Exploit

Exploit List - 2026 2025 2024 2023 2021 2020 2019 2018

H AI APT Attack BigBrothers BotNet Congress Cryptocurrency Cyber CyberCrime Exploit Hack ICS Incindent IoT Mobil OS Phishing Ransom Safety Security Social Spam Virus Vulnerebility | 2026 2025 2024 2023

DATE	NAME	Info	CATEG.	WEB
19.10.26	Hackers exploit SiteGuard WAF flaw to run commands as admins	Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers.	Exploit	BleepingComputer
19.10.26	BeyondTrust patches zero-day exploited in attacks since August	BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.	Exploit	BleepingComputer
18.10.26	Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers	Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud.	Exploit	BleepingComputer
18.10.26	Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks	Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.	Exploit	BleepingComputer
18.10.26	Cisco patches new Secure Email Gateway zero-day exploited in attacks	Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.	Exploit	BleepingComputer
17.10.26	Ivanti warns of Connect Secure zero-day exploited in attacks	Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.	Exploit	BleepingComputer
17.10.26	The MFA Gaps Attackers are Still Exploiting	Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps.	Exploit	BleepingComputer
15.10.26	Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts	Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows	Exploit	The Hacker News
15.10.26	AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches	Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to	Exploit	The Hacker News
15.10.26	Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation	Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.	Exploit	The Hacker News
15.10.26	Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability	Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system,	Exploit	The Hacker News
14.10.26	CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their	Exploit	The Hacker News
12.10.26	P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands	Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword . "Compared	Exploit	The Hacker News
11.10.26	Max severity SonicWall SMA1000 flaw now exploited in attacks	Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago.	Exploit	BleepingComputer
11.10.26	Hackers exploit critical Atlassian flaw after public PoC release	A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication.	Exploit	BleepingComputer
10.10.26	Ninja Forms plugin flaw exploited to hack WordPress sites	Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts.	Exploit	BleepingComputer
10.10.26	Hackers exploit 32 zero-days on first day of Pwn2Own Ireland	On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days.	Exploit	BleepingComputer
10.10.26	P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands	Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword . "Compared	Exploit	The Hacker News
9.10.26	Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access	Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives	Exploit	The Hacker News
9.10.26	Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge	Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and	Exploit	The Hacker News
9.10.26	Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities	Exploit	The Hacker News
7.10.26	Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details	Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to	Exploit	The Hacker News
5.10.26	Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2	Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling . "	Exploit	The Hacker News
4.10.26	Fortinet warns of critical FortiMail flaw exploited in zero-day attacks	Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices.	Exploit	BleepingComputer
4.10.26	Cisco warns of new SD-WAN zero-day exploited in attacks	Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges.	Exploit	BleepingComputer
4.10.26	Bitget hacked via zero-day in third-party security products	Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products.	Exploit	BleepingComputer
4.10.26	Hackers exploit Citrix NetScaler zero-day to deploy web shells	Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks.	Exploit	BleepingComputer
2.10.26	Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes	The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its	Exploit	The Hacker News
1.10.26	CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco	Exploit	The Hacker News
1.10.26	CISA orders feds to patch exploited Citrix flaws by Wednesday	The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities.	Exploit	BleepingComputer
1.10.26	Citrix confirms two NetScaler RCE zero-days exploited in attacks	Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws.	Exploit	BleepingComputer
1.10.26	Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs	Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data.	Exploit	The Hacker News
30.9.26	Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution	Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has	Exploit	The Hacker News
28.9.26	CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its	Exploit	The Hacker News
27.9.26	CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks	The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.	Exploit	BleepingComputer
27.9.26	Hackers now exploit critical Roundcube flaw in code injection attacks	A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.	Exploit	BleepingComputer
27.9.26	Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation	Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being	Exploit	The Hacker News
27.9.26	Hackers start exploiting critical WordPress flaw for code execution	Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.	Exploit	BleepingComputer
27.9.26	Arista patches actively exploited VeloCloud Orchestrator zero-day	Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments.	Exploit	BleepingComputer
27.9.26	F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks	F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks.	Exploit	BleepingComputer
27.9.26	Chinese hackers exploit WordPress, Zyxel flaws to steal govt data	A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.	Exploit	BleepingComputer
27.9.26	Check Point warns of Management Server zero-day exploited in attacks	Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts.	Exploit	BleepingComputer
26.9.26	Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells	Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the	Exploit	The Hacker News
26.9.26	D-Link warns of max severity zero-day bug in DIR-822A routers	D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers.	Exploit	BleepingComputer
26.9.26	New Windows Defender zero-day blocks Microsoft antivirus updates	Over the weekend, security researcher Abdelhamid Naceri (also known as Nightmare Eclipse) released another Microsoft Defender zero-day exploit that blocks antivirus updates	Exploit	BleepingComputer
26.9.26	CISA orders feds to patch Zyxel flaw exploited for data theft	Attackers are now actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).	Exploit	BleepingComputer
26.9.26	CISA alerts of active exploitation of three Linux kernel flaws	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical.	Exploit	BleepingComputer
26.9.26	SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities ( KEV ) catalog, citing	Exploit	The Hacker News
25.9.26	Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild	The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.	Exploit	The Hacker News
25.9.26	WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe	Exploit	The Hacker News
23.9.26	Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape	A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm	Exploit	The Hacker News
23.9.26	F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers	Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5	Exploit	The Hacker News
23.9.26	Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware	A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as	Exploit	The Hacker News
23.9.26	Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks	Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the	Exploit	The Hacker News
23.9.26	Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates	A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space	Exploit	The Hacker News
22.9.26	New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups	Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN,	Exploit	The Hacker News
22.9.26	Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.	Exploit	The Hacker News
20.9.26	Cisco warns of max severity ISE zero-day exploited in attacks	Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild.	Exploit	BleepingComputer
20.9.26	Critical ScreenConnect flaw now actively exploited in attacks	Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).	Exploit	BleepingComputer
19.9.26	Google fixes actively exploited Android zero-day on Pixel devices	Google has released the September 2026 security patches to address 110 vulnerabilities affecting its Pixel devices, including one zero-day flaw actively exploited in targeted attacks.	Exploit	BleepingComputer
19.9.26	Acronis warns of actively exploited flaw in its cPanel backup plugin	Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild.	Exploit	BleepingComputer
19.9.26	CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known	Exploit	The Hacker News
19.9.26	Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root	A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access	Exploit	The Hacker News
18.9.26	CISA: Critical VMware RCE flaw now exploited by ransomware gangs	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July.	Exploit	BleepingComputer
18.9.26	Cisco patches Secure Email Gateway zero-day exploited in attacks	Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks.	Exploit	BleepingComputer
17.9.26	Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar	A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time	Exploit	The Hacker News
16.9.26	Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation	Google has disclosed that a high-severity security flaw in its Pixel Cellular Modem has come under exploitation in the wild. The vulnerability, tracked	Exploit	The Hacker News
16.9.26	Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks	Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been	Exploit	The Hacker News
16.9.26	Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells	Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than	Exploit	The Hacker News
16.9.26	Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens	A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case	Exploit	The Hacker News
15.9.26	Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds	With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access.	Exploit	The Hacker News
15.9.26	Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers	Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The	Exploit	The Hacker News
15.9.26	Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution	Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461 , carries a CVSS score of 9.8 out of a maximum of 10.0.	Exploit	The Hacker News
15.9.26	China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE	A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and	Exploit	The Hacker News
15.9.26	Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries	A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security	Exploit	The Hacker News
14.9.26	CISA: Hackers now exploit max severity GitLab flaw in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks.	Exploit	BleepingComputer
14.9.26	Hackers exploit Tencent app flaw to deploy GrayRabbit malware	Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor.	Exploit	BleepingComputer
13.9.26	Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent	The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103.	Exploit	BleepingComputer
13.9.26	CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise	Exploit	The Hacker News
13.9.26	New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws	Multiple cyber-espionage groups deployed an exploit kit dubbed "BlueMoon" that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome.	Exploit	BleepingComputer
12.9.26	New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access	An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates.	Exploit	BleepingComputer
12.9.26	Google warns of new Chrome zero-day bug exploited in attacks	Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year.	Exploit	BleepingComputer
11.9.26	PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws	PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to	Exploit	The Hacker News
11.9.26	Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware	Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched	Exploit	The Hacker News
11.9.26	Magento StyleSmuggler zero-day exploited to deploy Linux backdoor	A zero-day vulnerability dubbed "StyleSmuggler" affecting all versions of Magento and Adobe Commerce is being exploited in attacks to deploy a backdoor.	Exploit	BleepingComputer
11.9.26	Hackers exploit new MikroTik RouterOS flaws to hijack routers	Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet.	Exploit	BleepingComputer
10.9.26	CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet,	Exploit	The Hacker News
10.9.26	Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week	Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google	Exploit	The Hacker News
8.9.26	Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell	Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that	Exploit	The Hacker News
6.9.26	New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges	An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "FalconFlank" that lets attackers escalate privileges on up-to-date Windows systems.	Exploit	BleepingComputer
6.9.26	Google warns of new Chrome zero-day flaw exploited in attacks	Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities.	Exploit	BleepingComputer
6.9.26	Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores	Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an	Exploit	The Hacker News
6.9.26	Hackers exploit Sangoma Switchvox flaw to deploy reverse shells	Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution.	Exploit	BleepingComputer
6.9.26	Hackers exploit critical JFrog Artifactory flaw to forge admin tokens	A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access.	Exploit	BleepingComputer
5.9.26	SonicWall warns of actively exploited SMA1000 zero-day flaws	SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks.	Exploit	BleepingComputer
5.9.26	Critical Langflow flaw exploited to steal OpenAI and AWS keys	Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys.	Exploit	BleepingComputer
4.9.26	Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day	Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine.	Exploit	The Hacker News
4.9.26	Recently patched PaperCut zero-days used in data theft attacks	Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks.	Exploit	BleepingComputer
3.9.26	Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon	The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new	Exploit	The Hacker News
3.9.26	CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited	Exploit	The Hacker News
2.9.26	Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain	SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances	Exploit	The Hacker News
2.9.26	Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another	Forescout Research - Vedere Labs said it used Anthropic's Claude to port a working pre-authentication remote code execution (RCE) exploit from one	Exploit	The Hacker News
2.9.26	Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials	Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated	Exploit	The Hacker News
2.9.26	Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure	Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr . The vulnerability in question is CVE-2026-82329 (CVSS	Exploit	The Hacker News
1.9.26	Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity	Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score:	Exploit	The Hacker News
30.8.26	PaperCut releases second emergency patch for exploited flaws	PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes.	Exploit	BleepingComputer
30.8.26	PaperCut warns of NG, MF flaw exploited in zero-day attacks	PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.	Exploit	BleepingComputer
30.8.26	Critical Avada WordPress theme flaw enables zero-click RCE	A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server.	Exploit	BleepingComputer
30.8.26	Hackers target Microsoft SharePoint RCE chain with PoC exploit	Attackers are now targeting a chain of two Microsoft SharePoint vulnerabilities that can allow them to execute arbitrary code on unpatched servers, according to threat intelligence company Defused.	Exploit	BleepingComputer
29.8.26	Hackers now exploit critical Gitea flaw in code injection attacks	Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).	Exploit	BleepingComputer
28.8.26	ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known	Exploit	The Hacker News
28.8.26	PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions	PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF	Exploit	The Hacker News
27.8.26	CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation.	Exploit	The Hacker News
27.8.26	CISA orders urgent patching of actively exploited Zimbra flaw	The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies to patch an actively exploited vulnerability in Zimbra Collaboration Suite (ZCS) within three days.	Exploit	BleepingComputer
26.8.26	Exploits and vulnerabilities in Q2 2026	This report covers statistics on vulnerabilities, exploits, and C2 frameworks in Q2 2026. For the first time ever, we aggregate data on vulnerabilities in open-source AI agents and AI frameworks.	Exploit	SECURELIST
26.8.26	Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched	Exploit	The Hacker News
25.8.26	Exploiting SharePoint: CVE-2026-55040 and CVE-2026-63520 RCE Chain	VulnCheck’s Initial Access Intelligence team shipped an exploit last week chaining two recently disclosed Microsoft SharePoint CVEs that, when used together, allow a remote unauthenticated adversary to bypass authentication and execute code on vulnerable target SharePoint servers:	Exploit	VULNCHECK
