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "category": "Langflow", "vendor": "Langflow", "product": "Langflow", "exploited": true, "publiclyDisclosed": false, "faq": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ", "cvss": 9.8, "cvssVector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "Langflow" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-0770", "source": "kev", "kev": { "dateAdded": "2026-07-21", "dueDate": "2026-07-24", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-829" ], "references": [ "https://github.com/langflow-ai/langflow/releases/tag/v1.9.0", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-0770" ] }, "epss": 0.56267, "epssPercentile": 0.98954, "pocCount": 3, "pocTopStars": 0, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/Ez4rd1x1/CVE-2026-0770", "stars": 0, "desc": "LangFlow RCE | CVE-2026-0770 | Proof-Of-Concept", "createdAt": "2026-05-15", "hasCode": true }, { "url": "https://github.com/diamorphine666/CVE-2026-0770", "stars": 0, "desc": "Langflow remote code execution exploit", "createdAt": "2026-05-23", "hasCode": true }, { "url": "https://github.com/razureink/cve-2026-0770-langflow_rce_reproduction", "stars": 0, "desc": "CVE Reproduction: cve-2026-0770-langflow_rce_reproduction", "createdAt": "2026-07-23", "hasCode": true } ], "published": "2026-01-23T04:16:04.063", "research": [ { "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx", "type": "writeup", "source": "langflow GHSA", "note": "Unauth RCE via public flow build endpoint", "hasCode": true }, { "url": "https://www.exploit-db.com/exploits/52597", "type": "poc", "source": "Exploit-DB", "note": "Langflow 1.3.0 RCE exploit" }, { "url": "https://github.com/affix/CVE-2026-0770-PoC", "type": "poc", "source": "affix", "note": "PoC for Langflow RCE via validate_code", "hasCode": true }, { "url": "https://github.com/0xgh057r3c0n/CVE-2026-0770", "type": "poc", "source": "0xgh057r3c0n", "note": "RCE PoC exec_globals exec()", "hasCode": true } ], "x": { "mentions": 4, "posts": [ { "handle": "pdnuclei_bot", "followers": 949, "likes": 5, "createdAt": "2026-02-22", "url": "https://x.com/pdnuclei_bot/status/2025707211205517544", "origin": false, "github": [] }, { "handle": "transilienceai", "followers": 332, "likes": 0, "createdAt": "2026-02-22", "url": "https://x.com/transilienceai/status/2025413138925908276", "origin": false, "github": [] }, { "handle": "CVEnew", "followers": 57565, "likes": 0, "createdAt": "2026-01-23", "url": "https://x.com/CVEnew/status/2014576951957315822", "origin": false, "github": [] }, { "handle": "CveFindCom", "followers": 620, "likes": 0, "createdAt": "2026-01-23", "url": "https://x.com/CveFindCom/status/2014558758748270784", "origin": false, "github": [] } ], "aliases": [] }, "bsky": { "mentions": 6, "posts": [ { "handle": "beikokucyber.bsky.social", "displayName": "Beikoku Cybersecurity", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-02-23", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mfkkg736ie2h", "origin": false, "authority": false, "github": [] }, { "handle": "thehackerwire.bsky.social", "displayName": "TheHackerWire", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-01-23", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3md2zecuky22h", "origin": false, "authority": false, "github": [] }, { "handle": "cve.skyfleet.blue", "displayName": "CVE Alerts ", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-01-23", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3md3bcrstqg2c", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "researchers": [ "affix", "0xgh057r3c0n" ], "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2021-27137", "title": "DD-WRT Stack-Based Buffer Overflow Vulnerability", "category": "DD-WRT", "vendor": "DD-WRT", "product": "DD-WRT", "exploited": true, "publiclyDisclosed": false, "faq": "DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.", "cvss": 8.1, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "HIGH", "impact": null, "products": [ "DD-WRT" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-27137", "source": "kev", "kev": { "dateAdded": "2026-07-21", "dueDate": "2026-07-24", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-121" ], "references": [ "https://svn.dd-wrt.com/changeset/45724", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2021-27137" ] }, "epss": 0.16488, "epssPercentile": 0.96659, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2026-07-16T18:16:39.113", "research": [ { "url": "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "type": "writeup", "source": "SSD Secure Disclosure / Selim Enes Karaduman", "note": "Original advisory; vuln analysis + PoC trigger" }, { "url": "https://github.com/tzwlhack/Vulnerability/blob/main/DD-WRT%20%E7%BC%93%E5%86%B2%E5%8C%BA%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%EF%BC%88CVE-2021-27137%EF%BC%89.md", "type": "poc", "source": "GitHub / tzwlhack", "note": "Python UDP M-SEARCH PoC; 164-byte ST:uuid overflow", "hasCode": false }, { "url": "https://github.com/JianrongXiao-Linksys/miscellaneous", "type": "poc", "source": "GitHub / JianrongXiao-Linksys", "note": "miniupnpd exploit test tool for CVE-2021-27137", "hasCode": true }, { "url": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "type": "writeup", "source": "FortiGuard Labs / Fortinet", "note": "C0XMO botnet; deep analysis of CVE-2021-27137 exploitation" }, { "url": "https://www.onekey.com/resource/broadcom-sdk-vulnerabilities-bug-reports", "type": "writeup", "source": "ONEKEY Research", "note": "Broadcom SDK supply-chain context; CVE-2021-27137 noted" }, { "url": "https://www.fortiguard.com/encyclopedia/ips/56117", "type": "detection", "source": "Fortinet FortiGuard IPS", "note": "IPS signature: DD-WRT.UPNP.CVE-2021-27137.uuid.Buffer.Overflow" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "Added to KEV 2026-07-21; active exploitation confirmed" }, { "url": "https://svn.dd-wrt.com/changeset/45724", "type": "detection", "source": "DD-WRT SVN / vendor patch", "note": "Official vendor fix; changeset 45724 patches ssdp.c strcpy" } ], "x": { "mentions": 15, "engagement": 6, "aliases": [], "posts": [ { "handle": "__kokumoto", "followers": 7584, "likes": 3, "reposts": 0, "quotes": 0, "impressions": 571, "createdAt": "2026-07-21", "url": "https://x.com/__kokumoto/status/2079701986791100440", "github": [], "origin": false }, { "handle": "FR13ND0x7F", "followers": 448, "likes": 1, "reposts": 0, "quotes": 0, "impressions": 332, "createdAt": "2026-07-10", "url": "https://x.com/FR13ND0x7F/status/2075698831061307495", "github": [], "origin": false }, { "handle": "r0otk3r", "followers": 43, "likes": 1, "reposts": 0, "quotes": 0, "impressions": 68, "createdAt": "2026-07-12", "url": "https://x.com/r0otk3r/status/2076270600591495492", "github": [], "origin": false }, { "handle": "AseemShrey", "followers": 8793, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 94, "createdAt": "2026-07-15", "url": "https://x.com/AseemShrey/status/2077224685767630991", "github": [], "origin": false }, { "handle": "SecAlertsCo", "followers": 858, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 73, "createdAt": "2026-07-21", "url": "https://x.com/SecAlertsCo/status/2079607270300598376", "github": [], "origin": false }, { "handle": "lexs17", "followers": 187, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 185, "createdAt": "2026-07-13", "url": "https://x.com/lexs17/status/2076597065199636958", "github": [], "origin": false }, { "handle": "VistemSolutions", "followers": 79, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 15, "createdAt": "2026-07-21", "url": "https://x.com/VistemSolutions/status/2079705493149307216", "github": [], "origin": false }, { "handle": "0xMetaLabs", "followers": 67, "likes": 0, "reposts": 0, "quotes": 0, "impressions": 27, "createdAt": "2026-07-15", "url": "https://x.com/0xMetaLabs/status/2077397923068067971", "github": [], "origin": false } ] }, "bsky": { "mentions": 11, "engagement": 0, "posts": [ { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-22", "url": "https://bsky.app/profile/thecybermind.co/post/3mr7giaghtj24", "origin": false, "authority": true, "github": [] }, { "handle": "cyberhub.blog", "displayName": "CyberHub", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-22", "url": "https://bsky.app/profile/cyberhub.blog/post/3mr7agdtno72s", "origin": false, "authority": false, "github": [] }, { "handle": "termsofsurrender.bsky.social", "displayName": "AfterShock Index", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-22", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mr7joxowrf2g", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-21", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mr62lvr2v72h", "origin": false, "authority": false, "github": [] }, { "handle": "happeningnow.news", "displayName": "HappeningNow", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-21", "url": "https://bsky.app/profile/happeningnow.news/post/3mr6akwgum72q", "origin": false, "authority": false, "github": [] }, { "handle": "cve.skyfleet.blue", "displayName": "CVE Alerts ", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrwzmanf62c", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 1, "reach": 127, "posts": [ { "channel": "VulnerabilityNews", "channelTitle": "Vulnerability News", "tier": "news", "date": "2026-07-21", "views": 126, "forwards": 1, "url": "https://t.me/VulnerabilityNews/43589", "text": "CISA Adds Four Known Exploited Vulnerabilities to Catalog CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-63030 WordPress Core Interpretation Con", "github": [], "origin": false } ] }, "researchers": [ "Enesdex" ], "corroboration": { "poc": false, "xOrigin": false, "independent": [ "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-58644", "title": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "category": "Microsoft", "vendor": "Microsoft", "product": "SharePoint", "exploited": true, "publiclyDisclosed": false, "faq": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "SharePoint" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-58644", "source": "kev", "kev": { "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-502" ], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58644" ] }, "epss": 0.05058, "epssPercentile": 0.91431, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2026-07-14T17:17:14.257", "research": [ { "url": "https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review", "type": "writeup", "source": "Zero Day Initiative (ZDI)", "note": "ZDI review; CVE-2026-50522 sibling demoed at Pwn2Own Berlin" }, { "url": "https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/", "type": "writeup", "source": "Rapid7", "note": "ETR: unauthenticated RCE, KEV-listed, CVSS 9.8" }, { "url": "https://hivesecurity.gitlab.io/blog/cve-2026-58644-sharepoint-rce-incident-response/", "type": "writeup", "source": "Hive Security", "note": "IR-focused writeup; CWE-502, patch + compromise assessment" }, { "url": "https://www.penligent.ai/hackinglabs/cve-2026-58644/", "type": "writeup", "source": "Penligent", "note": "Technical deserialization deep-dive + detection guidance" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations", "type": "detection", "source": "CISA", "note": "Official hardening alert; KEV added Jul 16, 2026" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "type": "detection", "source": "Microsoft MSRC", "note": "Vendor advisory; patches KB5002653/54/55 per