The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.

CVE-2026-72898 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Metabase
• Description: Metabase is affected by an unauthenticated SQL injection vulnerability in its password reset functionality. An unauthenticated remote attacker can exploit this issue to execute arbitrary SQL queries and gain administrator access to the application.
• Remediation:
  • Security update available for Metabase - Please upgrade now
  • SQL injection using an unauthenticated endpoint leading to admin access · Advisory · metabase/metabase · GitHub
• More Info: NVD - CVE-2026-72898
• PoC:
  • https://github.com/0xBlackash/CVE-2026-72898
  • https://github.com/Franc-Zar/CVE-2026-72898-safe-detection
  • https://github.com/VuxNx/CVE-2026-72898

CVE-2026-59310 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: VMware vCenter Server
• Description: VMware vCenter Server is affected by a directory traversal vulnerability in its Syslog server component that allows remote attackers to access or overwrite arbitrary files. This flaw stems from improper input validation of pathname sequences within the Syslog server message handlers.
• Remediation:
  • Support Content Notification - Support Portal - Broadcom support portal
  • Google LLC
• More Info: NVD - CVE-2026-59310
• PoC:
  • https://github.com/BiuTrap/CVE-2026-59310
  • https://github.com/HORKimhab/CVE-2026-59310

CVE-2026-18686 NEW

• Severity: 8.8 HIGH
• Impacted Products: GL.iNet GL-MT3000 up to 4.4.5
• Description: A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-18686
• PoC:
  • https://github.com/coconut652-7/IOT_Vul_Public/tree/main/Glinet/MT3000/nas-web/ADD_USER_ADD_SHARE

CVE-2026-18685 NEW

• Severity: 8.8 HIGH
• Impacted Products: GL.iNet GL-MT3000 up to 4.4.5
• Description: A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-18685
• PoC:
  • https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_set_upgrade_glc_rce

CVE-2013-4786 NEW

• Severity: 7.5 HIGH
• Impacted Products: IMPI version 2.0
• Description: Intelligent Platform Management Protocol is a industry-wide protocol used to standardize hardware-based remote server management. Baseboard Management Controllers (BMC) are commonly designed using IPMI.
• Remediation:
  • c04197764
  • DSA-2020-154
  • SOL16846
• More Info: NVD - CVE-2013-4786
• PoC:
  • https://www.exploit-db.com/exploits/38633
  • https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb

CVE-2026-55040 NEW

• Severity: 9.1 CRITICAL
• Impacted Products: Microsoft SharePoint Server
• Description: Microsoft SharePoint Server is affected by a security feature bypass vulnerability caused by weak authentication within the JWT token validation pipeline. This flaw allows a remote, unauthenticated attacker to bypass authentication mechanisms and perform operations with the privileges of a SharePoint site user or administrator.
• Remediation:
  • Microsoft SharePoint Server Security Feature Bypass Vulnerability
  • Microsoft KB 5002882
  • Microsoft KB 5002883
• More Info: NVD - CVE-2026-55040
• PoC:
  • https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040

CVE-2026-53413 NEW

• Severity: 8.3 HIGH
• Impacted Products: Zoom Clients
• Description: Zoom Clients contains an out-of-bounds write vulnerability within its annotation processing component that allows a meeting participant to execute arbitrary code on another participant’s device. The issue arises from missing bounds checks when parsing shared annotation objects during a meeting.
• Remediation:
  • ZSB-26015 | Zoom
• More Info: NVD - CVE-2026-53413
• PoC:
  • https://github.com/HORKimhab/CVE-2026-53413

CVE-2026-33824

• Severity: 9.8 CRITICAL
• Impacted Products: Microsoft Windows, IKE version 2 (IKEv2)
• Description: Microsoft Windows is affected by a double free vulnerability in the Internet Key Exchange (IKE) Service Extensions that allows for remote code execution. An unauthenticated attacker can trigger this flaw by sending specially crafted packets to a target system where IKE version 2 (IKEv2) is enabled.
• Remediation:
  • Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
  • Microsoft KB 5082052
  • Microsoft KB 5082060
• More Info: NVD - CVE-2026-33824
• PoC:
  • https://github.com/z3r0h3ro/CVE-2026-33824

CVE-2026-9198

• Severity: 9.8 CRITICAL
• Impacted Products: Langflow OSS
• Description: Langflow OSS allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-9198
• PoC:
  • https://github.com/0xgh057r3c0n/CVE-2026-9198
  • https://github.com/ywh-jfellus/CVE-2026-9198
  • https://www.ibm.com/support/pages/node/7278927

