Tag: exploit
-
Critical WatchGuard Agent Flaws Let Unauthenticated Attackers Execute Remote Code
WatchGuard has revealed two critical vulnerabilities in its Windows WatchGuard Agent, which could allow unauthenticated attackers to execute arbitrary code on affected endpoints. These vulnerabilities, tracked as CVE-2026-57910 and CVE-2026-57909, have CVSS v4.0 scores of 9.3 and 9.4, respectively. Both issues impact WatchGuard Agent versions earlier than 1.25.13.0000. If exploited, these vulnerabilities could give an…
-
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers have begun exploiting CVE-2026-60004, a critical code injection vulnerability in the Gitea Git platform, CISA confirmed on Tuesday by adding the vulnerability to its … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/
-
Hackers now exploit critical Gitea flaw in code injection attacks
Tags: attack, cybersecurity, exploit, flaw, hacker, infrastructure, injection, service, vulnerabilityAttackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks/
-
Sicherheitslücke: Schadcode-Attacken auf Gitea-Server gefährden Softwareprojekte
Eine kritische Sicherheitslücke ermöglicht Schadcode-Attacken auf Gitea-Instanzen. Angreifer nutzen das bereits. Admins sollten zügig patchen. First seen on golem.de Jump to article: www.golem.de/news/viele-softwareprojekte-gefaehrdet-hacker-schleusen-schadcode-auf-gitea-instanzen-2608-212317.html
-
Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests
Tags: exploitAikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs.The original incident was first reported by ABC News on August 10, based on chat logs and screenshots the user…
-
Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests
Tags: exploitAikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs.The original incident was first reported by ABC News on August 10, based on chat logs and screenshots the user…
-
Viele Softwareprojekte gefährdet: Hacker schleusen Schadcode auf Gitea-Instanzen
Eine kritische Sicherheitslücke ermöglicht Schadcode-Attacken auf Gitea-Instanzen. Angreifer nutzen das bereits. Admins sollten zügig patchen. First seen on golem.de Jump to article: www.golem.de/news/viele-softwareprojekte-gefaehrdet-hacker-schleusen-schadcode-auf-gitea-instanzen-2608-212317.html
-
U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog
Tags: cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, open-source, oracle, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gitea flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-60004 (CVSS score of 9,8), to its Known Exploited Vulnerabilities (KEV) catalog. Gitea is an open-source platform for…
-
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
Tags: access, attack, cve, cybersecurity, exploit, flaw, infrastructure, rce, remote-code-execution, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea.The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as…
-
Zimbra Exploitation Spreads as Thousands Stay Unpatched
More Than 8,000 Unpatched Instances Remain Exposed to CVE-2026-73570. Attackers have compromised at least 267 Zimbra installations through a likely CVE-2026-73570 campaign, while more than 8,000 unpatched servers remain exposed to unauthenticated remote code execution that can give attackers access to mail data and system resources. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/zimbra-exploitation-spreads-as-thousands-stay-unpatched-a-32654
-
Banks Face the Penalty But Scammers Exploit the Gaps
Australian Scam Rules Impose Tough Penalties But Leave Critical Players Unregulated Australia’s new Scams Prevention Framework promises shared responsibility for scam prevention. But gaps in coverage could leave banks exposed and victims asking who ultimately reimburses the for their fraud losses. The rules take effect in March 2027. First seen on govinfosecurity.com Jump to article:…
-
Car Infotainment Malware Builds Criminal Proxy Botnet
DoFun Software Updates Exploited to Infect Android Head Units. Attackers are exploiting legitimate software updates to infect Android-based car infotainment systems, or head units, turning them into reverse proxies. Kaspersky linked the malware campaign to the MoYu Group, a threat actor linked to BADBOX and BADBOX 2.0. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/car-infotainment-malware-builds-criminal-proxy-botnet-a-32652
-
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw
Attackers can exploit a security bug in NVIDIA’s tool to gain unauthenticated access to the local model server through the Ollama API, paving the way for persistent AI agent corruption. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw
-
Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw
Attackers can exploit a security bug in NVIDIA’s tool to gain unauthenticated access to the local model server through the Ollama API, paving the way for persistent AI agent corruption. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw
-
Actively Exploited Oracle WebLogic Bug Gets Patch Order
Federal Agencies Must Apply Oracle’s January Patch by Aug. 27. CISA ordered federal agencies to patch CVE-2026-21962 by Aug. 27 after confirming active exploitation of the maximum-severity Oracle middleware flaw, which lets unauthenticated attackers use crafted HTTP requests to access or modify critical data. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/actively-exploited-oracle-weblogic-bug-gets-patch-order-a-32650
-
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Two CVSS 9.8 miniOrange SAML WordPress plugin auth bypasses were exploited while paid editions never appeared in any vulnerability database. Manual patch required. Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, both rated CVSS 9.8, are under active exploitation. Both CVE-2026-61979 and CVE-2026-15981 allow an unauthenticated attacker to…
-
Researchers warn about chained SharePoint sequence
An authentication bypass flaw is already under exploitation, the latest in a series of recent SharePoint attacks.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/researchers-warn-about-chained-sharepoint-sequence/828726/
-
CISA orders agencies to fix exploited Zimbra vulnerability
The collaboration software’s developer took almost a full month to patch the flaw after disclosing it. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-zimbra-flaw-patch-mandate-kev/828718/
-
Australia Warns of Active Exploitation of Critical TeamCity Server Flaw
Australian officials are urging TeamCity customers to patch an actively exploited critical flaw, which follows a similar warning from the US government First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/australia-exploitation-teamcity/
-
U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in flaw, tracked as CVE-2026-21962 (CVSS score of 10,0), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-21962 is a critical, unauthenticated vulnerability…
-
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.The vulnerabilities, as disclosed by Patchstack, are listed below – CVE-2026-61979 (CVSS score: 8.1) – An unauthenticated privilege escalation…
-
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
Tags: access, cve, cybersecurity, data, exploit, flaw, infrastructure, kev, network, oracle, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2026-21962 (CVSS score: 10.0), allows an unauthenticated attacker with network access via HTTP to First seen on…
-
Hackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive Data
Tags: access, cisa, cve, cyber, cybersecurity, data, exploit, flaw, hacker, infrastructure, kev, oracle, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Oracle HTTP Server to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2026-21962, affects both Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. CISA classified this issue as…
-
Hackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive Data
Tags: access, cisa, cve, cyber, cybersecurity, data, exploit, flaw, hacker, infrastructure, kev, oracle, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Oracle HTTP Server to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2026-21962, affects both Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. CISA classified this issue as…
-
Exploited Zimbra Flaw Highlights Shrinking Window to Patch
CISA has issued a three-day deadline for agencies to patch a Zimbra security vulnerability, CVE-2026-73570, which allows full takeover of a user’s communications. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/zimbra-flaw-exploitation-shrinking-window-patch
-
CISA Orders Civilian Agencies to Patch Exploited TrueConf Server Flaws
CISA ordered civilian agencies to patch two exploited TrueConf Server flaws used to compromise systems and distribute trojanized client installers. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/news-cisa-trueconf-server-flaws-patch-order/
-
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks/
-
Fake GTA 6 Extended Look and demo sites deliver an infostealer
Bogus “Play Now” sites are exploiting the GTA 6 leak hype to spread malware that steals passwords stored in browsers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/fake-gta-6-extended-look-and-demo-sites-deliver-an-infostealer/
-
âš¡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.Plenty to clean up. Here’s…
-
Cudy WR3000 Router Flaws Can Be Chained to Gain Root Access
Public exploit tools for 2 Cudy WR3000 flaws can forge JWTs, bypass MQTT authentication, and remotely execute operating-system commands as root on the router. First seen on hackread.com Jump to article: hackread.com/cudy-wr3000-router-flaws-chained-root-access/