version" }, { "url": "https://cvefeed.io/vuln/detail/CVE-2026-58644", "type": "detection", "source": "CVEfeed.io", "note": "Aggregator; lists 7 GitHub PoCs (tab-gated, no direct URLs)" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58644", "type": "detection", "source": "NIST NVD", "note": "Official NVD entry; CWE-502, CVSS 9.8 Critical" } ], "x": { "mentions": 1, "aliases": [], "posts": [ { "handle": "MalwareBibleJP", "followers": 7678, "likes": 2, "createdAt": "2026-07-19", "url": "https://x.com/MalwareBibleJP/status/2078884829123445001", "github": [], "origin": false } ] }, "bsky": { "mentions": 21, "posts": [ { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-20", "url": "https://bsky.app/profile/thecybermind.co/post/3mr37da5yae2y", "origin": false, "authority": true, "github": [] }, { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-17", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mqtcaanzzb2m", "origin": false, "authority": true, "github": [] }, { "handle": "kotosecurity.bsky.social", "displayName": null, "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqx5yozm2c2o", "origin": false, "authority": false, "github": [] }, { "handle": "vulnsea.com", "displayName": "VulnSea", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-17", "url": "https://bsky.app/profile/vulnsea.com/post/3mqun3imxcw2r", "origin": false, "authority": false, "github": [] }, { "handle": "cyberhub.blog", "displayName": "CyberHub", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/cyberhub.blog/post/3mqqay4r2mv2t", "origin": false, "authority": false, "github": [] }, { "handle": "aegisbot.bsky.social", "displayName": "AEGIS // Threat Intel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-20", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3aoxg4hh2o", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 1, "reach": 6625, "posts": [ { "channel": "thehackernews", "channelTitle": "The Hacker News", "tier": "news", "date": "2026-07-17", "views": 6598, "forwards": 27, "url": "https://t.me/thehackernews/9531", "text": "Microsoft patched a SharePoint flaw after attackers had already exploited it as a zero-day. CVE-2026-58644 affects every supported on-premises SharePoint version and can lead to remote code execution. CISA has now added it to KEV. Here's what SharePoint admins need to check: https://thehackernews.com/2026/07/cisa-adds-exploited-sharepoint-rce-zero.html", "github": [], "origin": false } ] }, "corroboration": { "poc": false, "xOrigin": false, "independent": [ "x-mention" ], "level": "multi-source" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2026-25089", "title": "Fortinet FortiSandbox OS Command Injection Vulnerability", "category": "Fortinet", "vendor": "Fortinet", "product": "FortiSandbox", "exploited": true, "publiclyDisclosed": false, "faq": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "FortiSandbox" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089", "source": "kev", "kev": { "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-78" ], "references": [ "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-25089" ] }, "epss": 0.69827, "epssPercentile": 0.99303, "pocCount": 2, "pocTopStars": 6, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/HORKimhab/CVE-2026-25089", "stars": 6, "desc": "CVE-2026-25089 - Fortinet FortiSandbox", "createdAt": "2026-06-10", "hasCode": true }, { "url": "https://github.com/0xBlackash/CVE-2026-25089", "stars": 3, "desc": "CVE-2026-25089", "createdAt": "2026-06-12", "hasCode": true } ], "published": "2026-06-09T16:16:39.943", "research": [ { "url": "https://www.fortiguard.com/psirt/FG-IR-26-141", "type": "writeup", "source": "Fortinet PSIRT (official advisory)", "note": "Official vendor advisory; second-order OS cmd injection" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089", "type": "detection", "source": "NVD / NIST", "note": "NVD entry; CVSS 9.8 critical, CWE-78 confirmed" }, { "url": "https://www.tenable.com/cve/CVE-2026-25089", "type": "detection", "source": "Tenable Research", "note": "Tenable Vulnerability Watch classification entry" }, { "url": "https://cybersecuritynews.com/fortinet-fortisandbox-vulnerability-exploited/", "type": "writeup", "source": "CyberSecurityNews", "note": "Technical breakdown; reporter: Adham El Karn (Fortinet)" }, { "url": "https://thehackernews.com/2026/06/ivanti-fortinet-and-sap-release-patches.html", "type": "writeup", "source": "The Hacker News", "note": "Patch context; FortiSandbox Web UI unauthenticated RCE" }, { "url": "https://securityaffairs.com/193509/security/fortinet-patched-a-new-critical-fortisandbox-flaw.html", "type": "writeup", "source": "Security Affairs / Pierluigi Paganini", "note": "Summary writeup; no in-the-wild exploitation reported" }, { "url": "https://github.com/nomi-sec/PoC-in-GitHub/blob/master/2026/CVE-2026-25089.json", "type": "poc", "source": "nomi-sec/PoC-in-GitHub (aggregator)", "note": "GitHub PoC tracker entry; underlying repo unresolved", "hasCode": false }, { "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-073/", "type": "detection", "source": "Cyber Security Agency of Singapore (CSA)", "note": "Government alert urging immediate patch application" } ], "x": { "mentions": 3, "aliases": [], "posts": [ { "handle": "ptdbugs", "followers": 1502, "likes": 61, "createdAt": "2026-06-11", "url": "https://x.com/ptdbugs/status/2065015711924142538", "github": [], "origin": false }, { "handle": "CCBalert", "followers": 7212, "likes": 0, "createdAt": "2026-06-11", "url": "https://x.com/CCBalert/status/2065075395901194533", "github": [], "origin": false }, { "handle": "YogSoth0", "followers": 671, "likes": 0, "createdAt": "2026-06-10", "url": "https://x.com/YogSoth0/status/2064838632352239892", "github": [], "origin": false } ] }, "bsky": { "mentions": 18, "posts": [ { "handle": "iberianm.bsky.social", "displayName": "Citizen X", "likes": 0, "reposts": 1, "replies": 1, "createdAt": "2026-06-13", "url": "https://bsky.app/profile/iberianm.bsky.social/post/3mo67fgsf7n2r", "origin": false, "authority": false, "github": [] }, { "handle": "o2cloud.bsky.social", "displayName": "CVE by o2Cloud", "likes": 0, "reposts": 1, "replies": 1, "createdAt": "2026-06-10", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mnws6ecbbi2y", "origin": false, "authority": false, "github": [] }, { "handle": "blackhatnews.tokyo", "displayName": "blackhatnews.tokyo", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-06-17", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mohquqzh6a2d", "origin": false, "authority": false, "github": [] }, { "handle": "securitycyberuk.bsky.social", "displayName": "Security Cyber", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-06-10", "url": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mnx3gfta3s2d", "origin": false, "authority": false, "github": [] }, { "handle": "postac001.bsky.social", "displayName": "tec_acc", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-06-10", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mnxbqhtuxe2r", "origin": false, "authority": false, "github": [] }, { "handle": "technoholic.bsky.social", "displayName": "Technoholic.me", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-06-19", "url": "https://bsky.app/profile/technoholic.bsky.social/post/3moo3csgxk42f", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2026-39808", "title": "Fortinet FortiSandbox OS Command Injection Vulnerability", "category": "Fortinet", "vendor": "Fortinet", "product": "FortiSandbox", "exploited": true, "publiclyDisclosed": false, "faq": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "FortiSandbox" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "source": "kev", "kev": { "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-78" ], "references": [ "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-39808" ] }, "epss": 0.89691, "epssPercentile": 0.99775, "pocCount": 1, "pocTopStars": 0, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/error-inside/CVE-2026-39808", "stars": 0, "desc": "Fortinet FortiSandbox 4.4.0-4.4.8 - OS Command Injection via tracer-behavior Endpoint", "createdAt": "2026-06-18", "hasCode": true }, { "url": "https://github.com/HORKimhab/CVE-2026-39808", "stars": 0, "desc": "CVE-2026-39808 - Fortinet Sandbox - Draft", "createdAt": "2026-06-17", "hasCode": false } ], "published": "2026-04-14T16:16:44.860", "research": [ { "url": "https://github.com/samu-delucas/CVE-2026-39808", "type": "poc", "source": "GitHub / samu-delucas", "note": "Primary PoC; unauthenticated RCE as root via jid param", "hasCode": false }, { "url": "https://github.com/ynsmroztas/FortiSandbox-RCE-Exploit-CVE-2026-39808", "type": "poc", "source": "GitHub / ynsmroztas (mitsec)", "note": "Python RCE scanner; canary verify + Shodan dorks", "hasCode": true }, { "url": "https://github.com/error-inside/CVE-2026-39808", "type": "poc", "source": "GitHub / error-inside", "note": "Two-step inject+verify PoC, tracer-behavior endpoint", "hasCode": true }, { "url": "https://github.com/0xBlackash/CVE-2026-39808", "type": "poc", "source": "GitHub / 0xBlackash", "note": "Documented PoC; sandbox escape to root (uid=0)", "hasCode": true }, { "url": "https://github.com/projectdiscovery/nuclei-templates/releases", "type": "module", "source": "ProjectDiscovery / dhiyaneshdk", "note": "Nuclei template [CVE-2026-39808] critical, April 2026", "hasCode": true }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "type": "writeup", "source": "Fortinet PSIRT", "note": "Official advisory FG-IR-26-100; affected versions+patch" }, { "url": "https://www.crowdsec.net/vulntracking-report/cve-2026-39808-fortinet-fortisandbox-command-injection", "type": "detection", "source": "CrowdSec", "note": "Detection rule + 49 IPs tracked; early exploitation report" }, { "url": "https://projectdiscovery.io/blog/nuclei-templates-april-2026", "type": "writeup", "source": "ProjectDiscovery Blog", "note": "April 2026 Nuclei templates release; CVE-2026-39808 listed" } ], "x": { "mentions": 79, "aliases": [], "posts": [ { "handle": "MalwareObserver", "followers": 11, "likes": 0, "createdAt": "2026-07-20", "url": "https://x.com/MalwareObserver/status/2079280525265514912", "github": [ { "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg", "hasCode": true }, { "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg", "hasCode": true } ], "origin": false }, { "handle": "geovexintel", "followers": 999, "likes": 17, "createdAt": "2026-07-20", "url": "https://x.com/geovexintel/status/2079263366049063306", "github": [], "origin": false }, { "handle": "0x0SojalSec", "followers": 47743, "likes": 12, "createdAt": "2026-07-20", "url": "https://x.com/0x0SojalSec/status/2079262255892603372", "github": [], "origin": false }, { "handle": "NetSPI", "followers": 4074, "likes": 11, "createdAt": "2026-07-20", "url": "https://x.com/NetSPI/status/2079265470633381982", "github": [], "origin": false }, { "handle": "MalwareBibleJP", "followers": 7678, "likes": 6, "createdAt": "2026-07-20", "url": "https://x.com/MalwareBibleJP/status/2079323720771088529", "github": [], "origin": false }, { "handle": "ptdbugs", "followers": 2491, "likes": 5, "createdAt": "2026-07-20", "url": "https://x.com/ptdbugs/status/2079264509483515990", "github": [], "origin": false }, { "handle": "LupovisDefence", "followers": 575, "likes": 5, "createdAt": "2026-07-20", "url": "https://x.com/LupovisDefence/status/2079290355443269739", "github": [], "origin": false }, { "handle": "thingwhere", "followers": 8, "likes": 4, "createdAt": "2026-07-20", "url": "https://x.com/thingwhere/status/2079330106921607615", "github": [], "origin": false } ] }, "bsky": { "mentions": 18, "posts": [ { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 1, "reposts": 1, "replies": 0, "createdAt": "2026-04-16", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjmw4zfxor22", "origin": false, "authority": true, "github": [] }, { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-20", "url": "https://bsky.app/profile/thecybermind.co/post/3mr3cpqhc7y2v", "origin": false, "authority": true, "github": [] }, { "handle": "kotosecurity.bsky.social", "displayName": null, "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-19", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqzogcxreb2x", "origin": false, "authority": false, "github": [] }, { "handle": "alphahunt.io", "displayName": "AlphaHunt Converge", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/alphahunt.io/post/3mqwjqujt422d", "origin": false, "authority": false, "github": [] }, { "handle": "vulnsea.com", "displayName": "VulnSea", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/vulnsea.com/post/3mqrz3g3qbh26", "origin": false, "authority": false, "github": [] }, { "handle": "securityrss.bsky.social", "displayName": "securityrss.ai", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-18", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mqwbroccqx27", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 1, "reach": 361, "posts": [ { "channel": "p3Nt3st3rsTAr", "channelTitle": "[CVE Pentester] exploits forum", "tier": "underground", "date": "2026-04-22", "views": 361, "forwards": 0, "url": "https://t.me/p3Nt3st3rsTAr/24", "text": "https://github.com/p3Nt3st3r-sTAr/FortiSandbox-RCE-Exploit-CVE-2026-39808", "github": [ { "url": "https://github.com/p3Nt3st3r-sTAr/FortiSandbox-RCE-Exploit-CVE-2026-39808", "hasCode": true } ], "origin": true } ] }, "researchers": [ "samu-delucas", "error-inside", "0xBlackash", "ynsmroztas", "dhiyaneshdk" ], "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-46817", "title": "Oracle E-Business Suite Improper Privilege Management Vulnerability", "category": "Oracle", "vendor": "Oracle", "product": "E-Business Suite", "exploited": true, "publiclyDisclosed": false, "faq": "Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "E-Business Suite" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-46817", "source": "kev", "kev": { "dateAdded": "2026-07-15", "dueDate": "2026-07-18", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-269", "CWE-287", "CWE-306" ], "references": [ "https://www.oracle.com/security-alerts/cspumay2026.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-46817" ] }, "epss": 0.13309, "epssPercentile": 0.95996, "pocCount": 1, "pocTopStars": 1, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/0xBlackash/CVE-2026-46817", "stars": 1, "desc": "CVE-2026-46817", "createdAt": "2026-06-29", "hasCode": true } ], "published": "2026-05-28T21:16:31.503", "research": [ { "url": "https://defusedcyber.com/exploited/cve-2026-46817-oracle-e-business-suite", "type": "writeup", "source": "Defused Cyber", "note": "Honeypot telemetry; first ITW exploit captured Jun 27" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV", "note": "Official KEV entry added Jul 15 2026; patch mandate" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46817", "type": "detection", "source": "NIST NVD", "note": "Official NVD entry; CVSS 9.8, CWE-269/287/306" }, { "url": "https://www.oracle.com/security-alerts/cspumay2026.html", "type": "detection", "source": "Oracle", "note": "Vendor advisory; May 2026 CSPU patch source" }, { "url": "https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/", "type": "writeup", "source": "Help Net Security", "note": "Technical detail: ibytransmit XML payload, /etc/passwd" }, { "url": "https://rewterz.com/threat-advisory/oracle-e-business-suite-flaw-under-active-exploitation", "type": "detection", "source": "Rewterz", "note": "IOCs: attacker IP, UA string, CODEX_PULL_* scheme" }, { "url": "https://dailysecurityreview.com/cyber-security/attackers-hit-oracle-ebs-cve-2026-46817-days-after-patch/", "type": "writeup", "source": "Daily Security Review", "note": "XML DeliveryRequest payload structure described" }, { "url": "https://socradar.io/blog/cve-2026-46817-oracle-payments-takeover/", "type": "writeup", "source": "SOCRadar", "note": "Threat intel overview; detection & mitigation guidance" } ], "x": { "mentions": 4, "aliases": [], "posts": [ { "handle": "lyrie_ai", "followers": 317, "likes": 0, "createdAt": "2026-07-19", "url": "https://x.com/lyrie_ai/status/2078767126614077730", "github": [], "origin": false } ] }, "bsky": { "mentions": 22, "posts": [ { "handle": "bleepingcomputer.com", "displayName": "BleepingComputer", "likes": 3, "reposts": 5, "replies": 0, "createdAt": "2026-06-29", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mpgmrwrd2525", "origin": false, "authority": true, "github": [] }, { "handle": "shadowserver.bsky.social", "displayName": "The Shadowserver Foundation", "likes": 4, "reposts": 2, "replies": 1, "createdAt": "2026-07-01", "url": "https://bsky.app/profile/shadowserver.bsky.social/post/3mpldeactwk2n", "origin": false, "authority": true, "github": [] }, { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-19", "url": "https://bsky.app/profile/thecybermind.co/post/3mqybdbjmzb2p", "origin": false, "authority": true, "github": [] }, { "handle": "hacker.at.thenote.app", "displayName": "Hacker & Security News", "likes": 3, "reposts": 1, "replies": 0, "createdAt": "2026-06-30", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mpiz6ray5c2a", "origin": false, "authority": false, "github": [] }, { "handle": "kotosecurity.bsky.social", "displayName": null, "likes": 0, "reposts": 1, "replies": 1, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqrszjfqby23", "origin": false, "authority": false, "github": [] }, { "handle": "netsecio.bsky.social", "displayName": "CyberNetSecIO", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-17", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mqu6ksj3cd2q", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 4, "reach": 8816, "posts": [ { "channel": "thehackernews", "channelTitle": "The Hacker News", "tier": "news", "date": "2026-06-30", "views": 7997, "forwards": 19, "url": "https://t.me/thehackernews/9362", "text": "🚨 Oracle E-Business Suite has a new active exploitation problem. CVE-2026-46817 is a CVSS 9.8 flaw in Oracle Payments that can allow unauthenticated HTTP takeover. No public PoC. Attribution unknown. Read the full report: https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html", "github": [], "origin": false } ] }, "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2023-4346", "title": "KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability", "category": "KNX Association", "vendor": "KNX Association", "product": "KNX Protocol Connection Authorization Option 1", "exploited": true, "publiclyDisclosed": false, "faq": "KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. ", "cvss": 7.5, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "HIGH", "impact": null, "products": [ "KNX Protocol Connection Authorization Option 1" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-4346", "source": "kev", "kev": { "dateAdded": "2026-07-15", "dueDate": "2026-07-29", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-645" ], "references": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-4346" ] }, "epss": 0.00907, "epssPercentile": 0.56228, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2023-08-29T20:15:10.300", "research": [ { "url": "https://github.com/f0rw4rd/knxunlocker", "type": "poc", "source": "Felix Eberstaller / Limes Security (GitHub: f0rw4rd)", "note": "C# BCU key bruteforcer; dict+full keyspace modes", "hasCode": true }, { "url": "https://limessecurity.com/en/knxlock/", "type": "writeup", "source": "Limes Security", "note": "Original KNXlock campaign technical advisory (2021/2023)" }, { "url": "https://limessecurity.com/en/a-new-twist-in-the-knxlock-attack-campaign/", "type": "writeup", "source": "Limes Security", "note": "2024 update: readable-key variant, KNXunlocker release" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "type": "writeup", "source": "CISA ICS-CERT (ICSA-23-236-01)", "note": "Official ICS advisory; CVE assigned Aug 2023" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346", "type": "detection", "source": "CISA KEV Catalog", "note": "Added to KEV Jul 15 2026; BOD 26-04 deadline Jul 29" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4346", "type": "detection", "source": "NIST NVD", "note": "NVD entry; CVSS 7.5 HIGH, CWE-645" }, { "url": "https://github.com/advisories/GHSA-qccg-qqvh-pq7q", "type": "detection", "source": "GitHub Advisory Database", "note": "GHSA advisory; published Aug 29 2023", "hasCode": null }, { "url": "https://ccb.belgium.be/advisories/warning-cisa-added-actively-exploited-vulnerability-cve-2023-4346-knx-protocol-its-kev", "type": "detection", "source": "CCB Belgium (Centre for Cybersecurity Belgium)", "note": "Defensive advisory; mitigation steps for operators" } ], "x": { "mentions": 31, "aliases": [ "KNXlock" ], "posts": [ { "handle": "CCBalert", "followers": 7218, "likes": 2, "createdAt": "2026-07-16", "url": "https://x.com/CCBalert/status/2077778019649736779", "github": [], "origin": true }, { "handle": "8kSec", "followers": 3574, "likes": 46, "createdAt": "2026-07-13", "url": "https://x.com/8kSec/status/2076645610120233345", "github": [], "origin": false }, { "handle": "hackyboiz2", "followers": 204, "likes": 43, "createdAt": "2026-07-19", "url": "https://x.com/hackyboiz2/status/2078829209955533194", "github": [], "origin": false }, { "handle": "TheHackersNews", "followers": 1851846, "likes": 34, "createdAt": "2026-07-14", "url": "https://x.com/TheHackersNews/status/2077055767832883239", "github": [], "origin": false }, { "handle": "ptdbugs", "followers": 2491, "likes": 31, "createdAt": "2026-07-16", "url": "https://x.com/ptdbugs/status/2077629794737344696", "github": [], "origin": false }, { "handle": "CISACyber", "followers": 299806, "likes": 24, "createdAt": "2026-07-16", "url": "https://x.com/CISACyber/status/2077740069805273518", "github": [], "origin": false }, { "handle": "piyokango", "followers": 43826, "likes": 15, "createdAt": "2026-07-16", "url": "https://x.com/piyokango/status/2077888676730958170", "github": [], "origin": false }, { "handle": "MalwareBibleJP", "followers": 7678, "likes": 14, "createdAt": "2026-07-15", "url": "https://x.com/MalwareBibleJP/status/2077254587300667443", "github": [], "origin": false } ] }, "bsky": { "mentions": 8, "posts": [ { "handle": "kotosecurity.bsky.social", "displayName": null, "likes": 1, "reposts": 0, "replies": 1, "createdAt": "2026-07-19", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqzognw3sz2k", "origin": true, "authority": false, "github": [] }, { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/thecybermind.co/post/3mqsf2ua55a2l", "origin": false, "authority": true, "github": [] }, { "handle": "securityonline.bsky.social", "displayName": "Daily CyberSecurity", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mqq6zevtsw24", "origin": false, "authority": false, "github": [] }, { "handle": "kitafox.bsky.social", "displayName": "キタきつね", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-16", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mqqm4d4fsy2g", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqp7ytwxk72f", "origin": false, "authority": false, "github": [] }, { "handle": "thecircuitry.to", "displayName": "The