25.8.26	Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP	Exploit	The Hacker News
23.8.26	CISA orders feds to patch actively exploited TrueConf Server flaws	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform.	Exploit	BleepingComputer
22.8.26	Critical RCE flaw in Windows IKE Extension now actively exploited	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity remote code execution (RCE) flaw in the Windows Internet Key Exchange (IKE) Service Extensions component.	Exploit	BleepingComputer
21.8.26	Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution	Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no	Exploit	The Hacker News
20.8.26	Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution	A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish	Exploit	The Hacker News
19.8.26	Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, stating they are being exploited in the wild.	Exploit	The Hacker News
19.8.26	Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets	Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA /	Exploit	The Hacker News
16.8.26	Hackers exploit macOS Screen Sharing flaw to deploy Monero miner	The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged.	Exploit	BleepingComputer
16.8.26	Hackers exploit critical Adobe Commerce flaw to hijack customer accounts	Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts.	Exploit	BleepingComputer
16.8.26	Hackers leverage new Microsoft SharePoint exploit in attacks	Hackers have already begun using a proof-of-concept (PoC) exploit for a critical Microsoft SharePoint vulnerability, published by cybersecurity company Rapid7 on Tuesday.	Exploit	BleepingComputer
16.8.26	Cisco warns of ASA and FTD VPN flaw exploited to crash devices	Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices.	Exploit	BleepingComputer
15.8.26	CISA: Microsoft SharePoint flaw now exploited in ransomware attacks	CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July.	Exploit	BleepingComputer
15.8.26	Cisco warns of high-severity ClamAV flaws with public exploits	Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks.	Exploit	BleepingComputer
14.8.26	Unpatched GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE	A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform	Exploit	The Hacker News
13.8.26	SharePoint CVE-2026-55040 Comes Under Attack Following Public Exploit	Attackers are exploiting SharePoint flaw CVE-2026-55040 after a public PoC was released, allowing unauthenticated users to impersonate administrators. Attackers started exploiting CVE-2026-55040 ( ...	Exploit	SECURITYAFFAIRS
13.8.26	ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch	Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution. Security researcher Chaotic Eclip ...	Exploit	SECURITYAFFAIRS
13.8.26	State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit	It typically begins the same way it has for years, with an approach from a recruiter offering a role at a company the target would recognize, accompanied by a PDF describing the position in convincing detail. That approach remains one of the most effective entry points used by state sponsored threat actors today, and Check Point Research has spent recent months tracking a new wave of it	Exploit	CHECKPOINT
13.8.26	Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack	Check Point Research is tracking a long‑running campaign called Operation Dream Job, targeting organizations worldwide, with a particular focus on the defense sector. The campaign is affiliated to DPRK-linked Lazarus group and its latest wave focuses on the defense sector in Europe and India.	Exploit	CHECKPOINT
13.8.26	Attackers Exploit SharePoint Authentication Bypass After Public PoC Release	Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC)	Exploit	The Hacker News
12.8.26	Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor	The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw	Exploit	The Hacker News
12.8.26	Cisco ASA and FTD CVE-2026-20349 Exploited	Cisco has confirmed active exploitation of CVE-2026-20349, a High-severity denial-of-service (DoS) vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall ASA and Secure Firewall Threat Defense (FTD) Software.	Exploit	SOCRADAR
12.8.26	Critical Metabase Zero-Day Exploited	Metabase has disclosed a critical zero-day SQL injection (SQLi) vulnerability that can allow unauthenticated attackers to gain administrator access to vulnerable instances. The flaw is rated at maximum severity, and the vendor has confirmed active exploitation.	Exploit	SOCRADAR
12.8.26	Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access	Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings	Exploit	The Hacker News
12.8.26	ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access	The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-	Exploit	The Hacker News
12.8.26	Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS	Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat	Exploit	The Hacker News
10.8.26	Critical Progress LoadMaster flaw now actively exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are exploiting a critical-severity Progress Kemp LoadMaster command injection vulnerability.	Exploit	BleepingComputer
10.8.26	Metabase SQLi zero-day exploited in customer data-theft attacks	A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally.	Exploit	BleepingComputer
8.8.26	Hackers run khunt post-exploitation toolkit from Oracle database	Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network.	Exploit	BleepingComputer
8.8.26	CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws	The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited.	Exploit	BleepingComputer
8.8.26	Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication	Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been	Exploit	The Hacker News
6.8.26	CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild	A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild , according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The	Exploit	The Hacker News
5.8.26	CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited	The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (	Exploit	The Hacker News
4.8.26	CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to	Exploit	The Hacker News
3.8.26	N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete	N-able said attackers exploited an authentication bypass in N-central to gain remote administrative access and reach the customer systems	Exploit	The Hacker News
30.7.26	New Certighost PoC exploit lets attackers hijack Windows domains	A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain.	Exploit	BleepingComputer
30.7.26	Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure	Exploit	The Hacker News
28.7.26	Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw	A maximum-severity security flaw impacting on-premises versions of Arista VeloCloud Orchestrator (VCO) has come under active exploitation in	Exploit	The Hacker News
25.7.26	Check Point warns of SmartConsole zero-day exploited in attacks	Israeli cybersecurity firm Check Point Software has addressed an actively exploited zero-day flaw in the company's SmartConsole graphical user interface (GUI) admin panel.	Exploit	BleepingComputer
25.7.26	CISA orders urgent action on actively exploited Langflow RCE flaw	The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday ordered U.S. government agencies to prioritize patching an actively exploited vulnerability in the Langflow visual framework for building AI agents.	Exploit	BleepingComputer
24.7.26	Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller	Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a	Exploit	The Hacker News
24.7.26	Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say	Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need	Exploit	The Hacker News
23.7.26	Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication	A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case	Exploit	The Hacker News
21.7.26	SonicWall SMA1000 flaws exploited as zero-days to push custom malware	Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.	Exploit	BleepingComputer
21.7.26	Critical ServiceNow code execution flaw now exploited in attacks	Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused.	Exploit	BleepingComputer
21.7.26	WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning	Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code	Exploit	The Hacker News
20.6.26	SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access	A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA)	Exploit	The Hacker News
19.7.26	CISA urges immediate action on actively exploited Fortinet flaws	CISA on Thursday ordered government agencies to prioritize patching two actively exploited vulnerabilities in the Fortinet FortiSandbox threat detection platform.	Exploit	BleepingComputer