CVE-2026-65400 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Apple macOS
• Description: Apple macOS contains an authentication bypass vulnerability in its Screen Sharing component that allows a network-based attacker to authenticate without providing valid credentials. This issue is caused by improper state management during the authentication protocol.
• Remediation:
  • About the security content of macOS Tahoe 26.6.1 - Apple Support
  • About the security content of macOS Sequoia 15.7.9 - Apple Support
  • About the security content of macOS Sonoma 14.8.9 - Apple Support
• More Info: NVD - CVE-2026-65400
• PoC:
  • https://github.com/HORKimhab/CVE-2026-65400
  • https://github.com/acheong08/CVE-2026-65400
  • https://github.com/panchocosil/CVE-2026-65400-poc

CVE-2026-42533 NEW

• Severity: 8.1 HIGH
• Impacted Products: NGINX Plus, NGINX Open Source
• Description: NGINX Plus and NGINX Open Source are affected by a heap-based buffer overflow vulnerability within the map directive component. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests, potentially leading to a denial-of-service or arbitrary code execution.
• Remediation:
  • Red Hat Hardened Images RPMs bug fix and enhancement update
  • NGINX Map directive and Regex matching vulnerability
  • NGINX map directive and regex matching vulnerability CVE-2026-42533
• More Info: NVD - CVE-2026-42533
• PoC:
  • https://github.com/imbas007/CVE-2026-42533
  • https://github.com/suominen/CVE-2026-42533
  • https://github.com/0xCyberstan/CVE-2026-42533-POC

CVE-2026-18577 NEW

• Severity: 6.8 MEDIUM
• Impacted Products: N-able N-central 2026.3.1
• Description: N-able N-central is affected by an authentication bypass vulnerability resulting from an incomplete patch for CVE-2026-18556. This flaw allows a remote, unauthenticated attacker to bypass authentication controls and achieve complete administrative account takeover on vulnerable systems.
• Remediation:
  • 2026.3 HF1 Release Notes
  • N-central Security Update – August 2, 2026 - N-able
• More Info: NVD - CVE-2026-18577
• PoC:
  • https://github.com/HORKimhab/CVE-2026-18577

CVE-2026-73034 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: DB-GPT v0.8.1
• Description: DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories…
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-73034
• PoC:
  • https://github.com/Boreas37/CVE-2026-73034-PoC

CVE-2026-71362 NEW

• Severity: 9.1 CRITICAL
• Impacted Products: Adobe Commerce
• Description: Adobe Commerce is affected by an incorrect authorization vulnerability that allows a remote attacker to escalate privileges. An attacker can exploit this issue without requiring user interaction to gain unauthorized access to sensitive resources.
• Remediation:
  • Adobe Security Bulletin
• More Info: NVD - CVE-2026-71362
• PoC:
  • https://github.com/dinosn/cve-2026-71362-magento-lab

CVE-2026-69098 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: kotaemon through 0.12.0
• Description: kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-69098
• PoC:
  • https://github.com/0xdak/CVE-2026-69098_exploit

CVE-2026-67870 NEW

• Severity: 7.5 HIGH
• Impacted Products: open62541 v1.5.5
• Description: In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-67870
• PoC:
  • https://github.com/open62541/open62541/issues/8172

CVE-2026-67689 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: FineAdmin V1.0
• Description: FineAdmin V1.0 is affected by an SQL injection vulnerability in its paginated list endpoints. A remote attacker can exploit this issue via crafted HTTP requests to execute arbitrary SQL commands or code on the system.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-67689
• PoC:
  • https://github.com/qflksheep/CVE-2026-67689-FineAdmin.Mvc-vulnerability

CVE-2026-58231 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: SAP Commerce Cloud (versions COM_CLOUD 2211, 2211-JDK21)
• Description: SAP Commerce Cloud is affected by an improper authorization and code injection vulnerability within its Data Hub Adapter component. An unauthenticated remote attacker can abuse a default authentication client and submit crafted payloads to execute arbitrary code on the underlying system.
• Remediation:
  • SAP Security Patch Day - August 2026
• More Info: NVD - CVE-2026-58231
• PoC:
  • https://github.com/HORKimhab/CVE-2026-58231
  • https://github.com/WildanDeveloper/CVE-2026-58231