Circuitry", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/thecircuitry.to/post/3mqpc3rakth2x", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 1, "reach": 148, "posts": [ { "channel": "VulnerabilityNews", "channelTitle": "Vulnerability News", "tier": "news", "date": "2026-07-15", "views": 147, "forwards": 1, "url": "https://t.me/VulnerabilityNews/43501", "text": "CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vul", "github": [], "origin": false } ] }, "aliases": [ "KNXlock" ], "researchers": [ "f0rw4rd" ], "corroboration": { "poc": false, "xOrigin": true, "independent": [ "x" ], "level": "multi-source" } }, { "cve": "CVE-2026-56155", "title": "Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ", "category": "Microsoft", "vendor": "Microsoft", "product": "Active Directory Federation Services", "exploited": true, "publiclyDisclosed": false, "faq": "Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "HIGH", "impact": null, "products": [ "Active Directory Federation Services" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-56155", "source": "kev", "kev": { "dateAdded": "2026-07-14", "dueDate": "2026-07-28", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-1220" ], "references": [ "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-56155", "https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide" ] }, "epss": 0.02333, "epssPercentile": 0.81791, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2026-07-14T17:17:09.763", "research": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155", "type": "detection", "source": "Microsoft MSRC", "note": "Official advisory; patch + Event ID 1132 detection" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV", "note": "KEV-listed 2026-07-14; due date 2026-07-28" }, { "url": "https://windowsnews.ai/article/patch-now-cisa-adds-two-microsoft-zero-days-and-two-sonicwall-flaws-to-must-fix-list.438204", "type": "writeup", "source": "Windows News", "note": "DKM ACL root cause; token-key theft impact" }, { "url": "https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review", "type": "writeup", "source": "ZDI / Trend Micro", "note": "ZDI July 2026 review; RCE-chain pivot risk" }, { "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/", "type": "writeup", "source": "BleepingComputer", "note": "Credits DART's Kingston & Clark; zero-day context" }, { "url": "https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164", "type": "writeup", "source": "Tenable Research", "note": "CVSSv3 7.8; DART credit; admin privesc impact" }, { "url": "https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/", "type": "writeup", "source": "Cisco Talos", "note": "Talos Patch Tuesday; insufficient ACL analysis" }, { "url": "https://vulnerability.circl.lu/vuln/CVE-2026-56155", "type": "detection", "source": "CIRCL Vulnerability-Lookup", "note": "Aggregated refs: NVD, MSRC, CISA KEV, GHSA" } ], "x": { "mentions": 0, "aliases": [], "posts": [] }, "bsky": { "mentions": 4, "posts": [ { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqmt3ncdul23", "origin": false, "authority": false, "github": [] }, { "handle": "blackhatnews.tokyo", "displayName": "blackhatnews.tokyo", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqmv7wcsti26", "origin": false, "authority": false, "github": [] }, { "handle": "securityrss.bsky.social", "displayName": "securityrss.ai", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mqn4kn2xsr2i", "origin": false, "authority": false, "github": [] }, { "handle": "securityonline.bsky.social", "displayName": "Daily CyberSecurity", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mqnc5xk42a23", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "corroboration": { "poc": false, "xOrigin": false, "independent": [], "level": "cisa-attributed" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2026-56164", "title": "Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability", "category": "Microsoft", "vendor": "Microsoft", "product": "SharePoint Server", "exploited": true, "publiclyDisclosed": false, "faq": "Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.", "cvss": 5.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "MEDIUM", "impact": null, "products": [ "SharePoint Server" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-56164", "source": "kev", "kev": { "dateAdded": "2026-07-14", "dueDate": "2026-07-17", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-306" ], "references": [ "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-56164" ] }, "epss": 0.20127, "epssPercentile": 0.97185, "pocCount": 0, "pocTopStars": 15, "pocConfidence": "reported", "pocRepos": [ { "url": "https://github.com/sentinel-aidefense/CVE-2026-56164-EXP", "stars": 15, "desc": "CVE-2026-56164 EOP Exploit", "createdAt": "2026-07-15", "hasCode": false } ], "published": "2026-07-14T17:17:09.907", "research": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164", "type": "writeup", "source": "Microsoft MSRC", "note": "Official vendor advisory; patch + AMSI mitigation details" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "KEV entry added 2026-07-14; due date 2026-07-17" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations", "type": "detection", "source": "CISA Alert AA26-195A", "note": "Active exploitation alert; hardening/triage guidance" }, { "url": "https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review", "type": "writeup", "source": "Zero Day Initiative (ZDI)", "note": "ZDI July 2026 review; CWE-306, unauthenticated EoP analysis" }, { "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/", "type": "writeup", "source": "BleepingComputer", "note": "Credits Frost/Mandiant & Jiang/FLARE; no exploit details public" }, { "url": "https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html", "type": "writeup", "source": "The Hacker News", "note": "Covers zero-day context; Mandiant/FLARE discovery attribution" }, { "url": "https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/", "type": "writeup", "source": "SecurityWeek", "note": "Zero-day roundup; unauthenticated network EoP confirmed" }, { "url": "https://zecurit.com/endpoint-management/patch-tuesday/", "type": "detection", "source": "Zecurit", "note": "Patch Tuesday analysis; AMSI Full mode interim mitigation" } ], "x": { "mentions": 106, "aliases": [], "posts": [ { "handle": "MalwareObserver", "followers": 9, "likes": 0, "createdAt": "2026-07-15", "url": "https://x.com/MalwareObserver/status/2077250553655005389", "github": [ { "url": "https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c", "hasCode": true }, { "url": "https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c", "hasCode": true } ], "origin": false }, { "handle": "MalwareBibleJP", "followers": 7624, "likes": 8, "createdAt": "2026-07-15", "url": "https://x.com/MalwareBibleJP/status/2077234644404273220", "github": [], "origin": false }, { "handle": "PentesterLab", "followers": 205348, "likes": 6, "createdAt": "2026-07-15", "url": "https://x.com/PentesterLab/status/2077227113070166264", "github": [], "origin": false }, { "handle": "steventseeley", "followers": 22728, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/steventseeley/status/2077260190261624985", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12486, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/Daily_CyberSec/status/2077198003673214982", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/__kokumoto/status/2077233338256073098", "github": [], "origin": false }, { "handle": "blackorbird", "followers": 42692, "likes": 1, "createdAt": "2026-07-15", "url": "https://x.com/blackorbird/status/2077268390000132431", "github": [], "origin": false }, { "handle": "pdnuclei_bot", "followers": 989, "likes": 1, "createdAt": "2026-07-15", "url": "https://x.com/pdnuclei_bot/status/2077256883522723949", "github": [], "origin": false } ] }, "bsky": { "mentions": 5, "posts": [ { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqmt3pfil62x", "origin": false, "authority": false, "github": [] }, { "handle": "securityonline.bsky.social", "displayName": "Daily CyberSecurity", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mqnjrcevrj2b", "origin": false, "authority": false, "github": [] }, { "handle": "stackflag.bsky.social", "displayName": "STACKFLAG", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqn7ovdxyj2q", "origin": false, "authority": false, "github": [] }, { "handle": "securityrss.bsky.social", "displayName": "securityrss.ai", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mqn4kn2xsr2i", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "researchers": [ "JaysonFrost_IR", "GenWeiJiang" ], "corroboration": { "poc": false, "xOrigin": false, "independent": [ "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-15409", "title": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability", "category": "SonicWall", "vendor": "SonicWall", "product": "SMA1000 Appliances", "exploited": true, "publiclyDisclosed": false, "faq": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.", "cvss": 10, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "SMA1000 Appliances" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-15409", "source": "kev", "kev": { "dateAdded": "2026-07-14", "dueDate": "2026-07-17", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-918" ], "references": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15409" ] }, "epss": 0.7844, "epssPercentile": 0.99539, "pocCount": 2, "pocTopStars": 26, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/remmons-r7/rapid7-CVE-2026-15409", "stars": 26, "desc": "This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang", "createdAt": "2026-07-15", "hasCode": true }, { "url": "https://github.com/0xBlackash/CVE-2026-15409", "stars": 3, "desc": "CVE-2026-15409", "createdAt": "2026-07-15", "hasCode": true }, { "url": "https://github.com/HORKimhab/CVE-2026-15409", "stars": 0, "desc": "CVE-2026-15409 - Dectect", "createdAt": "2026-07-15", "hasCode": false } ], "published": "2026-07-14T20:16:56.783", "research": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "type": "detection", "source": "SonicWall PSIRT", "note": "Official vendor advisory; patch + IOC guidance" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV", "note": "KEV listing; BOD 26-04 deadline 2026-07-17" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15409", "type": "detection", "source": "NIST NVD", "note": "CVSS 10.0 CRITICAL; full CVSSv3.1 metadata" }, { "url": "https://vulnerability.circl.lu/vuln/CVE-2026-15409", "type": "detection", "source": "CIRCL Vulnerability-Lookup", "note": "Aggregated vuln data; SSVC active/automatable" }, { "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/", "type": "writeup", "source": "BleepingComputer", "note": "Zero-day coverage; chain w/ CVE-2026-15410" }, { "url": "https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/", "type": "writeup", "source": "Help Net Security", "note": "Active exploitation confirmed; tandem exploit chain" } ], "x": { "mentions": 1, "aliases": [], "posts": [ { "handle": "OffensiveLab", "followers": 79, "likes": 0, "createdAt": "2026-07-15", "url": "https://x.com/OffensiveLab/status/2077267480154935347", "github": [], "origin": false } ] }, "bsky": { "mentions": 13, "posts": [ { "handle": "bleepingcomputer.com", "displayName": "BleepingComputer", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mqn5d4tfmq27", "origin": false, "authority": true, "github": [] }, { "handle": "securityonline.bsky.social", "displayName": "Daily