/
data_types_exposed:configuration_data × criticity:critical × limpar

Resultados

2 casos · pág. 1/1

f5.com · exploit público critical

Drupal Core CVE-2026-9082 JSON:API pre-auth SQL injection actively exploited within days of disclosure

CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…

CVE-2026-9082
greynoise.io · critical

Chinese-speaking actor tied to Red Heron exploits WordPress wp2shell, ZyXEL GS1900 CVE-2026-7273 and Ubiquiti; steals 18,000+ government records

GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…

CVE-2026-7273 CVE-2026-34908 CVE-2026-34909 Red Heron government law enforcement