CVE-2026-52680 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Apache Kyuubi: from 1.7.0 through 1.11.1, Apache Kyuubi: 1.12.0
• Description: Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1. Users are recommended to upgrade to versi…
• Remediation:
  • CVE-2026-52680: Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write-Apache Mail Archives
• More Info: NVD - CVE-2026-52680
• PoC:
  • https://github.com/0xdak/CVE-2026-52680_exploit

CVE-2026-52134 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: libiec61850 v1.6
• Description: An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-52134
• PoC:
  • https://github.com/if-forget/CVE-2026-52134-libiec61850

CVE-2026-51785 NEW

• Severity: 8.1 HIGH
• Impacted Products: Hugo Leisink Hiawatha v.12.1 and before
• Description: An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-51785
• PoC:
  • https://fenrisk.com/hiawatha-http-smuggling

CVE-2026-42530

• Severity: 8.1 HIGH
• Impacted Products: NGINX Open Source
• Description: NGINX Open Source is affected by a use-after-free vulnerability in the ngx_http_v3_module when configured to use the HTTP/3 QUIC module. A remote, unauthenticated attacker, along with conditions beyond their control, can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream, potentially leading to a denial of service or arbitrary code execution.
• Remediation:
  • RHSA-2026:20351 - Security Advisory - Red Hat Customer Portal
  • Out-of-band Security Notification (June 17, 2026)
  • NGINX ngx_http_v3_module vulnerability CVE-2026-42530
• More Info: NVD - CVE-2026-42530
• PoC:
  • https://github.com/v4ltonn/CVE-2026-42530
  • https://github.com/HORKimhab/CVE-2026-42530
  • https://github.com/0xBlackash/CVE-2026-42530

CVE-2026-38447 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: osTicket 1.18.3
• Description: osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-38447
• PoC:
  • https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-38447.md

CVE-2026-19264 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Postiz
• Description: Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw dot-segments are collapsed before routing, but URL-encoded separators survive route matching and are decoded only once they reach the handler, restoring the traversal at the filesystem call. An unauthenticated…
• Remediation:
  • PSA-2026-TH12B7: Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover · GAdvisory
• More Info: NVD - CVE-2026-19264
• PoC:
  • https://github.com/DarkLycn1976/CVE-2026-19264

CVE-2026-18684 NEW

• Severity: 8.8 HIGH
• Impacted Products: GL.iNet GL-MT3000 up to 4.4.5
• Description: A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-18684
• PoC:
  • https://github.com/StrTzz123/iot_vul/tree/main/GL-iNet/MT3000/4.4.5/modem_remove_profile_glc_rce

CVE-2026-18601 NEW

• Severity: 8.8 HIGH
• Impacted Products: GL.iNet GL-MT3000 up to 4.4.5
• Description: A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-18601
• PoC:
  • https://github.com/StrTzz123/iot_vul/blob/main/GL-iNet/MT3000/4.4.5/ovpn_check_config_glc_rce/CVE.md

CVE-2026-18108 NEW

• Severity: 9.1 CRITICAL
• Impacted Products: Net::SAML2 versions before 0.86
• Description: Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature.
• Remediation:
  • https://github.com/perl-net-saml2/perl-Net-SAML2/commit/d916468586404518b8cf3c78dbd001cc1f1046a7.patch
• More Info: NVD - CVE-2026-18108
• PoC:
  • https://github.com/perl-net-saml2/perl-Net-SAML2/commit/d916468586404518b8cf3c78dbd001cc1f1046a7.patch

CVE-2026-17566 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: pgAdmin 4 prior to version 9.18
• Description: pgAdmin 4 is affected by an OS command injection vulnerability in its Import/Export Data tool prior to version 9.18. A logic mismatch in string escape validation allows authenticated attackers to bypass query guards and execute arbitrary commands on the underlying host.
• Remediation:
  • FEDORA-2026-bacb14f76f — security update for pgadmin4 — Fedora Updates System
  • FEDORA-2026-f0550055a7 — security update for pgadmin4 — Fedora Updates System
  • https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3
• More Info: NVD - CVE-2026-17566
• PoC:
  • https://github.com/HackSpeak/CVE-2026-17566