19.7.26	CISA orders feds to patch actively exploited Oracle flaw by Saturday	CISA has ordered federal agencies to secure their systems by Saturday against ongoing attacks exploiting a critical vulnerability in the Oracle E-Business Suite financial application.	Exploit	BleepingComputer
18.7.26	CISA warns admins to patch actively exploited SharePoint flaws	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances.	Exploit	BleepingComputer
18.7.26	SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now	SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates.	Exploit	BleepingComputer
18.7.26	You Don't Have to Run an Exploit to Know If You're Vulnerable	Many vulnerabilities cannot be safely validated with live exploits, either because no exploit exists or the affected systems are too critical to test. Picus explains how TTP chaining helps organizations determine exploitability by validating the attack techniques an exploit depends on, without launching the exploit itself.	Exploit	BleepingComputer
17.7.26	CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft	Exploit	The Hacker News
13.7.26	iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and	Exploit	The Hacker News
12.7.26	Hackers exploit critical auth bypass in Gitea Docker image	Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.	Exploit	BleepingComputer
11.7.26	Hackers exploit Roundcube flaw to spy on academic researchers	A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware.	Exploit	BleepingComputer
10.7.26	Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets	Security firm Coinspect has disclosed a crypto wallet flaw it calls Ill Bloom , and attackers are already using it. The flaw is in how some wallet	Exploit	The Hacker News
10.7.26	_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary]	Every so often a honeypot hit comes along that is less about the exploit and more about the intent behind it. While reviewing DShield logs I ran into a scanning bot that caught my eye: a URI string that appeared to be a plea for help.	Exploit	SANS
9.7.26	Max severity Adobe ColdFusion flaw now exploited in attacks	Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, according to vulnerability intelligence company KEVIntel.	Exploit	BleepingComputer
8.7.26	CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (	Exploit	The Hacker News
7.7.26	Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities	A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and	Exploit	The Hacker News
5.7.26	Cisco finally confirms attackers exploiting Unified CM flaw	Cisco confirmed that attackers are now exploiting a Unified Communications Manager (Unified CM) vulnerability patched in early June.	Exploit	BleepingComputer
5.7.26	CISA: Microsoft SharePoint RCE flaw now actively exploited	CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May.	Exploit	BleepingComputer
2.7.26	SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint	Exploit	The Hacker News
1.7.26	Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts	A recently disclosed critical security flaw impacting Progress Kemp LoadMaster is seeing active exploitation attempts, according to an	Exploit	The Hacker News
30.6.26	Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints	Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner.	Exploit	The Hacker News
30.6.26	Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer	An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two	Exploit	The Hacker News
30.6.26	Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild	A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The	Exploit	The Hacker News
28.6.26	CISA sets urgent deadline to fix Cisco flaw exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is giving federal agencies until Sunday to patch a vulnerability in Cisco Unified Communications Manager Server that is being actively exploited.	Exploit	BleepingComputer
27.6.26	CISA warns of max severity Ubiquiti flaws exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers actively exploiting flaws in Ubiquity UniFi OS and Lantronix serial-to-ethernet servers.	Exploit	BleepingComputer
27.6.26	The Exploit Doesn't Exist. You Can Still Prove It Works Against You	Attackers can now weaponize newly disclosed vulnerabilities far faster than most organizations can patch them. Picus Security explains how security teams can validate exploitability before a public exploit even exists.	Exploit	BleepingComputer
26.6.26	CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data	Exploit	The Hacker News
25.6.26	Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access	An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two	Exploit	The Hacker News
25.6.26	CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation of a critical security flaw impacting	Exploit	The Hacker News
24.6.26	Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root	Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and	Exploit	The Hacker News
24.6.26	GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns	GitHub is moving to strengthen software supply chain security by updating " actions/checkout " to block pwn request attacks that exploit	Exploit	The Hacker News
21.6.26	Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin	Threat actors are exploiting an unauthenticated information disclosure vulnerability in the WordPress plugin Gravity SMTP, active on 100,000 sites.	Exploit	BleepingComputer
21.6.26	CISA: Splunk Enterprise flaw actively exploited, patch by Sunday	CISA has urged U.S. federal agencies to secure their systems by Sunday against a critical Splunk Enterprise vulnerability that is being exploited in attacks.	Exploit	BleepingComputer
20.6.26	CISA warns of another cPanel plugin flaw exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. government agencies three days to secure their servers against an actively exploited vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin.	Exploit	BleepingComputer
20.6.26	Critical Fortinet FortiSandbox flaws now exploited in attacks	Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused.	Exploit	BleepingComputer
20.6.26	Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys	Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a	Exploit	The Hacker News
20.6.26	Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain	Security researchers at Paradigm Shift have published a working exploit, dubbed usbliter8 , that achieves arbitrary code execution inside the SecureROM of Apple's A12 and A13 chips. That code is burned into the	Exploit	The Hacker News
16.6.26	Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week	Bad actors are exploiting multiple security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber. In a	Exploit	The Hacker News
16.6.26	Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw	Cisco has released security updates for a medium-severity security flaw in Catalyst SD-WAN Manager that has come under active exploitation in	Exploit	The Hacker News
16.6.26	CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw impacting LiteSpeed cPanel Plugin to its Known	Exploit	The Hacker News
15.6.26	Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw	Palo Alto Networks has revealed that it has observed "active exploitation" of a recently disclosed PAN-OS vulnerability by an unknown threat actor	Exploit	The Hacker News
14.6.26	CISA orders feds to patch actively exploited Ivanti flaw by Sunday	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04.	Exploit	BleepingComputer
14.6.26	Oracle mitigates PeopleSoft zero-day exploited in data theft attacks	Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks.	Exploit	BleepingComputer
13.6.26	CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day	CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates.	Exploit	BleepingComputer
13.6.26	Google patches new Chrome zero-day flaw exploited in the wild	Google has released emergency updates to patch another Chrome zero-day vulnerability that has been exploited in the wild, the fifth such flaw patched since the start of the year.	Exploit	BleepingComputer
12.6.26	ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities	The ShinyHunters extortion crew exploited an unpatched flaw in Oracle PeopleSoft to break into enterprise systems, steal data, and demand	Exploit	The Hacker News
12.6.26	New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files	Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML , a day after they published an exploit for Microsoft Defender. "This was an accidental discovery, it took a total of 4 hours to find this," the researcher said in a post on Blogger.	Exploit	The Hacker News
10.6.26	ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances	ServiceNow has warned about a security incident in which unknown threat actors exploited a flaw to obtain deeper unauthorized access to	Exploit	The Hacker News
9.6.26	WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine	Two Russia-aligned cyber attack campaigns have continued to exploit a security flaw in WinRAR to target Ukrainian organisations, almost a year	Exploit	The Hacker News
9.6.26	Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now	Google has released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The	Exploit	The Hacker News
9.6.26	LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.	Exploit	The Hacker News
9.6.26	One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public	Security researchers have published a detailed, working exploit for a Linux kernel use-after-free that lets an unprivileged local user escalate to	Exploit	The Hacker News
8.6.26	Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups	Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The	Exploit	The Hacker News
7.6.26	CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers	CISA warned today that hackers are now actively exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers.	Exploit	BleepingComputer
7.6.26	Cisco warns of unpatched SD-WAN zero-day exploited in attacks	On Thursday, Cisco warned of a high-severity, unpatched zero-day in the Cisco Catalyst SD-WAN Manager (tracked as CVE-2026-20245) actively exploited in attacks enabling root privilege escalation.	Exploit	BleepingComputer
7.6.26	Cisco warns of critical Unified CM flaw with PoC exploit code	Cisco has released security updates to patch a critical-severity Unified Communications Manager (Unified CM) flaw that allows attackers to gain root privileges.	Exploit	BleepingComputer
7.6.26	CISA warns of active attacks exploiting Android, Linux bugs	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system.	Exploit	BleepingComputer
7.6.26	Critical Kirki flaw exploited to hijack WordPress admin accounts	Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators.	Exploit	BleepingComputer
6.6.26	CISA flags two-year-old Oracle flaw as actively exploited in attacks	CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerability that was patched two years ago and is now actively exploited in attacks.	Exploit	BleepingComputer
6.6.26	Critical Windows Netlogon RCE flaw now exploited in attacks	The Centre for Cybersecurity Belgium (CCB), the country's national authority for cybersecurity, warned on Friday that threat actors are now exploiting a recently patched critical Windows Netlogon vulnerability (CVE-2026-41089) in attacks.	Exploit	BleepingComputer
6.6.26	WP Maps Pro bug exploited to create admin accounts on WordPress sites	Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication.	Exploit	BleepingComputer
6.6.26	CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw impacting SolarWinds Serv-U multi-	Exploit	The Hacker News
5.6.26	Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites	Threat actors are actively exploiting a critical security flaw in Everest Forms Pro, a WordPress plugin with about 4,000 active installations, to	Exploit	The Hacker News
4.6.26	CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting Mirasvit Cache Warmer, a	Exploit	The Hacker News
3.6.26	Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine	The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple	Exploit	The Hacker News
1.6.26	Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts	Threat actors are attempting to actively exploit a critical security flaw impacting WP Maps Pro , a WordPress plugin that has had over 15,000	Exploit	The Hacker News
31.5.26	Hackers exploit FortiClient EMS flaw to push infostealer malware	Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ	Exploit	BleepingComputer
30.5.26	CISA gives feds 4 days to patch actively exploited cPanel plugin flaw	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. federal agencies four days to secure their servers against a critical vulnerability in the LiteSpeed cPanel user-end plugin, which is actively being exploited in attacks.	Exploit	BleepingComputer
30.5.26	CISA orders feds to patch actively exploited Drupal vulnerability	CISA has given U.S. government agencies until Wednesday evening to secure their servers against an SQL injection vulnerability in the Drupal content management system (CMS) that it flagged as actively exploited.	Exploit	BleepingComputer
28.5.26	FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch	Arctic Wolf observed a threat cluster exploiting CVE-2026-35616, deploying an infostealer disguised as a Fortinet patch to FortiClient EMS-managed endpoints.	Exploit	ARTICWOLF
26.5.26	Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability	In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver. KnowledgeDeliver is a Learning Management System (LMS) developed by Digital Knowledge commonly used in Japan.	Exploit	GTI
26.5.26	KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike	A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver , a Learning Management System (LMS) popular in	Exploit	The Hacker News
25.5.26	Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks	Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel	Exploit	The Hacker News
24.5.26	Trend Micro warns of Apex One zero-day exploited in the wild	Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems.	Exploit	BleepingComputer
24.5.26	Microsoft warns of new Defender zero-days exploited in attacks	On Wednesday, Microsoft started rolling out security patches for two Defender vulnerabilities that have been exploited in zero-day attacks.	Exploit	BleepingComputer
23.5.26	Exploit released for new PinTheft Arch Linux root escalation flaw	PinTheft, a recently patched Linux privilege escalation vulnerability, now has a publicly available proof-of-concept (PoC) exploit that allows local attackers to gain root privileges on Arch Linux systems.	Exploit	BleepingComputer
23.5.26	Microsoft shares mitigation for YellowKey Windows zero-day	Microsoft has shared mitigations for YellowKey, a recently disclosed Windows BitLocker zero-day vulnerability that grants access to protected drives.	Exploit	BleepingComputer
23.5.26	LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root	A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw,	Exploit	The Hacker News
23.5.26	Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to	Exploit	The Hacker News
21.5.26	Microsoft Warns of Two Actively Exploited Defender Vulnerabilities	Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild.	Exploit	The Hacker News
20.5.26	Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit	Microsoft on Tuesday released a mitigation for a BitLocker bypass vulnerability named YellowKey following its public disclosure last week.	Exploit	The Hacker News
17.5.26	Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming	A critical security vulnerability impacting the Funnel Builder plugin for WordPress has come under active exploitation in the wild to inject	Exploit	The Hacker News
17.5.26	Funnel Builder WordPress plugin bug exploited to steal credit cards	A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript snippets into WooCommerce checkout pages.	Exploit	BleepingComputer
17.5.26	Microsoft warns of Exchange zero-day flaw exploited in attacks	On Thursday, Microsoft shared mitigations for a high-severity Exchange Server vulnerability exploited in attacks that allow threat actors to execute arbitrary code via cross-site scripting (XSS) while targeting Outlook on the web users.	Exploit	BleepingComputer
17.5.26	Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin	Hackers are leveraging a critical authentication bypass vulnerability in the WordPress plugin Burst Statistics to obtain admin-level access to websites.	Exploit	BleepingComputer
13.5.26	Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation	A threat actor with affiliations to China has been linked to a "multi-wave intrusion" targeting an unnamed Azerbaijani oil and gas company	Exploit	The Hacker News
10.5.26	CISA gives feds four days to patch Ivanti flaw exploited as zero-day	CISA has given U.S. federal agencies four days to secure their networks against a high-severity vulnerability in Ivanti Endpoint Manager Mobile (EPMM) exploited in zero-day attacks.	Exploit	BleepingComputer
10.5.26	Ivanti warns of new EPMM flaw exploited in zero-day attacks	Ivanti warned customers today to patch a high-severity remote code execution vulnerability in Endpoint Manager Mobile (EPMM) exploited in zero-day attacks.	Exploit	BleepingComputer
10.5.26	Palo Alto Networks firewall zero-day exploited for nearly a month	Palo Alto Networks warned customers that suspected state-sponsored hackers have been exploiting a critical-severity PAN-OS firewall zero-day vulnerability for nearly a month.	Exploit	BleepingComputer
10.5.26	Palo Alto Networks warns of firewall RCE zero-day exploited in attacks	Palo Alto Networks warned customers today that a critical-severity unpatched vulnerability in the PAN-OS User-ID Authentication Portal is being exploited in attacks.	Exploit	BleepingComputer
9.5.26	They don’t hack, they borrow: How fraudsters target credit unions	Fraudsters aren't hacking credit unions, they are exploiting normal business processes. Flare reveals how structured loan fraud methods use stolen identities to pass verification and secure funds.	Exploit	BleepingComputer
9.5.26	CISA says ‘Copy Fail’ flaw now exploited to root Linux systems	CISA has warned that threat actors have started exploiting the "Copy Fail" Linux security vulnerability in the wild, one day after Theori researchers disclosed it and shared a proof-of-concept (PoC) exploit.	Exploit	BleepingComputer
