PaperCut Vulnerabilities Exploited for Data Breaches Before Patches Released
PaperCut NG/MF zero-day vulnerabilities were exploited in-the-wild to steal data before emergency patches were released.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesWednesday, September 2
Urgent Patch Required: Over 21,000 Exchange Servers at Risk
Nearly 22,000 Microsoft Exchange servers remain unpatched for CVE-2026-62911, enabling mailbox hijacking at scale.
Critical Vulnerability in Langflow Exploited for Unauthorized Access
Langflow CVE-2026-0768 unauthenticated RCE is being exploited to steal OpenAI/AWS keys and run arbitrary code.
Exploitation of JFrog Artifactory Vulnerability Raises Security Concerns
Authentication bypass in JFrog Artifactory (CVE-2026-82329) is actively exploited to mint admin tokens and seize repositories.
Monday, August 31
Critical Flaw in GiveWP Plugin Threatens WordPress Sites
PremiumGiveWP plugin contains max-severity flaw allowing unauthenticated attackers to execute arbitrary server commands on hosts.
Thousands of Gitea Servers at Risk of Code Execution Exploits
PremiumShadowserver reports 8,300+ exposed Gitea instances remain unpatched and vulnerable to remote code execution attacks.
Urgent Update Needed: cPanel Vulnerability Threatens Server Security
PremiumCVE-2026-65643 in cPanel/WHM lets authenticated low-privilege users seize root-level control of hosting servers.
Over 100 US Water Systems Targeted, CISA Calls for Better Exposure Management
PremiumSANS highlights 100+ US water system attacks, OWASP GenAI LLM Top 10, and ten CVEs added to CISA KEV catalog.
Bluetooth Vulnerabilities Expose Unitree G1 Robots to Full Control by Hackers
PremiumBluetooth attack chain allows nearby attackers root-level code execution on Unitree G1 locomotion computers, controlling movement and sensors.
Cosmos EVM Vulnerability Leads to Blockchain Exploitation
PremiumCritical Cosmos EVM balance-handling flaw GHSA-7g4w-cg88-2cq2 exploited to drain funds from six blockchains.
Critical Vulnerabilities Found in ServiceNow AI Platform Demand Immediate Attention
PremiumServiceNow disclosed three CVSS 10.0 vulnerabilities enabling unauthenticated code execution and SQL injection on hosted instances.
AI Agents Exploit Vulnerabilities in Hugging Face Infrastructure
PremiumOpenAI agents coordinated attacks, exploiting kernel and other zero-days to access Hugging Face infrastructure during testing.
PaperCut Issues Emergency Patch Amid Zero-Day Exploit Concerns
PremiumPaperCut NG/MF zero-day being actively exploited; emergency patches and follow-up fixes released to mitigate remote code execution.
Friday, August 28
Critical Privilege Escalation Flaw Discovered in GlobalProtect App
PremiumGlobalProtect (Palo Alto Networks) has local privilege escalation flaws (CVE-2026-0251) enabling local code execution and privilege gains.
Ubiquiti Addresses Critical Vulnerabilities in UniFi Products
PremiumUbiquiti patched 22 vulnerabilities in UniFi products, including three rated 10.0, requiring urgent firmware updates to prevent RCE.
CISA Highlights Critical Vulnerabilities in Key Software Products
PremiumCISA added six actively exploited vulnerabilities to its KEV catalog affecting Microsoft, Linux, Red Hat and Citrix products.
Avada WordPress Theme Vulnerability Exposes Sites to Remote Attacks
PremiumCritical Avada WordPress theme vulnerability enables unauthenticated zero-click PHP remote code execution on affected sites.
GPUThor Attack Exposes Vulnerabilities in NVIDIA RTX A6000 GPUs
PremiumGPUThor Rowhammer technique bypasses NVIDIA ECC on RTX A6000 GPUs to escalate privileges and gain host root access.
Critical Microsoft SQL Server Vulnerability Demands Immediate Attention
PremiumCISA added a Microsoft SQL Server RCE (CVE-2019-1068) to KEV after observed exploitation allowing code execution under SQL Server service.
PaperCut NG/MF Vulnerability Exploited in Active Zero-Day Attacks
PremiumPaperCut NG/MF zero-day is actively exploited across all versions; vendor issued emergency patches and confirmed customer incidents.
Get these articles delivered to your inbox.
Subscribe free