CVE-2026-17351 NEW

• Severity: 9.0 CRITICAL
• Impacted Products: pgAdmin 4 9.13, pgAdmin 4 9.14, pgAdmin 4 9.15, pgAdmin 4 9.16
• Description: pgAdmin 4 is affected by an SQL injection and read-only transaction bypass vulnerability in its AI Assistant feature. This issue arises from a lexer parsing disagreement between the sqlparse library and PostgreSQL, enabling crafted SQL queries to bypass validation checks.
• Remediation:
  • pgadmin4-9.17-1.fc43
  • pgadmin4-9.17-1.fc44
  • https://github.com/pgadmin-org/pgadmin4/commit/bf4792444446f0e7ab721d23cbd6bfe6afaa7a8b
• More Info: NVD - CVE-2026-17351
• PoC:
  • https://github.com/Hunt-Benito/pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass

CVE-2024-12856 NEW

• Severity: 7.2 HIGH
• Impacted Products: Four-Faith F3x24 firmware version 2.0, Four-Faith F3x36 firmware version 2.0
• Description: Four-Faith router models F3x24 and F3x36 are affected by an OS command injection vulnerability in firmware version 2.0, allowing authenticated remote attackers to execute arbitrary OS commands via the apply.cgi interface when modifying system time. The presence of default credentials can effectively render this vulnerability unauthenticated.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2024-12856
• PoC:
  • https://github.com/nu113d/CVE-2024-12856
  • https://vulncheck.com/blog/four-faith-cve-2024-12856
  • https://ducklingstudio.blog.fc2.com/blog-entry-392.html

CVE-2026-69085 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: SiYuan v3.7.3
• Description: SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding.
• Remediation:
  • Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking · Advisory · siyuan-note/siyuan · GitHub
• More Info: NVD - CVE-2026-69085
• PoC:
  • https://github.com/Boreas37/CVE-2026-69084-PoC

CVE-2026-69084 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: SiYuan v3.7.2
• Description: SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions.
• Remediation:
  • Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write · Advisory · siyuan-note/siyuan · GitHub
• More Info: NVD - CVE-2026-69084
• PoC:
  • https://github.com/Boreas37/CVE-2026-69084-PoC

CVE-2026-69083 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: SiYuan v3.7.3
• Description: SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
• Remediation:
  • Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB · Advisory · siyuan-note/siyuan · GitHub
• More Info: NVD - CVE-2026-69083
• PoC:
  • https://github.com/0xdak/CVE-2026-69083_exploit

CVE-2026-68771 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: ComfyUI v0.23.0
• Description: ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code.
• Remediation:
  • harden: load training-dataset shards with weights_only=True by mattmillerai · Pull Request #14543 · Comfy-Org/ComfyUI · GitHub
• More Info: NVD - CVE-2026-68771
• PoC:
  • https://github.com/0xdak/CVE-2026-68771_exploit

CVE-2026-67340 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: ArcadeDB before 26.7.2
• Description: ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.
• Remediation:
  • Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE) · Advisory · ArcadeData/arcadedb · GitHub
• More Info: NVD - CVE-2026-67340
• PoC:
  • https://github.com/0xdak/CVE-2026-67340_exploit

CVE-2026-65321 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: PyAthena < 3.35.4, Athena, Trino
• Description: PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL s…
• Remediation:
  • SQL injection in DefaultParameterFormatter for DELETE and CTAS statements · Advisory · pyathena-dev/PyAthena · GitHub
• More Info: NVD - CVE-2026-65321
• PoC:
  • https://github.com/rahulreddykarne/CVE-2026-65321-pyathena

CVE-2026-64827 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Telenia Software TVox 26.5.3, Telenia Software TVox 26.x, Telenia Software TVox 24.9.21, Telenia Software TVox 24.x
• Description: Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches ‘login_admin.php’.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-64827
• PoC:
  • https://karmainsecurity.com/KIS-2026-14

CVE-2026-63223 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: CodeIgniter 4.7.4
• Description: CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory.
• Remediation:
  • Uploaded file extension validation bypass in is_image and mime_in rules · Advisory · codeigniter4/CodeIgniter4 · GitHub
• More Info: NVD - CVE-2026-63223
• PoC:
  • https://github.com/shinthink/CVE-2026-63223
  • https://github.com/imbas007/CVE-2026-63223-POC

CVE-2026-59243 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: apache-airflow-providers-fab < 3.7.3
• Description: The apache-airflow-providers-fab package prior to version 3.7.3 is affected by an authentication bypass vulnerability in its FAB auth manager component. An unauthenticated attacker can exploit this flaw to bypass authentication and log in as any arbitrary user, including accounts with administrative privileges.
• Remediation:
  • CVE-2026-59243: Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (verify_signature defaults to False)-Apache Mail Archives
  • Verify Azure AD OAuth id_token signatures by default in FAB auth manager by potiuk · Pull Request #69374 · apache/airflow · GitHub
• More Info: NVD - CVE-2026-59243
• PoC:
  • https://github.com/0xdak/CVE-2026-59243_exploit