CyberSecurity", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mqng6u6m3s2a", "origin": false, "authority": false, "github": [] }, { "handle": "cybernewsroom.bsky.social", "displayName": "Cyber Newsroom", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqnztgbmgi2p", "origin": false, "authority": false, "github": [] }, { "handle": "hapsis.bsky.social", "displayName": "Tomas Ström", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mqmvbuce4c2u", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqmzrvb4nk22", "origin": false, "authority": false, "github": [] }, { "handle": "blackhatnews.tokyo", "displayName": "blackhatnews.tokyo", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqmrct2poa2b", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 2, "posts": [ { "channel": "VulnerabilityNews", "channelTitle": "Vulnerability News", "tier": "news", "date": "2026-07-14", "views": 73, "forwards": 1, "url": "https://t.me/VulnerabilityNews/43452", "text": "SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates. [...] https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day", "github": [], "origin": false } ] }, "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2026-15410", "title": "SonicWall SMA1000 Appliances Code Injection Vulnerability", "category": "SonicWall", "vendor": "SonicWall", "product": "SMA1000 Appliances", "exploited": true, "publiclyDisclosed": false, "faq": "SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.", "cvss": 7.2, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "HIGH", "impact": null, "products": [ "SMA1000 Appliances" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-15410", "source": "kev", "kev": { "dateAdded": "2026-07-14", "dueDate": "2026-07-17", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-94" ], "references": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15410" ] }, "epss": 0.76347, "epssPercentile": 0.99485, "pocCount": 1, "pocTopStars": 0, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/HORKimhab/CVE-2026-15410", "stars": 0, "desc": "CVE-2026-15410 - More: https://github.com/HORKimhab/poc-cve-collection", "createdAt": "2026-07-15", "hasCode": true } ], "published": "2026-07-14T20:16:56.903", "research": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "type": "detection", "source": "SonicWall PSIRT (SNWLID-2026-0008)", "note": "Official vendor advisory; patch & IoC guidance" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15410", "type": "detection", "source": "NIST NVD", "note": "NVD entry; CVSS 7.2 HIGH, CWE-94, active exploit" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "KEV listed 2026-07-14; BOD 26-04 patch deadline" }, { "url": "https://vulnerability.circl.lu/vuln/CVE-2026-15410", "type": "detection", "source": "CIRCL Vulnerability-Lookup", "note": "Aggregated vuln data; CWE-94 code injection detail" }, { "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/", "type": "writeup", "source": "BleepingComputer", "note": "Zero-day chaining w/ CVE-2026-15409 confirmed ITW" }, { "url": "https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/", "type": "writeup", "source": "Help Net Security", "note": "Tandem exploit confirmed; discoverer Adam Babis/PSIRT" }, { "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-033/", "type": "detection", "source": "CSA Singapore (AL-2026-033)", "note": "Govt advisory; immediate patch recommended" }, { "url": "https://hackread.com/sonicwall-sma-appliances-exploited-zero-day-attacks/", "type": "writeup", "source": "HackRead", "note": "AMC attack surface & mitigation steps covered" } ], "x": { "mentions": 0, "aliases": [], "posts": [] }, "bsky": { "mentions": 10, "posts": [ { "handle": "bleepingcomputer.com", "displayName": "BleepingComputer", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mqn5d4tfmq27", "origin": false, "authority": true, "github": [] }, { "handle": "cybernewsroom.bsky.social", "displayName": "Cyber Newsroom", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqnztgbmgi2p", "origin": false, "authority": false, "github": [] }, { "handle": "blackhatnews.tokyo", "displayName": "blackhatnews.tokyo", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-15", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqny4xcime2x", "origin": false, "authority": false, "github": [] }, { "handle": "hapsis.bsky.social", "displayName": "Tomas Ström", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mqmvbuce4c2u", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqmzrxebkp2p", "origin": false, "authority": false, "github": [] }, { "handle": "hendryadrian.bsky.social", "displayName": "Cybersecurity News Everyday", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqnefpclnf2a", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 2, "posts": [ { "channel": "VulnerabilityNews", "channelTitle": "Vulnerability News", "tier": "news", "date": "2026-07-14", "views": 73, "forwards": 1, "url": "https://t.me/VulnerabilityNews/43452", "text": "SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates. [...] https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day", "github": [], "origin": false } ] }, "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc" ], "level": "multi-source" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2008-4128", "title": "Cisco IOS Cross-Site Request Forgery Vulnerability", "category": "Cisco", "vendor": "Cisco", "product": "IOS", "exploited": true, "publiclyDisclosed": false, "faq": "Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.", "cvss": 4.3, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "MEDIUM", "impact": null, "products": [ "IOS" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2008-4128", "source": "kev", "kev": { "dateAdded": "2026-07-13", "dueDate": "2026-07-16", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-352" ], "references": [ "https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2008-4128" ] }, "epss": 0.32953, "epssPercentile": 0.98188, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2008-09-18T20:00:00.530", "research": [ { "url": "https://www.exploit-db.com/exploits/6476", "type": "poc", "source": "Exploit-DB (EDB-ID 6476)", "note": "CSRF PoC #1: show privilege via /level/15/exec/-" }, { "url": "https://www.exploit-db.com/exploits/6477", "type": "poc", "source": "Exploit-DB (EDB-ID 6477)", "note": "CSRF PoC #2: alias exec via /level/15/exec/-/configure/http" }, { "url": "http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html", "type": "writeup", "source": "jbrownsec (original discloser blog)", "note": "Original 0day disclosure blog post, Sept 2008" }, { "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45226", "type": "writeup", "source": "IBM X-Force (cisco-router-csrf/45226)", "note": "IBM X-Force VDB entry: cisco-router-csrf(45226)" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4128", "type": "writeup", "source": "NIST NVD", "note": "Official NVD advisory with references & scoring" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "Added to KEV 2026-07-13; active exploitation confirmed" }, { "url": "https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html", "type": "detection", "source": "Cisco (vendor mitigation)", "note": "Cisco IOS 12.4 EOL/obsolete page; official mitigation" }, { "url": "https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF", "type": "detection", "source": "NSA/DoD (CSA_IMPROVE_ROUTER_HYGIENE)", "note": "NSA/DoD CSA: router hygiene guidance referencing CVE" } ], "x": { "mentions": 23, "aliases": [], "posts": [ { "handle": "MalwareBibleJP", "followers": 7624, "likes": 89, "createdAt": "2026-07-02", "url": "https://x.com/MalwareBibleJP/status/2072532472366252391", "github": [], "origin": false }, { "handle": "piyokango", "followers": 43666, "likes": 17, "createdAt": "2026-07-14", "url": "https://x.com/piyokango/status/2076873110486405486", "github": [], "origin": false }, { "handle": "CISACyber", "followers": 299586, "likes": 14, "createdAt": "2026-07-14", "url": "https://x.com/CISACyber/status/2077088886715469846", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 2, "createdAt": "2026-07-13", "url": "https://x.com/__kokumoto/status/2076803357294117350", "github": [], "origin": false }, { "handle": "rahmid3mir", "followers": 346, "likes": 2, "createdAt": "2026-07-14", "url": "https://x.com/rahmid3mir/status/2076960536235761956", "github": [], "origin": false }, { "handle": "f1tym1", "followers": 999, "likes": 1, "createdAt": "2026-07-13", "url": "https://x.com/f1tym1/status/2076768504838054216", "github": [], "origin": false }, { "handle": "DC3DCISE", "followers": 728, "likes": 1, "createdAt": "2026-07-03", "url": "https://x.com/DC3DCISE/status/2073060948286263696", "github": [], "origin": false }, { "handle": "PCMedicalist", "followers": 116, "likes": 1, "createdAt": "2026-07-14", "url": "https://x.com/PCMedicalist/status/2077121529259688085", "github": [], "origin": false } ] }, "bsky": { "mentions": 7, "posts": [ { "handle": "secdb.bsky.social", "displayName": "ZEN SecDB", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mqketpxyi62r", "origin": false, "authority": true, "github": [] }, { "handle": "suriq.io", "displayName": "Suriq - Always on Watch", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/suriq.io/post/3mqlit67few22", "origin": false, "authority": false, "github": [] }, { "handle": "blackhatnews.tokyo", "displayName": "blackhatnews.tokyo", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqlvy3ls3e25", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqk7rgvkgi27", "origin": false, "authority": false, "github": [] }, { "handle": "qiancx.bsky.social", "displayName": "qian.cx", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/qiancx.bsky.social/post/3mqk7ydvawh23", "origin": false, "authority": false, "github": [] }, { "handle": "happeningnow.news", "displayName": "HappeningNow", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/happeningnow.news/post/3mqkf7zlzh32k", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "researchers": [ "jbrownsec" ], "corroboration": { "poc": false, "xOrigin": false, "independent": [ "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-56291", "title": "Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability", "category": "Balbooa", "vendor": "Balbooa", "product": "Forms", "exploited": true, "publiclyDisclosed": false, "faq": "Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "Forms" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-56291", "source": "kev", "kev": { "dateAdded": "2026-07-10", "dueDate": "2026-07-13", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-434" ], "references": [ "https://www.balbooa.com/joomla-forms", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-56291" ] }, "epss": 0.76066, "epssPercentile": 0.99481, "pocCount": 3, "pocTopStars": 1, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/shinthink/CVE-2026-56291", "stars": 1, "desc": "Balbooa Forms (com_baforms) < 2.4.1 — Unauthenticated File Upload to RCE via form.uploadAttachmentFile | CVSS 9.8 | CISA KEV", "createdAt": "2026-07-11", "hasCode": true }, { "url": "https://github.com/rimbadirgantara/CVE-2026-56291.yaml", "stars": 0, "desc": "nuclei template for CVE-2026-56291", "createdAt": "2026-07-13", "hasCode": true }, { "url": "https://github.com/ChiefYoru/CVE-2026-56291_PoC", "stars": 0, "desc": "The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.", "createdAt": "2026-07-18", "hasCode": true } ], "published": "2026-07-09T11:16:40.990", "research": [ { "url": "https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/", "type": "writeup", "source": "mySites.guru / Phil Taylor (discoverer)", "note": "Original disclosure; no PoC released by author" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog (official)", "note": "KEV listing; active exploitation confirmed Jul 10 2026" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56291", "type": "detection", "source": "NVD / NIST", "note": "Official CVE record; CVSS 4.0 score 10.0" }, { "url": "https://www.cycognito.com/blog/emerging-threat-cve-2026-56291-balbooa-forms-remote-code-execution-via-unauthenticated-file-upload/", "type": "writeup", "source": "CyCognito", "note": "Threat advisory; detection & remediation guidance" }, { "url": "https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "type": "writeup", "source": "The Hacker News", "note": "News writeup; zero-day + KEV context" }, { "url": "https://htprotect.org/en/balbooa-forms", "type": "detection", "source": "HTProtect.org", "note": "Defensive update guide; IoC checklist included" }, { "url": "https://cve.threatint.eu/CVE/CVE-2026-56291", "type": "detection", "source": "THREATINT", "note": "CVE aggregator; CVSS 4.0 vector + KEV status" }, { "url": "https://www.securityweek.com/organizations-warned-of-exploited-joomla-extension-vulnerabilities/", "type": "writeup", "source": "SecurityWeek", "note": "Coverage of zero-day exploitation in the wild" } ], "x": { "mentions": 101, "aliases": [], "posts": [ { "handle": "MalwareObserver", "followers": 9, "likes": 0, "createdAt": "2026-07-15", "url": "https://x.com/MalwareObserver/status/2077250553655005389", "github": [ { "url": "https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c", "hasCode": true }, { "url": "https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c", "hasCode": true } ], "origin": false }, { "handle": "ptdbugs", "followers": 2380, "likes": 13, "createdAt": "2026-07-14", "url": "https://x.com/ptdbugs/status/2076934981381693826", "github": [], "origin": false }, { "handle": "MalwareBibleJP", "followers": 7624, "likes": 8, "createdAt": "2026-07-15", "url": "https://x.com/MalwareBibleJP/status/2077234644404273220", "github": [], "origin": false }, { "handle": "PentesterLab", "followers": 205348, "likes": 6, "createdAt": "2026-07-15", "url": "https://x.com/PentesterLab/status/2077227113070166264", "github": [], "origin": false }, { "handle": "steventseeley", "followers": 22728, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/steventseeley/status/2077260190261624985", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12486, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/Daily_CyberSec/status/2077198003673214982", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/__kokumoto/status/2077233338256073098", "github": [], "origin": false }, { "handle": "blackorbird", "followers": 42692, "likes": 1, "createdAt": "2026-07-15", "url": "https://x.com/blackorbird/status/2077268390000132431", "github": [], "origin": false } ] }, "bsky": { "mentions": 21, "posts": [ { "handle": "vulnsea.com", "displayName": "VulnSea", "likes": 3, "reposts": 0, "replies": 0, "createdAt": "2026-07-11", "url": "https://bsky.app/profile/vulnsea.com/post/3mqfjy535kc2p", "origin": false, "authority": false, "github": [] }, { "handle": "eyalestrin.bsky.social", "displayName": "Eyal Estrin ☁️", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mqli7q37zh2a", "origin": false, "authority": false, "github": [] }, { "handle": "ahmandonk.bsky.social", "displayName": "Ahmandonk", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mqloi5uyei22", "origin": false, "authority": false, "github": [] }, { "handle": "cybernewsroom.bsky.social", "displayName": "Cyber Newsroom", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfm3n2vp2f", "origin": false, "authority": false, "github": [] }, { "handle": "toxy4ny.bsky.social", "displayName": "KL3FT3Z", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mqkmnbpmtc2n", "origin": false, "authority": false, "github": [] }, { "handle": "newssecia.bsky.social", "displayName": null, "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mqj5wg6v462s", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 2, "posts": [ { "channel": "PentestingNews", "channelTitle": "Pentesting News", "tier": "news", "date": "2026-07-13", "views": 440, "forwards": 2, "url": "https://t.me/PentestingNews/75097", "text": "CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities https://thecyberexpress.com/cisa-cve-2026-48939-cve-2026-56291/", "github": [], "origin": false } ] }, "researchers": [ "philtaylor_mysitesguru" ], "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-48939", "title": "iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability", "category": "iCagenda", "vendor": "iCagenda", "product": "iCagenda", "exploited": true, "publiclyDisclosed": false, "faq": "iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "iCagenda" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-48939", "source": "kev", "kev": { "dateAdded": "2026-07-10", "dueDate": "2026-07-13", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-434" ], "references": [ "https://www.icagenda.com/#download", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48939" ] }, "epss": 0.24347, "epssPercentile": 0.97638, "pocCount": 2, "pocTopStars": 2, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/shinthink/CVE-2026-48939", "stars": 2, "desc": "Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)", "createdAt": "2026-07-05", "hasCode": true }, { "url": "https://github.com/ChiefYoru/CVE-2026-48939_PoC", "stars": 0, "desc": "iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.", "createdAt": "2026-07-18", "hasCode": true }, { "url": "https://github.com/Polosss/By-Poloss..-..CVE-2026-48939", "stars": 1, "desc": "iCagenda Unauthenticated File Upload to RCE", "createdAt": "2026-06-29", "hasCode": false } ], "published": "2026-06-20T13:16:42.433", "research": [ { "url": "https://github.com/shinthink/CVE-2026-48939", "type": "poc", "source": "GitHub / shinthink", "note": "Python mass-exploit: upload shell.php → RCE, CVSS 10", "hasCode": true }, { "url": "https://github.com/Polosss/By-Poloss..-..CVE-2026-48939", "type": "poc", "source": "GitHub / Polosss (CISA-ADP tagged exploit)", "note": "Bash/curl PoC; tagged exploit in official CVE record", "hasCode": false }, { "url": "https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/", "type": "writeup", "source": "mySites.guru / Phil Taylor (finder)", "note": "Original discovery writeup; code-review + end-to-end repro" }, { "url": "https://www.ionix.io/threat-center/cve-2026-48939/", "type": "writeup", "source": "IONIX Research", "note": "Root-cause analysis, IOCs, CVSS vector breakdown" }, { "url": "https://www.sentinelone.com/vulnerability-database/cve-2026-48939/", "type": "writeup", "source": "SentinelOne Vulnerability Database", "note": "Technical flow: POST upload → GET shell execution path" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV Catalog", "note": "KEV listing; BOD 26-04 mandate; patch deadline Jul 13 2026" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48939", "type": "detection", "source": "NIST NVD", "note": "Official CVE record; CVSS 4.0=10.0; CWE-284" }, { "url": "https://app.opencve.io/cve/CVE-2026-48939", "type": "detection", "source": "OpenCVE / CISA-ADP Vulnrichment", "note": "Structured CVE record; credits Phil Taylor as finder" } ], "x": { "mentions": 104, "aliases": [], "posts": [ { "handle": "MalwareObserver", "followers": 9, "likes": 0, "createdAt": "2026-07-15", "url": "https://x.com/MalwareObserver/status/2077250553655005389", "github": [ { "url": "https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c", "hasCode": true }, { "url": "https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c", "hasCode": true } ], "origin": false }, { "handle": "MalwareBibleJP", "followers": 7624, "likes": 8, "createdAt": "2026-07-15", "url": "https://x.com/MalwareBibleJP/status/2077234644404273220", "github": [], "origin": false }, { "handle": "PentesterLab", "followers": 205348, "likes": 6, "createdAt": "2026-07-15", "url": "https://x.com/PentesterLab/status/2077227113070166264", "github": [], "origin": false }, { "handle": "piyokango", "followers": 43666, "likes": 6, "createdAt": "2026-07-13", "url": "https://x.com/piyokango/status/2076502207483232651", "github": [], "origin": false }, { "handle": "steventseeley", "followers": 22728, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/steventseeley/status/2077260190261624985", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12486, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/Daily_CyberSec/status/2077198003673214982", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 2, "createdAt": "2026-07-15", "url": "https://x.com/__kokumoto/status/2077233338256073098", "github": [], "origin": false }, { "handle": "PCMedicalist", "followers": 116, "likes": 2, "createdAt": "2026-07-13", "url": "https://x.com/PCMedicalist/status/2076727231766790414", "github": [], "origin": false } ] }, "bsky": { "mentions": 22, "posts": [ { "handle": "eyalestrin.bsky.social", "displayName": "Eyal Estrin ☁️", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mqli7q37zh2a", "origin": false, "authority": false, "github": [] }, { "handle": "ahmandonk.bsky.social", "displayName": "Ahmandonk", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-14", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mqloi5uyei22", "origin": false, "authority": false, "github": [] }, { "handle": "cybernewsroom.bsky.social", "displayName": "Cyber Newsroom", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfhxw7if2k", "origin": false, "authority": false, "github": [] }, { "handle": "toxy4ny.bsky.social", "displayName": "KL3FT3Z", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mqkmnbpmtc2n", "origin": false, "authority": false, "github": [] }, { "handle": "newssecia.bsky.social", "displayName": null, "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mqj5wg6v462s", "origin": false, "authority": false, "github": [] }, { "handle": "securityrss.bsky.social", "displayName": "securityrss.ai", "likes": 0, "reposts": 1, "replies": 0, "createdAt": "2026-07-13", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mqjplozg4p2v", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 2, "posts": [ { "channel": "PentestingNews", "channelTitle": "Pentesting News", "tier": "news", "date": "2026-07-13", "views": 440, "forwards": 2, "url": "https://t.me/PentestingNews/75097", "text": "CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities https://thecyberexpress.com/cisa-cve-2026-48939-cve-2026-56291/", "github": [], "origin": false } ] }, "researchers": [ "Polosss" ], "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-48908", "title": "JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability", "category": "JoomShaper", "vendor": "JoomShaper", "product": "SP Page Builder", "exploited": true, "publiclyDisclosed": false, "faq": "JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "SP Page Builder" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-48908", "source": "kev", "kev": { "dateAdded": "2026-07-07", "dueDate": "2026-07-10", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-434" ], "references": [ "https://extensions.joomla.org/extension/sp-page-builder/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48908" ] }, "epss": 0.8813, "epssPercentile": 0.99751, "pocCount": 5, "pocTopStars": 15, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/papageo75/CVE-2026-48908-PoC", "stars": 