8.5.26	Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions	Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel. Dubbed Dirty Frag , it has been described as a successor to Copy Fail (CVE-2026-31431, CVSS score: 7.8), a recently disclosed LPE flaw impacting the Linux kernel that has since come under active exploitation in the wild. The vulnerability was reported to Linux kernel maintainers on April 30, 2026.	Exploit	The Hacker News
8.5.26	Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access	Ivanti is warning that a new security flaw impacting Endpoint Manager Mobile (EPMM) has been explored in limited attacks in the wild. The high-	Exploit	The Hacker News
8.5.26	PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems	Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed cloud	Exploit	The Hacker News
8.5.26	PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage	Palo Alto Networks has disclosed that threat actors may have attempted to unsuccessfully exploit a recently disclosed critical security flaw as	Exploit	The Hacker News
6.5.26	Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution	Palo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the	Exploit	The Hacker News
5.5.26	MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks	Threat actors are actively exploiting a critical security flaw impacting an open-source content management system (CMS) known as MetInfo,	Exploit	The Hacker News
3.5.26	CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux	Exploit	The Hacker News
3.5.26	Critical cPanel and WHM bug exploited as a zero-day, PoC now available	The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been leveraged in attempts since late February.	Exploit	BleepingComputer
2.5.26	CISA orders feds to patch Windows flaw exploited as zero-day	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to secure their Windows systems against a vulnerability exploited in zero-day attacks.	Exploit	BleepingComputer
1.5.26	Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft	A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that	Exploit	The Hacker News
29.4.26	CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities ( KEV ) catalog,	Exploit	The Hacker News
27.4.26	PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks	A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing	Exploit	The Hacker News
26.4.26	New ‘Pack2TheRoot’ flaw gives hackers root Linux access	A new vulnerability dubbed Pack2TheRoot could be exploited in the PackageKit daemon to allow local Linux users to install or remove system packages and gain root permissions.	Exploit	BleepingComputer
26.4.26	Hackers exploit file upload bug in Breeze Cache WordPress plugin	Hackers are actively exploiting a critical vulnerability in the Breeze Cache plugin for WordPress that allows uploading arbitrary files on the server without authentication.	Exploit	BleepingComputer
26.4.26	CISA orders feds to patch BlueHammer flaw exploited as zero-day	CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.	Exploit	BleepingComputer
26.4.26	New Mirai campaign exploits RCE flaw in EoL D-Link routers	A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet.	Exploit	BleepingComputer
25.4.26	CISA flags new SD-WAN flaw as actively exploited in attacks	CISA has given U.S. government agencies four days to secure their systems against another Catalyst SD-WAN Manager vulnerability it flagged as actively exploited in attacks.	Exploit	BleepingComputer
25.4.26	Actively exploited Apache ActiveMQ flaw impacts 6,400 servers	Nonprofit security organization Shadowserver found that over 6,400 Apache ActiveMQ servers exposed online are vulnerable to ongoing attacks exploiting a high-severity code injection vulnerability.	Exploit	BleepingComputer
25.4.26	CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added four vulnerabilities impacting SimpleHelp, Samsung MagicINFO 9	Exploit	The Hacker News
21.4.26	No Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks	The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-	Exploit	The Hacker News
21.4.26	CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities ( KEV )	Exploit	The Hacker News
19.4.26	CISA flags Apache ActiveMQ flaw as actively exploited in attacks	CISA warned that attackers are now exploiting a high-severity Apache ActiveMQ vulnerability, which was patched earlier this month after going undetected for 13 years.	Exploit	BleepingComputer
19.4.26	Recently leaked Windows zero-days now exploited in attacks	Threat actors are exploiting three recently disclosed Windows security vulnerabilities in attacks aimed at gaining SYSTEM or elevated administrator permissions.	Exploit	BleepingComputer
19.4.26	New Microsoft Defender “RedSun” zero-day PoC grants SYSTEM privileges	A researcher known as "Chaotic Eclipse" has published a proof-of-concept exploit for a second Microsoft Defender zero-day, dubbed "RedSun," in the past two weeks, protesting how the company works with cybersecurity researchers.	Exploit	BleepingComputer
19.4.26	Critical Nginx UI auth bypass flaw now actively exploited in the wild	A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication.	Exploit	BleepingComputer
19.4.26	CISA flags Windows Task Host vulnerability as exploited in attacks	CISA warned U.S. government agencies to secure their systems against a Windows Task Host privilege escalation vulnerability that could allow attackers to gain SYSTEM privileges.	Exploit	BleepingComputer
18.4.26	Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched	Huntress is warning that threat actors are exploiting three recently disclosed security flaws in Microsoft Defender to gain elevated privileges in	Exploit	The Hacker News
12.4.26	Hackers exploiting Acrobat Reader zero-day flaw since December	Attackers have been exploiting a zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December.	Exploit	BleepingComputer
12.4.26	Hackers exploit critical flaw in Ninja Forms WordPress plugin	A critical vulnerability in the Ninja Forms File Uploads premium add-on for WordPress allows uploading arbitrary files without authentication, which can lead to remote code execution.	Exploit	BleepingComputer
11.4.26	Max severity Flowise RCE vulnerability now exploited in attacks	Hackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for building custom LLM apps and agentic systems to execute arbitrary code.	Exploit	BleepingComputer
11.4.26	Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit	Exploit code has been released for an unpatched Windows privilege escalation flaw reported privately to Microsoft, allowing attackers to gain SYSTEM or elevated administrator permissions.	Exploit	BleepingComputer
11.4.26	CISA orders feds to patch exploited Fortinet EMS flaw by Friday	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to secure FortiClient Enterprise Management Server (EMS) instances against an actively exploited vulnerability by Friday.	Exploit	BleepingComputer
10.4.26	Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025	Threat actors have been exploiting a previously unknown zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least	Exploit	The Hacker News
6.4.26	Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime	Threat actors are exploiting vacant homes as "drop addresses" to intercept mail and enable fraud. Flare shows how postal services and fake identities are abused to turn mail into a fraud vector.	Exploit	BleepingComputer
5.4.26	36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants	Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different	Exploit	The Hacker News
5.4.26	Hackers exploit TrueConf zero-day to push malicious software updates	Hackers have targeted TrueConf conference servers in attacks that exploit a zero-day vulnerability, allowing them to execute arbitrary files on all connected endpoints.	Exploit	BleepingComputer
5.4.26	Routine Access Is Powering Modern Intrusions, a New Threat Report Finds	Modern intrusions increasingly start with valid credentials and routine access, not exploits. Blackpoint Cyber's upcoming threat report shows how VPN abuse, RMM tools, and social engineering drive most incidents.	Exploit	BleepingComputer
5.4.26	Google fixes fourth Chrome zero-day exploited in attacks in 2026	Google has fixed the fourth Chrome vulnerability exploited in zero-day attacks since the start of the year.	Exploit	BleepingComputer
4.4.26	CISA orders feds to patch actively exploited Citrix flaw by Thursday	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their Citrix NetScaler appliances against an actively exploited vulnerability by Thursday.	Exploit	BleepingComputer
3.4.26	Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials	A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database	Exploit	The Hacker News
1.4.26	New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released	Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been	Exploit	The Hacker News
1.4.26	TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks	A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign	Exploit	The Hacker News
29.3.26	CISA: New Langflow flaw actively exploited to hijack AI workflows	The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents.	Exploit	BleepingComputer
