5 casos · pág. 1/1
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-14 based on evidence of active exploitation: CVE-2026-76461, a SQL injection vulnerability in Cisco Secure Email Gateway. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the f…
Cisco published a security hardening release for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager (September 2026), fixing multiple vulnerabilities found during an internal security review. Cisco states that two of them are known to be actively exploited. They are described in separate advisories as a SQL injection and an…
Researchers describe WP2Shell, a chain of two WordPress core flaws, CVE-2026-63030 and CVE-2026-60137, that lets unauthenticated attackers progress from public REST API endpoints to remote code execution. It affects default installations with no third-party plugin required. Public exploit code exists and exploitation attempts have been ob…
CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…
Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …
