Threat Library

CVE-2026-60296 is a critical, easily exploitable vulnerability in Oracle Coherence (Oracle Fusion Middleware) that allows an unauthenticated attacker with network access to fully compromise the affected server over TCP. With a CVSS score of 9.8 and no authentication or user interaction required, this flaw poses severe risk to any organization running affected Coherence versions, including those used as caching/data grid layers behind enterprise and AI-driven applications.

A critical unauthenticated remote code execution vulnerability affects Oracle Application Testing Suite version 13.3.0.1, allowing attackers with mere network access to fully compromise the system without any credentials or user interaction. The flaw carries a maximum-impact CVSS score of 9.8, threatening confidentiality, integrity, and availability, and is trivially exploitable, making it a high-priority patching target.

CVE-2026-63764 is a critical unauthenticated SSRF vulnerability in lmdeploy's OpenAI-compatible API server, exploitable via the image_url parameter in chat completions requests. Attackers can chain HTTP redirects to bypass initial URL validation and reach internal services or cloud instance metadata endpoints, potentially exfiltrating cloud credentials. This directly threatens organizations self-hosting lmdeploy to serve multimodal LLMs behind agent or RAG pipelines.

CVE-2026-50522 is a deserialization of untrusted data vulnerability in Microsoft SharePoint that allows unauthorized attackers to achieve remote code execution over the network. CISA has added this CVE to its Known Exploited Vulnerabilities catalog with a compressed three-day remediation window, indicating active exploitation in the wild. Organizations running on-premises SharePoint should treat this as an urgent patching priority.

CVE-2026-16232 is an improper authentication vulnerability in Check Point SmartConsole that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. This flaw has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a remediation due date of 2026-07-25. Successful exploitation grants an attacker complete administrative control over the security management platform governing an organization's firewall and gateway policies.

Siemens SIDIS Secured SmartPlug versions before V7.26.0310 are affected by 13 vulnerabilities inherited from bundled third-party components including OpenSSL, OpenSSH, hostapd/wpa_supplicant, busybox, ICU, libarchive, and sudo. The most severe issue (CVE-2022-23303) carries a CVSS v3.1 score of 9.8 and could allow remote attackers to compromise message integrity and confidentiality without authentication. Siemens has released a fixed firmware version and recommends immediate update.

Tycon Systems TPDIN-Monitor-WEB2 2.3.9, a power distribution monitoring device used in critical manufacturing, contains a critical authentication bypass (CVE-2026-61884, CVSS 9.8) allowing unauthenticated remote attackers to gain full administrative access by submitting empty login credentials. A secondary flaw (CVE-2026-55985) exposes system credentials in cleartext to any authenticated user, enabling lateral movement to other network systems. The vendor has not responded to CISA's coordination attempts, so no patch is currently available.

CVE-2026-28306 is a privilege escalation vulnerability in SolarWinds Serv-U that allows a domain administrator to elevate privileges to system administrator level. The flaw carries a critical CVSS score of 9.1, though its impact is reduced in Windows-based deployments. Organizations running Serv-U for managed file transfer should prioritize patching given the severity of privilege escalation to full system control.

A critical insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows an authenticated domain account with admin privileges and home directory write access to achieve remote code execution as root. Impact is reduced on Windows deployments but severe on Linux/Unix hosts running Serv-U with elevated service permissions.

SolarWinds Serv-U contains an insecure direct object reference (IDOR) vulnerability that allows a group administrator to escalate privileges and achieve remote code execution as root, primarily on Linux/Unix deployments. Windows deployments are less impacted due to lower default privilege exposure. Given the high CVSS score of 9.1, exploitation could grant an attacker full control of the host system.

Grav CMS 2.0.4 contains a critical RCE vulnerability in its Blueprint::dynamicData() function, which passes attacker-controlled callable strings directly to call_user_func_array() without an allowlist. An authenticated user with page-write permissions can plant a malicious callable in page frontmatter that executes as the web-server user whenever any visitor loads the page, effectively converting low-privilege access into full server compromise.

The Grav api plugin prior to version 1.0.8 improperly authorizes API key generation and revocation actions, checking only for the baseline admin.login permission instead of proper account-management privileges. This flaw allows any authenticated low-privilege panel user to mint a persistent, valid API key bound to any other account, including administrators, resulting in impersonation and full account takeover.

DD-WRT firmware contains a stack-based buffer overflow in its UPnP handling that allows unauthenticated remote attackers to execute arbitrary code. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Organizations running DD-WRT on routers or edge devices should patch immediately given the short remediation window.

WordPress Core contains a SQL injection flaw triggered when plugins or themes pass untrusted input to an affected parameter, and this has been added to CISA's Known Exploited Vulnerabilities catalog indicating active exploitation. When chained with CVE-2026-63030, it enables unauthenticated remote code execution on default WordPress installations, posing a severe risk to any internet-facing WordPress site.

Threat actors exploited two previously undisclosed vulnerabilities in SonicWall SMA1000 series VPN appliances as zero-days for several weeks before public disclosure, deploying custom malware on compromised devices. The attacks targeted internet-facing remote access infrastructure, giving attackers a persistent foothold into victim networks.

AVideo before version 29.0 contains an incomplete patch for a previously disclosed command injection vulnerability, allowing attackers to execute arbitrary OS commands via the Live plugin's on_publish.php endpoint. Despite the use of escapeshellarg(), the execAsync() function re-wraps escaped commands in a double-quoted sh -c shell, enabling command substitution through $() and backticks. This flaw carries a critical CVSS score of 9.8 and requires no authentication for exploitation.

A critical unauthenticated remote code execution vulnerability exists in ktransformers, a popular LLM inference acceleration framework, affecting versions through 0.6.3. Attackers can send crafted pickle payloads to the SchedulerServer's ZMQ ROUTER socket, which is bound to all network interfaces by default, to achieve arbitrary command execution as the server process with no authentication required.

GPT-SoVITS, a popular open-source voice cloning/text-to-speech toolkit, contains a critical unauthenticated OS command injection vulnerability (CVSS 9.8) in its Gradio-based web UI. Attackers can execute arbitrary shell commands as the server process user by injecting shell metacharacters into ASR, slicing, denoising, or UVR5 path parameters, with no authentication required.

F5 disclosed and patched a critical heap buffer overflow in nginx worker processes that can be triggered remotely by an unauthenticated attacker via crafted HTTP requests. The flaw can crash worker processes, causing denial of service, and may allow remote code execution in some configurations. Organizations running affected nginx or NGINX Plus versions should upgrade immediately.

Public exploit code has been released for critical remote code execution vulnerabilities dubbed "wp2shell" affecting WordPress Core, significantly increasing the risk of widespread exploitation. Administrators are urged to patch immediately as attackers can now leverage readily available exploit tooling to compromise unpatched sites.