RuntimeRebel — critical severity

MikroTik RouterOS Unauthenticated SSH Exploit: Critical Advisory

Sun, 06 Sep 2026 11:50:33 GMT

Attackers are exploiting a critical vulnerability in MikroTik RouterOS via internet-exposed SSH to gain full administrative control without authentication.

Zero-Day Exploitation: StyleSmuggler RCE in Magento, Adobe Commerce

Sun, 06 Sep 2026 01:55:08 GMT

Attackers are exploiting an unpatched zero-day (StyleSmuggler) in Magento Open Source and Adobe Commerce for unauthenticated RCE, installing backdoors.

CVE-2026-63077: JetBrains Cadence Breach Exposes Credentials

Sat, 05 Sep 2026 17:48:47 GMT

JetBrains Cadence suffered a data breach via unpatched TeamCity (CVE-2026-63077), exposing AWS credentials, source code, and user data. Immediate action required.

SonicWall SMA 1000 Zero-Days: Unauthenticated RCE Explained

Sat, 05 Sep 2026 11:31:26 GMT

Zero-day vulnerabilities in SonicWall SMA 1000 series appliances enable unauthenticated remote code execution, posing critical risks to organizations.

CVE-2026-19490: Citrix NetScaler Auth Bypass Under Attack

Sat, 05 Sep 2026 02:00:06 GMT

Critical Citrix NetScaler authentication bypass (CVE-2026-19490) is actively exploited in the wild, allowing remote unprivileged access.

Chrome Zero-Day CVE-2026-85046 Actively Exploited: Patch Now

Fri, 04 Sep 2026 12:22:34 GMT

Google released an urgent update for a critical Chrome zero-day, CVE-2026-85046, actively exploited in V8 engine type confusion attacks.

WordPress RCE Exploited via CVE-2026-14894 & CVE-2026-32475

Fri, 04 Sep 2026 12:22:02 GMT

Attackers exploit critical RCE flaws in WordPress Super Forms (CVE-2026-14894) and Elementor Pro (CVE-2026-32475) to deploy web shells and seize sites.

CVE-2026-73749: HPE ArubaOS-CX RCE Flaw Patched

Thu, 03 Sep 2026 19:00:03 GMT

HPE patches a critical remote code execution flaw, CVE-2026-73749, in ArubaOS-CX switches. Unauthenticated attackers can exploit a buffer overflow.

CVE-2026-83548: SonicWall SMA1000 SSRF Under Active Exploitation

Wed, 02 Sep 2026 19:13:21 GMT

A critical server-side request forgery (SSRF) vulnerability, CVE-2026-83548, in SonicWall SMA1000 Appliances is under active exploitation.

CVE-2026-9586: Sangoma Switchvox RCE via SQL Injection

Wed, 02 Sep 2026 19:12:29 GMT

Sangoma Switchvox is affected by CVE-2026-9586, an unauthenticated remote SQL injection vulnerability enabling RCE, with active exploitation confirmed.

CVE-2026-49869: Kestra OSS OS Command Injection Exploited

Wed, 02 Sep 2026 19:11:22 GMT

CISA has added CVE-2026-49869, an OS command injection in Kestra OSS, to its KEV catalog, confirming active exploitation by unauthenticated attackers.

CVE-2026-48710: Kludex Starlette HTTP Smuggling for Auth Bypass

Wed, 02 Sep 2026 19:10:47 GMT

CVE-2026-48710 impacts Kludex Starlette, enabling HTTP request smuggling and authentication bypass via path injection. Actively exploited.

CVE-2026-59822: BerriAI LiteLLM Authentication Bypass

Wed, 02 Sep 2026 19:09:55 GMT

BerriAI LiteLLM is vulnerable to an improper authentication flaw (CVE-2026-59822) actively exploited to bypass authentication.

CVE-2026-82329: JFrog Artifactory Auth Bypass to Admin Tokens

Tue, 01 Sep 2026 19:00:04 GMT

Threat actors are exploiting CVE-2026-82329 in JFrog Artifactory, an authentication bypass allowing unauthenticated admin access. Patch immediately.

CVE-2021-23758: Ajax.NET RCE via Deserialization of Untrusted Data

Tue, 01 Sep 2026 02:58:41 GMT

CVE-2021-23758 in Ajax.NET Professional allows remote code execution via untrusted data deserialization, with CISA confirming active exploitation.

CVE-2026-53362: Linux Kernel IPv6 Privilege Escalation

Tue, 01 Sep 2026 02:57:10 GMT

CISA adds CVE-2026-53362 to KEV, confirming active exploitation of a Linux Kernel privilege escalation vulnerability via IPv6. Patch now.