26.3.26	CISA orders feds to patch DarkSword iOS flaws exploited attacks	CISA ordered U.S. government agencies to patch three iOS vulnerabilities targeted in cryptocurrency theft and cyberespionage attacks using the DarkSword exploit kit	Exploit	BleepingComputer
24.3.26	Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems	Threat actors are suspected to be exploiting a maximum-severity security flaw impacting Quest KACE Systems Management Appliance (SMA), according to	Exploit	The Hacker News
21.3.26	CISA urges US orgs to secure Microsoft Intune systems after Stryker breach	CISA warned U.S. organizations to follow Microsoft guidance to strengthen the Intune endpoint management tool after a cyberattack exploited it to wipe medical technology giant Stryker's systems.	Exploit	BleepingComputer
21.3.26	Critical Microsoft SharePoint flaw now exploited in attacks	A critical Microsoft SharePoint vulnerability patched in January is now being exploited in attacks, the Cybersecurity and Infrastructure Security Agency (CISA) warned.	Exploit	BleepingComputer
21.3.26	CISA orders feds to patch Zimbra XSS flaw exploited in attacks	CISA has ordered U.S. government agencies to secure their servers against an actively exploited vulnerability in the Zimbra Collaboration Suite (ZCS).	Exploit	BleepingComputer
21.3.26	The Refund Fraud Economy: Exploiting Major Retailers and Payment Platforms	Refund fraud is now a business, with methods and tutorials sold to exploit return policies for profit. Flare shows how fraudsters turn refunds and chargebacks into a repeatable profit model.	Exploit	BleepingComputer
21.3.26	New DarkSword iOS exploit used in infostealer attack on iPhones	A new exploit kit for iOS devices and delivery framework dubbed "Darksword" has been used to steal a wide range of personal information, including data from cryptocurrency wallet app.	Exploit	BleepingComputer
21.3.26	CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added five security flaws impacting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities ( KEV ) catalog, urging federal agencies to patch them by April 3, 2026.	Exploit	The Hacker News
20.3.26	54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security	A new analysis of endpoint detection and response (EDR) killers has revealed that 54 of them leverage a technique known as bring your own vulnerable	Exploit	The Hacker News
s19.3.26	CISA flags Wing FTP Server flaw as actively exploited in attacks	CISA warned U.S. government agencies to secure their Wing FTP Server instances against an actively exploited vulnerability that may be chained in remote code execution attacks.	Exploit	BleepingComputer
19.3.26	DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover	A new exploit kit for Apple iOS devices designed to steal sensitive data from is being wielded by multiple threat actors since at least November 2025,	Exploit	The Hacker News
19.3.26	CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged government agencies to apply patches for two security flaws impacting	Exploit	The Hacker News
17.3.26	CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known	Exploit	The Hacker News
15.3.26	Google fixes two new Chrome zero-days exploited in attacks	Google has released emergency security updates to patch two high-severity Chrome vulnerabilities exploited in zero-day attacks.	Exploit	BleepingComputer
15.3.26	CISA orders feds to patch n8n RCE flaw exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies on Wednesday to patch their systems against an actively exploited n8n vulnerability.	Exploit	BleepingComputer
13.3.26	Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8	Google on Thursday released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the	Exploit	The Hacker News
12.3.26	CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting n8n to its Known Exploited	Exploit	The Hacker News
10.3.26	FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials	Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW)	Exploit	The Hacker News
10.3.26	CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws to its Known Exploited Vulnerabilities ( KEV )	Exploit	The Hacker News
9.3.26	Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure	High-value organizations located in South, Southeast, and East Asia have been targeted by a Chinese threat actor as part of a years-long campaign. The	Exploit	The Hacker News
7.3.26	WordPress membership plugin bug exploited to create admin accounts	Hackers are exploiting a critical vulnerability in the User Registration & Membership plugin, which is installed on more than 60,000 WordPress sites.	Exploit	BleepingComputer
7.3.26	Google says 90 zero-days were exploited in attacks last year	Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities actively exploited throughout 2025, almost half of them in enterprise software and appliances.	Exploit	BleepingComputer
7.3.26	Cisco flags more SD-WAN flaws as actively exploited in attacks	Cisco has flagged two Catalyst SD-WAN Manager security flaws as actively exploited in the wild, urging administrators to upgrade vulnerable devices.	Exploit	BleepingComputer
7.3.26	CISA flags VMware Aria Operations RCE flaw as exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware Aria Operations vulnerability tracked as CVE-2026-22719 to its Known Exploited Vulnerabilities catalog, flagging the flaw as exploited in attacks.	Exploit	BleepingComputer
6.3.26	Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities	Cisco has disclosed that two more vulnerabilities affecting Catalyst SD-WAN Manager (formerly SD-WAN vManage) have come under active exploitation in	Exploit	The Hacker News
4.3.26	Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1	Google said it identified a "new and powerful" exploit kit dubbed Coruna (aka CryptoWaters) targeting Apple iPhone models running iOS versions between	Exploit	The Hacker News
4.3.26	CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria	Exploit	The Hacker News
1.3.26	US sanctions Russian broker for buying stolen zero-day exploits	The U.S. Treasury Department has sanctioned a Russian exploit broker who bought stolen hacking tools from a former executive of a U.S. defense contractor.	Exploit	BleepingComputer
28.2.26	CISA: Recently patched RoundCube flaws now exploited in attacks	CISA flagged two Roundcube Webmail vulnerabilities as actively exploited in attacks and ordered U.S. federal agencies to patch them within three weeks.	Exploit	BleepingComputer
22.2.26	CISA orders feds to patch actively exploited Dell flaw within 3 days	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their systems within three days against a maximum-severity Dell vulnerability that has been under active exploitation since mid-2024.	Exploit	BleepingComputer
21.2.26	CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Roundcube webmail software to its Known	Exploit	The Hacker News
19.2.26	CISA gives feds 3 days to patch actively exploited BeyondTrust flaw	CISA ordered U.S. government agencies on Friday to secure their BeyondTrust Remote Support instances against an actively exploited vulnerability within three days.	Exploit	BleepingComputer
19.2.26	Google patches first Chrome zero-day exploited in attacks this year	Google has released emergency updates to fix a high-severity Chrome vulnerability exploited in zero-day attacks, marking the first such security flaw patched since the start of the year.	Exploit	BleepingComputer
18.2.26	CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog,	Exploit	The Hacker News
16.2.26	New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released	Google on Friday released security updates for its Chrome browser to address a security flaw that it said has been exploited in the wild. The high-severity	Exploit	The Hacker News
15.2.26	Critical BeyondTrust RCE flaw now exploited in attacks, patch now	A critical pre-authentication remote code execution vulnerability in BeyondTrust Remote Support and Privileged Remote Access appliances is now being exploited in attacks after a PoC was published online.	Exploit	BleepingComputer
13.2.26	Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability	Threat actors have started to exploit a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access	Exploit	The Hacker News
12.2.26	83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure	A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to	Exploit	The Hacker News
12.2.26	Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices	Apple on Wednesday released iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw that it said has been exploited in	Exploit	The Hacker News
10.2.26	Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data	The Netherlands' Dutch Data Protection Authority (AP) and the Council for the Judiciary confirmed both agencies (Rvdr) have disclosed that their systems	Exploit	The Hacker News
10.2.26	SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers	Microsoft has revealed that it observed a multi‑stage intrusion that involved the threat actors exploiting internet‑exposed SolarWinds Web Help Desk	Exploit	The Hacker News
