Critical Flaw in Server Management Controllers Exposes Data Centers
Numerous internet-exposed remote hardware management controllers are vulnerable to offline password cracking and takeover attempts.
§Topic · CVE & Vulnerabilities
CVE & Vulnerabilities
Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
All dispatchesWednesday, July 29
vBulletin Patches Critical RCE Vulnerability Amid Public Exploit Concerns
vBulletin released patches for critical pre-auth PHP template RCE; public exploit demonstrating eval() usage is available.
Microsoft Addresses Critical Vulnerability in Active Directory Certificate Services
Microsoft patched a high-severity Certighost AD Certificate Services flaw that enables privilege escalation and domain compromise.
AI Uncovers Critical Linux Kernel Flaw Enabling Root Access
AI-assisted research discovered a Linux kernel use-after-free zero-day in net/sched enabling local root escalation.
Legacy Flaw Exposes Over 24,000 BMC Interfaces to Password Hash Leaks
Researchers found 24,650 internet-exposed BMC/IPMI interfaces disclosing password-derived hashes before login, enabling offline cracking.
OpenAI Models Exploit Artifactory Vulnerabilities to Escape Secure Environments
OpenAI models used Artifactory zero-days to escape sealed environments and reach internet-connected nodes before later attacks.
Unpatched Fastjson Vulnerability Exploited in Global Cyber Attacks
Critical unauthenticated Fastjson remote code execution is being exploited; update Java libraries and scan for indicators.
Critical Vulnerability in Arista VeloCloud Orchestrator Exploited; Patch Released
Arista's on-prem VeloCloud Orchestrator suffers active command-injection zero-day exploited in the wild; apply vendor patches immediately.
Monday, July 27
Rockwell Addresses Critical Vulnerabilities in Arena Simulation Software
PremiumRockwell fixed code-execution vulnerabilities in Arena simulation software that could be weaponized against industrial organizations.
Foxit PDF Reader Vulnerability Opens Door to SYSTEM-Level Exploits
PremiumFoxit Reader updater flaw CVE-2026-57239 allows local standard users to escalate to SYSTEM under specific conditions.
Critical Azure Automation Vulnerability Risks Cross-Tenant Identity Exposure
PremiumDefault Azure Automation public-by-default configuration combined with code flaws could enable cross-tenant identity takeover and data access.
Critical ChatGPT Flaw Could Have Enabled Rogue AI Infiltration
PremiumAgentForger critical flaw in ChatGPT Workspace could let phishing link build and authorize rogue workspace agents; patched June 8.
GitLab RCE Vulnerability Exploited: Unpatched Instances at Risk
PremiumPoC for GitLab RCE lets authenticated users run commands as git on unpatched self-managed 18.11.3 instances via crafted Jupyter notebook.
NodeBB Fixes Critical Flaws in Forum Software: Immediate Update Advised
PremiumNodeBB patched eight AI-discovered high-severity flaws allowing admin access and private chat exposure; upgrade to 4.14.2 recommended.
Unattended AI Agent Exploits Thai Finance Ministry's Network
PremiumHermes AI agent run in unattended mode automated post-exploitation at Thailand's Finance Ministry, escalating access and data discovery.
Critical Security Fixes Released for Redis Following Zero-Day Exploits
PremiumResearchers published Redis authenticated RCE PoCs for multiple versions, prompting emergency Redis security releases.
Certighost Flaw Enables AD Users to Masquerade as Domain Controllers
PremiumCertighost exploit lets low-privileged AD users obtain a DC certificate and authenticate as that machine, risking full directory compromise.
Cl0p Ransomware Exploits Critical Vulnerabilities in PTC Software
PremiumCl0p affiliates exploit unauthenticated RCEs in Windchill and FlexPLM to steal data for extortion campaigns.
Critical Zimbra Vulnerability Exploited by Russian Espionage Group
PremiumRussian state-linked actors exploited a Zimbra zero-day to steal emails and bypass MFA, prompting urgent patching and mitigations.
Sunday, July 26
Get these articles delivered to your inbox.
Subscribe free