CVE-2023-49105: ownCloud Improper Auth Leads to Data Compromise

Tue, 01 Sep 2026 02:56:15 GMT

CVE-2023-49105 in ownCloud allows unauthenticated file access, modification, or deletion, actively exploited in the wild.

CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Exploit

Tue, 01 Sep 2026 02:54:42 GMT

CISA adds CVE-2026-82078 in PaperCut NG/MF to its KEV catalog following active exploitation. Review technical details and patch now.

CVE-2026-60004: Gitea Code Injection Under Active Exploitation

Wed, 26 Aug 2026 00:45:21 GMT

CISA confirms active exploitation of CVE-2026-60004, a Gitea code injection vulnerability allowing shell command execution with repository write access.

CVE-2026-21962: Oracle WebLogic RCE Under Active Attack

Tue, 25 Aug 2026 08:32:45 GMT

CISA urges immediate patching for CVE-2026-21962, a critical Oracle WebLogic Server Proxy plugin vulnerability actively exploited in the wild.

CVE-2026-72529: Critical RCE in TrueConf Server via Missing Auth

Fri, 21 Aug 2026 00:48:00 GMT

CISA warns of active exploitation of CVE-2026-72529 in TrueConf Server, allowing remote attackers to execute arbitrary scripts via port 4307/TCP.

CVE-2026-72530: TrueConf Server Remote Code Execution

Fri, 21 Aug 2026 00:47:12 GMT

CISA confirms active exploitation of CVE-2026-72530, a TrueConf Server code injection flaw leading to remote code execution. Immediate patching is critical.

Zimbra CVE-2026-73570 Actively Exploited: Patch Now

Thu, 20 Aug 2026 16:24:30 GMT

Active exploitation targets Zimbra servers via CVE-2026-73570, a high-severity flaw allowing unauthenticated RCE. Patch to v10.1.20 now.

CVE-2026-32475: Elementor Pro Unauthenticated RCE Flaw

Thu, 20 Aug 2026 08:26:43 GMT

A critical flaw, CVE-2026-32475, in Elementor Pro allows unauthenticated attackers to upload PHP files and execute code, affecting versions <= 4.2.1.

MLflow CVE-2026-64849 Exploited: Cloud Credential Theft Via SSRF

Wed, 19 Aug 2026 08:25:32 GMT

Attackers exploit a critical MLflow SSRF vulnerability (CVE-2026-64849) to steal cloud credentials.

CVE-2026-33824: Microsoft IKE Double Free RCE Exploit

Wed, 19 Aug 2026 00:43:34 GMT

CISA confirms active exploitation of CVE-2026-33824 in Microsoft Internet Key Exchange (IKE) Service Extensions, enabling remote code execution.

CVE-2026-12569: Clop Exploits Windchill with Custom Web Shell

Wed, 19 Aug 2026 00:40:12 GMT

Clop ransomware group exploited CVE-2026-12569 in PTC Windchill and FlexPLM servers, deploying a custom web shell for deep data theft. Patch immediately.

CVE-2025-62593: Ray-Project Ray RCE Exploited In Wild

Mon, 17 Aug 2026 16:20:50 GMT

CISA confirms active exploitation of CVE-2025-62593, a critical code injection vulnerability in Ray-Project Ray allowing remote code execution. Developers are targeted.

Apple Screen Sharing Exploits: Secure Your macOS Systems Now

Mon, 17 Aug 2026 16:20:27 GMT

Critical vulnerabilities in Apple Screen Sharing are actively exploited, allowing system compromise. Learn how to secure macOS against these threats.

Clop Ransomware Exploits CVE-2026-12569 in PTC Products

Sun, 16 Aug 2026 08:18:07 GMT

Shell investigates potential data theft by Clop gang after exploitation of critical CVE-2026-12569 in PTC Windchill and FlexPLM instances.

TeamPCP Supply Chain Attack: Trivy Compromise Impacts 2,500 Orgs

Sat, 15 Aug 2026 00:42:24 GMT

A supply chain attack attributed to TeamPCP compromised over 2,500 organizations, primarily through Aqua Security's Trivy scanner, not LiteLLM.

CVE-2026-71362: Adobe Commerce Account Takeover — Patch Now

Fri, 14 Aug 2026 01:07:52 GMT

Hackers are immediately exploiting CVE-2026-71362, a critical authorization flaw in Adobe Commerce, to take over customer accounts. Patch urgently.

CVE-2026-59310: vCenter RCE Exploited for Reverse SSH Access

Thu, 13 Aug 2026 16:45:32 GMT

A critical RCE flaw, CVE-2026-59310, in VMware vCenter Syslog Server is under active exploitation, enabling reverse SSH for persistence.