9.2.26	TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure	Cybersecurity researchers have called attention to a "massive campaign" that has systematically targeted cloud native environments to set up malicious	Exploit	The Hacker News
8.2.26	Critical n8n flaws disclosed along with public exploits	Multiple critical vulnerabilities in the popular n8n open-source workflow automation platform allow escaping the confines of the environment and taking complete control of the host server.	Exploit	BleepingComputer
8.2.26	CISA: VMware ESXi flaw now exploited in ransomware attacks	CISA confirmed on Wednesday that ransomware gangs have begun exploiting a high-severity VMware ESXi sandbox escape vulnerability that was used in zero-day attacks since at least February 2024.	Exploit	BleepingComputer
8.2.26	CISA warns of five-year-old GitLab flaw exploited in attacks	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their systems against a five-year-old GitLab vulnerability that is actively being exploited in attacks.	Exploit	BleepingComputer
4.2.26	CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting SolarWinds Web Help Desk (WHD) to	Exploit	The Hacker News
3.2.26	Ivanti warns of two EPMM flaws exploited in zero-day attacks	Ivanti has disclosed two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, that were exploited in zero-day attacks.	Exploit	BleepingComputer
3.2.26	Microsoft patches actively exploited Office zero-day vulnerability	Microsoft has released emergency security updates to patch a high-severity Office zero-day vulnerability exploited in attacks.	Exploit	BleepingComputer
3.2.26	CISA says critical VMware RCE flaw now actively exploited	CISA has flagged a critical VMware vCenter Server vulnerability as actively exploited and ordered U.S. federal agencies to secure their servers within three weeks.	Exploit	BleepingComputer
30.1.26	Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates Released	Ivanti has rolled out security updates to address two security flaws impacting Ivanti Endpoint Manager Mobile (EPMM) that have been exploited in zero-day	Exploit	The Hacker News
28.1.26	Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088	Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched	Exploit	The Hacker News
27.1.26	Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation	Microsoft on Monday issued out-of-band security patches for a high-severity Microsoft Office zero-day vulnerability exploited in attacks. The vulnerability,	Exploit	The Hacker News
25.1.26	CISA confirms active exploitation of four enterprise software bugs	The Cybersecurity and Infrastructure Security Agency (CISA) in the U.S. warned of active exploitation of four vulnerabilities impacting enterprise software from Versa and Zimbra, the Vite frontend tooling framework, and the Prettier code formatter.	Exploit	BleepingComputer
25.1.26	Hackers exploit critical telnetd auth bypass flaw to get root	A coordinated campaign has been observed targeting a recently disclosed critical-severity vulnerability that has been present in the GNU InetUtils telnetd server for 11 years.	Exploit	BleepingComputer
25.1.26	SmarterMail auth bypass flaw now exploited to hijack admin accounts	Hackers began exploiting an authentication bypass vulnerability in SmarterTools' SmarterMail email server and collaboration tool that allows resetting admin passwords.	Exploit	BleepingComputer
25.1.26	Hackers exploit security testing apps to breach Fortune 500 firms	Threat actors are exploiting misconfigured web applications used for security training and internal penetration testing, such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP, to gain access to cloud environments of Fortune 500 companies and security vendors.	Exploit	BleepingComputer
24.1.26	CISA Adds Actively Exploited VMware vCenter Flaw CVE-2024-37079 to KEV Catalog	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw affecting Broadcom VMware vCenter Server that	Exploit	The Hacker News
24.1.26	CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added four security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog,	Exploit	The Hacker News
22.1.26	SmarterMail Auth Bypass Exploited in the Wild Two Days After Patch Release	A new security flaw in SmarterTools SmarterMail email software has come under active exploitation in the wild, two days after the release of a patch. The	Exploit	The Hacker News
22.1.26	Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations	Cybersecurity company Arctic Wolf has warned of a "new cluster of automated malicious activity" that involves unauthorized firewall configuration changes	Exploit	The Hacker News
18.1.26	Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks	Attackers are now exploiting a critical Fortinet FortiSIEM vulnerability with publicly available proof-of-concept exploit code.	Exploit	BleepingComputer
18.1.26	Hackers exploit Modular DS WordPress plugin flaw for admin access	Hackers are actively exploiting a maximum severity flaw in the Modular DS WordPress plugin that allows them to bypass authentication remotely and access the vulnerable sites with admin-level privileges.	Exploit	BleepingComputer
18.1.26	Exploit code public for critical FortiSIEM command injection flaw	Technical details and a public exploit have been published for a critical vulnerability affecting Fortinet's Security Information and Event Management (SIEM) solution that could be leveraged by a remote, unauthenticated attacker to execute commands or code.	Exploit	BleepingComputer
17.1.26	CISA orders feds to patch Gogs RCE flaw exploited in zero-day attacks	CISA has ordered government agencies to secure their systems against a high-severity Gogs vulnerability that was exploited in zero-day attacks.	Exploit	BleepingComputer
16.1.26	Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways	Cisco on Thursday released security updates for a maximum-severity security flaw impacting Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, nearly a month after the company disclosed that it had been exploited as a zero-day by a China-nexus advanced persistent threat (APT) actor codenamed UAT-9686.	Exploit	The Hacker News
16.1.26	Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access	A maximum-severity security flaw in a WordPress plugin called Modular DS has come under active exploitation in the wild, according to Patchstack. The vulnerability, tracked as CVE-	Exploit	The Hacker News
14.1.26	CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity security flaw impacting Gogs by adding it to its Known	Exploit	The Hacker News
10.1.26	VMware ESXi zero-days likely exploited a year before disclosure	Chinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted vulnerabilities became publicly known.	Exploit	BleepingComputer
10.1.26	Cisco warns of Identity Service Engine flaw with exploit code	Cisco has patched an ISE vulnerability with public proof-of-concept exploit code that can be abused by attackers with admin privileges.	Exploit	BleepingComputer
10.1.26	CISA tags max severity HPE OneView flaw as actively exploited	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a maximum-severity HPE OneView vulnerability as actively exploited in attacks.	Exploit	BleepingComputer
10.1.26	New D-Link flaw in legacy DSL routers actively exploited in attacks	Threat actors are exploiting a recently discovered command injection vulnerability that affects multiple D-Link DSL gateway routers that went out of support years ago.	Exploit	BleepingComputer
10.1.26	The Great VM Escape: ESXi Exploitation in the Wild	Based on indicators we observed, including the workstation name the threat actor was operating from and other TTPs, the Huntress Tactical Response team assesses with high confidence that initial access occurred via SonicWall VPN.	Exploit	HUNTRESS
8.1.26	Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release	Cisco has released updates to address a medium-severity security flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) with a public proof-of-concept	Exploit	The Hacker News
7.1.26	CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting Microsoft Office and Hewlett Packard Enterprise (HPE) OneView to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.	Exploit	The Hacker News
4.1.26	Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass	Over 10,000 Internet-exposed Fortinet firewalls are still vulnerable to attacks exploiting a five-year-old two-factor authentication (2FA) bypass vulnerability.	Exploit	BleepingComputer
3.1.26	CISA orders feds to patch MongoBleed flaw exploited in attacks	CISA ordered U.S. federal agencies to patch an actively exploited MongoDB vulnerability (MongoBleed) that can be exploited to steal credentials, API keys, and other sensitive data.	Exploit	BleepingComputer
3.1.26	CISA orders feds to patch MongoBleed flaw exploited in attacks	CISA ordered U.S. federal agencies to patch an actively exploited MongoDB vulnerability (MongoBleed) that can be exploited to steal credentials, API keys, and other sensitive data.	Exploit	BleepingComputer
3.1.26	Fortinet warns of 5-year-old FortiOS 2FA bypass still exploited in attacks	Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls.	Exploit	BleepingComputer