CVE-2026-53921 NEW

• Severity: Unknown
• Impacted Products: odhcpd, OpenWrt
• Description: A critical stack overflow vulnerability in the odhcpd DHCPv6 server of OpenWrt. It can be triggered by an unauthenticated attacker sending a crafted DHCPv6 REQUEST to UDP port 547, allowing the attacker to overwrite a stack buffer and execute arbitrary code as root.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-53921
• PoC:
  • https://github.com/0xBlackash/CVE-2026-53921

CVE-2026-50656

• Severity: 7.8 HIGH
• Impacted Products: Microsoft Defender
• Description: Microsoft Defender is affected by a race condition vulnerability that allows an attacker to escalate privileges to SYSTEM level. This flaw enables the execution of arbitrary code or unauthorized actions on the affected Windows system.
• Remediation:
  • Microsoft Defender Elevation of Privilege Vulnerability
• More Info: NVD - CVE-2026-50656
• PoC:
  • https://github.com/0xBlackash/CVE-2026-50656

CVE-2026-41452 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Krayin CRM 2.2.4
• Description: Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-41452
• PoC:
  • https://github.com/Boreas37/CVE-2026-41452-PoC
  • https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452

CVE-2026-33267 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Apache Traffic Server 9.2.0 through 9.2.14, Apache Traffic Server 10.1.0 through 10.1.3
• Description: Apache Traffic Server is affected by an improper input validation vulnerability that allows remote attackers to spoof internal metadata. The flaw exists because the server fails to sanitize untrusted internal and hop-by-hop headers from incoming HTTP requests.
• Remediation:
  • [SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.15 and 10.1.4-Apache Mail Archives
  • FEDORA-2026-5bec7441bb — security update for trafficserver — Fedora Updates System
• More Info: NVD - CVE-2026-33267
• PoC:
  • https://github.com/Boreas37/CVE-2026-33267-PoC

CVE-2025-49113

• Severity: 9.9 CRITICAL
• Impacted Products: Roundcube Webmail
• Description: Roundcube Webmail is affected by a PHP object deserialization vulnerability that allows authenticated users to execute arbitrary code. This flaw exists because the application fails to properly validate the _from URL parameter within the program/actions/settings/upload.php component.
• Remediation:
  • USN-7584-1: Roundcube vulnerability | Ubuntu security notices | Ubuntu
  • roundcubemail-1.6.11-1.fc42
  • roundcubemail-1.6.11-1.fc41
• More Info: NVD - CVE-2025-49113
• PoC:
  • https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/roundcube_auth_rce_cve_2025_49113.rb
  • https://github.com/AC8999/CVE-2025-49113/blob/main/exploit.py
  • https://github.com/B1ack4sh/Blackash-CVE-2025-49113

CVE-2021-33045 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Dahua IP cameras
• Description: Dahua IP cameras and related products are affected by an authentication bypass vulnerability in the login component. By sending specially crafted network packets, a remote attacker can circumvent identity verification to gain unauthorized access to the device.
• Remediation:
  • Identity authentication bypass vulnerability found in some Dahua products
• More Info: NVD - CVE-2021-33045
• PoC:
  • https://github.com/lequoca/Camera-Dahua-CVE-2021-33045/blob/main/README.md

CVE-2021-33044 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Dahua IP cameras, Dahua video intercoms
• Description: Multiple Dahua products, including IP cameras and video intercoms, are affected by an authentication bypass vulnerability. This flaw allows a remote attacker to bypass identity verification by sending specially crafted data packets during the login process.
• Remediation:
  • Identity authentication bypass vulnerability found in some Dahua products
• More Info: NVD - CVE-2021-33044
• PoC:
  • https://github.com/eagle-nett/DAHUA_AUTH-BYPASS-CVE-2021-33044
  • https://github.com/Baza-NATO/CVE-2021-33044
  • https://github.com/haingn/LoHongCam-CVE-2021-33044/blob/main/dahua_bypass.py

References

This list was scraped from the quite amazing and highly recommended newsletters below:

• ~this week in security~
• Unsupervised Learning
• @RISK
• Hive Five
• Vulnerable U
• tl;dr sec

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.