CVE-2026-55040: Critical SharePoint Auth Bypass Exploited After PoC

Thu, 13 Aug 2026 09:02:53 GMT

Attackers exploit CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint, leading to data disclosure and modification.

Malicious LiteLLM PyPI Releases Steal Cloud Credentials via TeamPCP

Wed, 12 Aug 2026 09:02:31 GMT

Malicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.

CVE-2026-72898: Metabase SQL Injection Active Exploitation

Wed, 12 Aug 2026 01:08:08 GMT

CISA adds Metabase CVE-2026-72898 SQL injection to its KEV catalog, enabling unauthenticated remote attackers to gain admin access.

Microsoft August 2026 Patch Tuesday: 398 Flaws and Zero-Day

Wed, 12 Aug 2026 01:05:21 GMT

Microsoft patches 398 flaws in August 2026, including an actively exploited Windows kernel driver zero-day and four critical RCE vulnerabilities.

CVE-2026-63077: JetBrains TeamCity RCE via Deserialization

Tue, 11 Aug 2026 16:54:33 GMT

CISA adds CVE-2026-63077 to KEV, indicating active exploitation of a JetBrains TeamCity deserialization RCE vulnerability.

SonicWall SMA1000 Exploited: Ransomware Targets CVE-2026-15409/15410

Mon, 10 Aug 2026 16:44:58 GMT

CISA confirms ransomware exploitation of SonicWall SMA1000 flaws CVE-2026-15409 and CVE-2026-15410, urging immediate patching.

CVE-2025-66376: APT28 Exploits Zimbra Zero-Click for Espionage

Sat, 08 Aug 2026 08:33:35 GMT

Russian state-sponsored actors exploit a zero-click Zimbra vulnerability (CVE-2025-66376) to exfiltrate sensitive webmail data from targeted organizations.

Metabase Zero-Day Exploited: Unauthenticated Admin Access

Sat, 08 Aug 2026 08:28:26 GMT

Metabase zero-day vulnerability (CVSS 10.0) actively exploited, allowing unauthenticated remote attackers to gain admin access and steal data.

CVE-2026-8037: Progress LoadMaster Command Injection RCE

Sat, 08 Aug 2026 01:04:01 GMT

Progress LoadMaster command injection (CVE-2026-8037) allows unauthenticated attackers to execute arbitrary commands. Active exploitation confirmed by CISA.

Metabase SQLi Zero-Day Exploited: Data Theft Attacks Confirmed

Sat, 08 Aug 2026 00:54:50 GMT

A critical Metabase SQL injection zero-day vulnerability (versions 1.58+) has been exploited in data theft attacks affecting customers like Framework and Tally.

CISA Warns: Actively Exploited Langflow, N-central, and Tomcat Vulnerabilities

Wed, 05 Aug 2026 10:27:25 GMT

CISA warns federal agencies and organizations about active exploitation of critical vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat.

CVE-2026-18556: N-able N-central Authentication Bypass Actively Exploited

Tue, 04 Aug 2026 17:33:39 GMT

CISA added CVE-2026-18556 to its KEV catalog, confirming active exploitation of an N-able N-central authentication bypass vulnerability.

CVE-2026-50522: SharePoint RCE via Deserialization — Patch Now

Sun, 02 Aug 2026 16:49:14 GMT

CISA confirmed active exploitation of CVE-2026-50522 in Microsoft SharePoint. Attackers leverage a deserialization vulnerability to execute code remotely. Patch…

CVE-2026-60137: WordPress Core SQL Injection to RCE — Patch Now

Sun, 02 Aug 2026 02:55:48 GMT

CISA warns of active exploitation for CVE-2026-60137, a WordPress Core SQL Injection vulnerability chaining to RCE for unauthenticated attackers.

CVE-2026-16232: Check Point SmartConsole Admin Bypass via Auth Flaw

Sun, 02 Aug 2026 02:54:04 GMT

CISA warns of active exploitation for CVE-2026-16232, an improper authentication vulnerability in Check Point SmartConsole allowing unauthenticated admin access…

Coldcard Firmware Flaw Enables $70M Bitcoin Theft

Sat, 01 Aug 2026 20:54:22 GMT

A critical firmware flaw in Coldcard hardware wallets, specifically a March 2021 integration error affecting seed generation, led to over $70 million in Bitcoin theft.

CVE-2026-20316: Cisco Secure FMC Hard-coded Password Vulnerability

Fri, 31 Jul 2026 10:42:09 GMT

CISA confirms active exploitation of CVE-2026-20316, a hard-coded password vulnerability in Cisco Secure Firewall Management Center.