15, "desc": "Unauthenticated RCE PoC for CVE-2026-48908 — SP Page Builder for Joomla (≤ 6.6.1): arbitrary file upload via asset.uploadCustomIcon. Self-cleaning, token-guarde", "createdAt": "2026-06-22", "hasCode": true }, { "url": "https://github.com/0xBlackash/CVE-2026-48908", "stars": 2, "desc": "CVE-2026-48908", "createdAt": "2026-06-24", "hasCode": true }, { "url": "https://github.com/Jenderal92/CVE-2026-48908", "stars": 2, "desc": "CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For", "createdAt": "2026-07-07", "hasCode": true }, { "url": "https://github.com/gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla", "stars": 0, "desc": "CVE-2026-48908 - SP Page Builder Joomla Unauthenticated RCE", "createdAt": "2026-06-24", "hasCode": true }, { "url": "https://github.com/ayiezola/CVE-2026-48908", "stars": 0, "desc": "Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.", "createdAt": "2026-06-28", "hasCode": true } ], "published": "2026-06-20T13:16:42.080", "research": [], "x": { "mentions": 76, "aliases": [], "posts": [ { "handle": "vutruso", "followers": 38, "likes": 0, "createdAt": "2026-07-08", "url": "https://x.com/vutruso/status/2074690046486290926", "github": [ { "url": "https://github.com/V4bel/Januscape", "hasCode": true } ], "origin": false }, { "handle": "nebusecurity", "followers": 4500, "likes": 240, "createdAt": "2026-07-08", "url": "https://x.com/nebusecurity/status/2074663573742338256", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 7, "createdAt": "2026-07-08", "url": "https://x.com/__kokumoto/status/2074698589713154281", "github": [], "origin": false }, { "handle": "yousukezan", "followers": 14384, "likes": 6, "createdAt": "2026-07-08", "url": "https://x.com/yousukezan/status/2074650902166913222", "github": [], "origin": false }, { "handle": "ridvanyagli", "followers": 1120, "likes": 6, "createdAt": "2026-07-08", "url": "https://x.com/ridvanyagli/status/2074701200167952860", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12430, "likes": 5, "createdAt": "2026-07-08", "url": "https://x.com/Daily_CyberSec/status/2074678524191855020", "github": [], "origin": false }, { "handle": "oss_security", "followers": 4646, "likes": 4, "createdAt": "2026-07-08", "url": "https://x.com/oss_security/status/2074685116626907570", "github": [], "origin": false }, { "handle": "ohhara_shiojiri", "followers": 2004, "likes": 1, "createdAt": "2026-07-08", "url": "https://x.com/ohhara_shiojiri/status/2074727301179408802", "github": [], "origin": false } ] }, "bsky": { "mentions": 43, "posts": [ { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 5, "reposts": 1, "replies": 0, "createdAt": "2026-07-02", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpnkwum44r2x", "origin": true, "authority": true, "github": [] }, { "handle": "bleepingcomputer.com", "displayName": "BleepingComputer", "likes": 4, "reposts": 2, "replies": 0, "createdAt": "2026-07-01", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mpmd2ruarv2l", "origin": true, "authority": true, "github": [] }, { "handle": "campuscodi.risky.biz", "displayName": "Catalin Cimpanu", "likes": 2, "reposts": 1, "replies": 2, "createdAt": "2026-07-03", "url": "https://bsky.app/profile/campuscodi.risky.biz/post/3mpq6imguic2y", "origin": true, "authority": true, "github": [] }, { "handle": "trinacriatech.bsky.social", "displayName": null, "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-06", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mpyxq7y6oc2z", "origin": true, "authority": false, "github": [] }, { "handle": "ahmandonk.bsky.social", "displayName": "Ahmandonk", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-05", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mpvwgjir5j2r", "origin": true, "authority": false, "github": [] }, { "handle": "blindthoughts.bsky.social", "displayName": "blindthoughts.bsky.social", "likes": 2, "reposts": 0, "replies": 0, "createdAt": "2026-07-02", "url": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mpnbpwhb5427", "origin": true, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2026-55255", "title": "Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "category": "Langflow", "vendor": "Langflow", "product": "Langflow", "exploited": true, "publiclyDisclosed": false, "faq": "Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.", "cvss": 8.4, "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "severity": "HIGH", "impact": null, "products": [ "Langflow" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-55255", "source": "kev", "kev": { "dateAdded": "2026-07-07", "dueDate": "2026-07-10", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-639" ], "references": [ "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-55255" ] }, "epss": 0.29052, "epssPercentile": 0.97967, "pocCount": 0, "pocTopStars": 0, "pocConfidence": "none", "pocRepos": [], "published": "2026-06-23T17:17:08.050", "research": [], "x": { "mentions": 0, "aliases": [], "posts": [] }, "bsky": { "mentions": 8, "posts": [ { "handle": "suriq.io", "displayName": "Suriq - Always on Watch", "likes": 2, "reposts": 0, "replies": 1, "createdAt": "2026-06-19", "url": "https://bsky.app/profile/suriq.io/post/3mook75kc3e2d", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mq36dr4s372w", "origin": false, "authority": false, "github": [] }, { "handle": "cyberhub.blog", "displayName": "CyberHub", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-06-25", "url": "https://bsky.app/profile/cyberhub.blog/post/3mp3fj5b7sq2n", "origin": false, "authority": false, "github": [] }, { "handle": "shiojiri.com", "displayName": "ohhara", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-08", "url": "https://bsky.app/profile/shiojiri.com/post/3mq4cpumcxcfn", "origin": false, "authority": false, "github": [] }, { "handle": "stackflag.bsky.social", "displayName": "STACKFLAG", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mq354ildoj2e", "origin": false, "authority": false, "github": [] }, { "handle": "csirts.bsky.social", "displayName": "CSIRTS.COM", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/csirts.bsky.social/post/3mq34zqafiw2q", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 1, "posts": [ { "channel": "VulnerabilityNews", "channelTitle": "Vulnerability News", "tier": "news", "date": "2026-07-07", "views": 41, "forwards": 1, "url": "https://t.me/VulnerabilityNews/43355", "text": "CISA Adds Three Known Exploited Vulnerabilities to Catalog CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-55255 Langflow Authorization Bypass Through User-Controlled Key Vulnerability CVE-2026-5629", "github": [], "origin": false } ] }, "corroboration": { "poc": false, "xOrigin": false, "independent": [], "level": "cisa-attributed" }, "aliases": [], "researchers": [] }, { "cve": "CVE-2026-56290", "title": "Joomlack Page Builder Improper Access Control Vulnerability", "category": "Joomlack", "vendor": "Joomlack", "product": "Page Builder", "exploited": true, "publiclyDisclosed": false, "faq": "Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "Page Builder" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-56290", "source": "kev", "kev": { "dateAdded": "2026-07-07", "dueDate": "2026-07-10", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-284" ], "references": [ "https://www.joomlack.fr/en/joomla-extensions/page-builder-ck", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-56290" ] }, "epss": 0.83254, "epssPercentile": 0.99649, "pocCount": 4, "pocTopStars": 3, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/shinthink/pbck-exploit", "stars": 3, "desc": "📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE", "createdAt": "2026-07-04", "hasCode": true }, { "url": "https://github.com/Jenderal92/CVE-2026-56290", "stars": 3, "desc": "CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass, PHP shell uploader", "createdAt": "2026-07-08", "hasCode": true }, { "url": "https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit", "stars": 2, "desc": "Page Builder CK for Joomla - Unauthenticated SSRF / Remote File Write leading to PHP execution Exploiter", "createdAt": "2026-07-03", "hasCode": true }, { "url": "https://github.com/ChiefYoru/CVE-2026-56290_PoC", "stars": 0, "desc": "The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.", "createdAt": "2026-07-19", "hasCode": true } ], "published": "2026-06-29T15:16:42.360", "research": [ { "url": "https://github.com/shinthink/pbck-exploit", "type": "poc", "source": "GitHub / shinthink", "note": "Mass exploit framework; unauthenticated file upload→RCE", "hasCode": true }, { "url": "https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/", "type": "writeup", "source": "mySites.guru / Phil Taylor (finder)", "note": "Discoverer writeup; source-diff & live exploitation confirmed" }, { "url": "https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog", "type": "detection", "source": "CISA KEV", "note": "Added to KEV catalog 2026-07-07; patch mandated" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56290", "type": "detection", "source": "NVD / NIST", "note": "Official CVE record; CVSS 10.0, CWE-284/CWE-434" }, { "url": "https://www.sentinelone.com/vulnerability-database/cve-2026-56290/", "type": "writeup", "source": "SentinelOne Vulnerability DB", "note": "Technical breakdown; detection IOCs; affected versions" }, { "url": "https://www.ionix.io/threat-center/cve-2026-56290/", "type": "writeup", "source": "IONIX Threat Center", "note": "Root cause, attack vector, in-wild exploitation details" }, { "url": "https://ccb.belgium.be/advisories/warning-critical-unauthenticated-arbitrary-file-upload-vulnerability-cve-2026-56290", "type": "detection", "source": "CCB Belgium (national CERT)", "note": "Govt advisory; patch & monitoring guidance" }, { "url": "https://app.opencve.io/cve/CVE-2026-56290", "type": "detection", "source": "OpenCVE / CISA ADP Vulnrichment", "note": "Structured CVE record with CISA SSVC enrichment" } ], "x": { "mentions": 75, "aliases": [], "posts": [ { "handle": "vutruso", "followers": 38, "likes": 0, "createdAt": "2026-07-08", "url": "https://x.com/vutruso/status/2074690046486290926", "github": [ { "url": "https://github.com/V4bel/Januscape", "hasCode": true } ], "origin": false }, { "handle": "nebusecurity", "followers": 4500, "likes": 240, "createdAt": "2026-07-08", "url": "https://x.com/nebusecurity/status/2074663573742338256", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 7, "createdAt": "2026-07-08", "url": "https://x.com/__kokumoto/status/2074698589713154281", "github": [], "origin": false }, { "handle": "yousukezan", "followers": 14384, "likes": 6, "createdAt": "2026-07-08", "url": "https://x.com/yousukezan/status/2074650902166913222", "github": [], "origin": false }, { "handle": "ridvanyagli", "followers": 1120, "likes": 6, "createdAt": "2026-07-08", "url": "https://x.com/ridvanyagli/status/2074701200167952860", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12430, "likes": 5, "createdAt": "2026-07-08", "url": "https://x.com/Daily_CyberSec/status/2074678524191855020", "github": [], "origin": false }, { "handle": "oss_security", "followers": 4646, "likes": 4, "createdAt": "2026-07-08", "url": "https://x.com/oss_security/status/2074685116626907570", "github": [], "origin": false }, { "handle": "ohhara_shiojiri", "followers": 2004, "likes": 1, "createdAt": "2026-07-08", "url": "https://x.com/ohhara_shiojiri/status/2074727301179408802", "github": [], "origin": false } ] }, "bsky": { "mentions": 15, "posts": [ { "handle": "cyberhub.blog", "displayName": "CyberHub", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-03", "url": "https://bsky.app/profile/cyberhub.blog/post/3mppkw5emi42f", "origin": false, "authority": false, "github": [] }, { "handle": "shiojiri.com", "displayName": "ohhara", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-08", "url": "https://bsky.app/profile/shiojiri.com/post/3mq4cpumcxcfn", "origin": false, "authority": false, "github": [] }, { "handle": "csirts.bsky.social", "displayName": "CSIRTS.COM", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/csirts.bsky.social/post/3mq34zqoytw2d", "origin": false, "authority": false, "github": [] }, { "handle": "cvesentinel.bsky.social", "displayName": "CVESentinel", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mq36drvbnv2c", "origin": false, "authority": false, "github": [] }, { "handle": "stackflag.bsky.social", "displayName": "STACKFLAG", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mq354jypwd2k", "origin": false, "authority": false, "github": [] }, { "handle": "qiancx.bsky.social", "displayName": "qian.cx", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-05", "url": "https://bsky.app/profile/qiancx.bsky.social/post/3mpweckcrlh2r", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 0, "posts": [] }, "researchers": [ "philtaylor_mysitesguru" ], "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-48282", "title": "Adobe ColdFusion Path Traversal Vulnerability", "category": "Adobe", "vendor": "Adobe", "product": "ColdFusion", "exploited": true, "publiclyDisclosed": false, "faq": "Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.", "cvss": 10, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "CRITICAL", "impact": null, "products": [ "ColdFusion" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-48282", "source": "kev", "kev": { "dateAdded": "2026-07-07", "dueDate": "2026-07-10", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-22" ], "references": [ "https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48282" ] }, "epss": 0.99197, "epssPercentile": 0.99931, "pocCount": 1, "pocTopStars": 23, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/imbas007/CVE-2026-48282", "stars": 23, "desc": "", "createdAt": "2026-07-06", "hasCode": true } ], "published": "2026-06-30T16:16:54.533", "research": [ { "url": "https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/", "type": "writeup", "source": "watchTowr Labs / Sina Kheirkhah", "note": "Deep patch-diff; RDS FILEIO arb file write/read analysis" }, { "url": "https://github.com/imbas007/CVE-2026-48282", "type": "poc", "source": "GitHub / imbas007", "note": "Python PoC: check, read, write, browse via RDS endpoint", "hasCode": true }, { "url": "https://www.resecurity.com/blog/article/cve-2026-48282-adobe-coldfusion-rds-path-traversal-leading-to-rce", "type": "writeup", "source": "Resecurity", "note": "Technical breakdown: FILEIO handler, webshell write to RCE" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48282", "type": "detection", "source": "NVD / NIST", "note": "Official CVE record; CVSS 10.0 path traversal → RCE" }, { "url": "https://github.com/projectdiscovery/nuclei-templates/pull/16538", "type": "module", "source": "ProjectDiscovery / DhiyaneshGeek", "note": "Nuclei template PR: ColdFusion RDS arb file write check", "hasCode": true }, { "url": "https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/", "type": "detection", "source": "BleepingComputer", "note": "IOC guidance: /CFIDE/ webshell hunting, KEVIntel ITW data" }, { "url": "https://www.helpnetsecurity.com/2026/07/07/adobe-coldfusion-cve-2026-48282-exploitation-detected/", "type": "detection", "source": "Help Net Security", "note": "Exploitation timeline, CCCS advisory AV26-647, IoCs" }, { "url": "https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html", "type": "writeup", "source": "The Hacker News", "note": "Exploit payload sample, watchTowr/KEVIntel attribution" } ], "x": { "mentions": 140, "aliases": [], "posts": [ { "handle": "DarkWebInformer", "followers": 222189, "likes": 58, "createdAt": "2026-07-07", "url": "https://x.com/DarkWebInformer/status/2074627080579375543", "github": [ { "url": "https://github.com/imbas007/CVE-2026-48282", "hasCode": true } ], "origin": false }, { "handle": "ridvanyagli", "followers": 1120, "likes": 1, "createdAt": "2026-07-08", "url": "https://x.com/ridvanyagli/status/2074661987389190305", "github": [ { "url": "https://github.com/imbas007/CVE-2026-48282", "hasCode": true } ], "origin": false }, { "handle": "vutruso", "followers": 38, "likes": 0, "createdAt": "2026-07-08", "url": "https://x.com/vutruso/status/2074690046486290926", "github": [ { "url": "https://github.com/V4bel/Januscape", "hasCode": true } ], "origin": false }, { "handle": "nebusecurity", "followers": 4500, "likes": 240, "createdAt": "2026-07-08", "url": "https://x.com/nebusecurity/status/2074663573742338256", "github": [], "origin": false }, { "handle": "__kokumoto", "followers": 7578, "likes": 7, "createdAt": "2026-07-08", "url": "https://x.com/__kokumoto/status/2074698589713154281", "github": [], "origin": false }, { "handle": "ptdbugs", "followers": 2267, "likes": 7, "createdAt": "2026-07-07", "url": "https://x.com/ptdbugs/status/2074464871832268812", "github": [], "origin": false }, { "handle": "yousukezan", "followers": 14384, "likes": 6, "createdAt": "2026-07-08", "url": "https://x.com/yousukezan/status/2074650902166913222", "github": [], "origin": false }, { "handle": "Daily_CyberSec", "followers": 12430, "likes": 5, "createdAt": "2026-07-08", "url": "https://x.com/Daily_CyberSec/status/2074678524191855020", "github": [], "origin": false } ] }, "bsky": { "mentions": 25, "posts": [ { "handle": "bleepingcomputer.com", "displayName": "BleepingComputer", "likes": 4, "reposts": 2, "replies": 0, "createdAt": "2026-07-06", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mpy6ivjebg2g", "origin": false, "authority": true, "github": [] }, { "handle": "intelnightowl.bsky.social", "displayName": "Intel Night OWL 🦉🇺🇸", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-06", "url": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mpyzzusqaa2y", "origin": false, "authority": true, "github": [] }, { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpzy3jdskx2r", "origin": false, "authority": true, "github": [] }, { "handle": "thecircuitry.to", "displayName": "The Circuitry", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/thecircuitry.to/post/3mpzddyomc72v", "origin": false, "authority": false, "github": [] }, { "handle": "sergioiker.bsky.social", "displayName": "Dr.Sergio E. Sanchez… Dr. Qubit", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mq2qyb6slk2o", "origin": false, "authority": false, "github": [] }, { "handle": "netsecio.bsky.social", "displayName": "CyberNetSecIO", "likes": 1, "reposts": 0, "replies": 0, "createdAt": "2026-07-07", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mq333dmrjj2p", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 4, "posts": [ { "channel": "VulnerabilityNews", "channelTitle": "Vulnerability News", "tier": "news", "date": "2026-07-06", "views": 43, "forwards": 1, "url": "https://t.me/VulnerabilityNews/43320", "text": "Max severity Adobe ColdFusion flaw now exploited in attacks Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, according to vulnerability intelligence company KEVIntel. [...] https://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/", "github": [], "origin": false } ] }, "researchers": [ "SinSinology", "ethicalhack3r" ], "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [] }, { "cve": "CVE-2026-45659", "title": "Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability", "category": "Microsoft", "vendor": "Microsoft", "product": "SharePoint Server", "exploited": true, "publiclyDisclosed": false, "faq": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.", "cvss": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "HIGH", "impact": null, "products": [ "SharePoint Server" ], "productCount": 1, "mitreUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-45659", "source": "kev", "kev": { "dateAdded": "2026-07-01", "dueDate": "2026-07-04", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "ransomware": false, "cwes": [ "CWE-502" ], "references": [ "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-45659" ] }, "epss": 0.06918, "epssPercentile": 0.93414, "pocCount": 1, "pocTopStars": 1, "pocConfidence": "confirmed", "pocRepos": [ { "url": "https://github.com/HORKimhab/CVE-2026-45659", "stars": 1, "desc": "CVE-2026-45659", "createdAt": "2026-05-27", "hasCode": true } ], "published": "2026-05-22T23:16:56.273", "research": [], "x": { "mentions": 9, "aliases": [], "posts": [ { "handle": "PurpleOps_io", "followers": 604, "likes": 0, "createdAt": "2026-07-06", "url": "https://x.com/PurpleOps_io/status/2074059496381460723", "github": [], "origin": false }, { "handle": "alphahunt_io", "followers": 141, "likes": 0, "createdAt": "2026-07-06", "url": "https://x.com/alphahunt_io/status/2074115397490458733", "github": [], "origin": false }, { "handle": "ByteDrop453", "followers": 22, "likes": 0, "createdAt": "2026-07-06", "url": "https://x.com/ByteDrop453/status/2073997117996020182", "github": [], "origin": false } ] }, "bsky": { "mentions": 25, "posts": [ { "handle": "thecybermind.co", "displayName": "mikeransier.bsky.social", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-02", "url": "https://bsky.app/profile/thecybermind.co/post/3mpo26pfdjz25", "origin": false, "authority": true, "github": [] }, { "handle": "infosec.skyfleet.blue", "displayName": "InfoSec", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-02", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpombjkeyg2p", "origin": false, "authority": true, "github": [] }, { "handle": "getpokemon7.bsky.social", "displayName": "まりーん", "likes": 0, "reposts": 0, "replies": 1, "createdAt": "2026-06-22", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3movog3sfzk2u", "origin": false, "authority": false, "github": [] }, { "handle": "potato.software", "displayName": "CyberTaters", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-06", "url": "https://bsky.app/profile/potato.software/post/3mpx5tborhb2k", "origin": false, "authority": false, "github": [] }, { "handle": "diesec.bsky.social", "displayName": "DIESEC", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-06", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mpxwqll5le2d", "origin": false, "authority": false, "github": [] }, { "handle": "ahmandonk.bsky.social", "displayName": "Ahmandonk", "likes": 0, "reposts": 0, "replies": 0, "createdAt": "2026-07-06", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mpx5tbcopm2v", "origin": false, "authority": false, "github": [] } ] }, "telegram": { "mentions": 3, "posts": [ { "channel": "thehackernews", "channelTitle": "The Hacker News", "tier": "news", "date": "2026-05-26", "views": 8323, "forwards": 31, "url": "https://t.me/thehackernews/9083", "text": "⚠️ SharePoint RCE Vulnerability. Details → https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html CVE-2026-45659 allows authenticated attackers with only Site Member permissions to execute code remotely on SharePoint Server. The CVSS 8.8 flaw affects SharePoint Server 2016, 2019, and Subscription Edition.", "github": [], "origin": false } ] }, "corroboration": { "poc": true, "xOrigin": false, "independent": [ "poc", "x-mention" ], "level": "multi-source" }, "aliases": [], "researchers": [] } ] }