Zero-Day & Actively Exploited Vulnerabilities

A flaw in Zoom's screen annotation feature could have allowed any meeting participant to hijack the client of another attendee, including the presenter, without any user interaction. The vulnerability required no click, download, or visible prompt, making it a fully zero-click, in-meeting attack vector. This poses significant risk to organizations relying on Zoom for internal and external communications, including those coordinating distributed teams or automated workflows via meeting integrations.

Updated Aug 12, 2026

A critical Incorrect Authorization vulnerability in Adobe Campaign Classic (ACC) allows attackers to achieve arbitrary code execution in the context of the current user without any user interaction. With a CVSS score of 10.0 and a changed scope, successful exploitation could lead to full compromise of the marketing automation platform and downstream systems it integrates with.

Updated Aug 12, 2026 · CVSS 10

MaxKey SSO contains a hard-coded JWT signing secret that allows unauthenticated attackers to forge valid admin-level JWT tokens and bypass authentication entirely via the password-skipped login endpoint. This grants full access to SSO application configuration and downstream application secrets, effectively compromising every service federated through the affected MaxKey instance.

Updated Aug 12, 2026 · CVSS 9.8

Metabase, a widely used open-source business intelligence and analytics platform, contains an unauthenticated SQL injection vulnerability that can grant attackers full administrative access to the application. CISA has added this CVE to its Known Exploited Vulnerabilities catalog with a short remediation window, indicating active exploitation in the wild. Successful exploitation exposes connected database credentials and any data accessible through those connections.

Updated Aug 12, 2026

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that allows a locally authenticated attacker to escalate privileges to SYSTEM. It has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with federal agencies required to remediate by August 25, 2026.

Updated Aug 12, 2026

A critical unauthenticated vulnerability (CVE-2026-34265) affects SAP NetWeaver Application Server ABAP, stemming from logical errors in DIAG protocol parsing that lead to memory corruption. With a CVSS score of 9.8, attackers can remotely disclose sensitive information or crash affected systems without any authentication, posing severe risk to organizations running SAP ERP environments.

Updated Aug 11, 2026 · CVSS 9.8

A critical command injection vulnerability in Progress Kemp LoadMaster, tracked as CVE-2026-8037 (CVSS 9.6), has been added to CISA's Known Exploited Vulnerabilities catalog after 792 reported exploitation attempts in the wild. The flaw allows attackers to achieve arbitrary command execution on affected load balancer appliances, posing severe risk to organizations relying on this infrastructure for traffic management.

Updated Aug 10, 2026 · CVSS 9.6

N-able has released a second hotfix for its N-central Remote Monitoring and Management (RMM) platform after observing threat actors actively exploiting a recently disclosed vulnerability and evolving their attack techniques to persist on managed endpoints. The vendor is expanding protections beyond the initial patch, indicating attackers reaching into managed customer environments through the compromised RMM infrastructure.

Updated Aug 10, 2026

A critical command injection vulnerability exists in the accesscontrol function of MSI Radix AXE6600 router firmware v781521, allowing remote attackers to execute arbitrary commands with root privileges. Given the CVSS score of 9.8, exploitation likely requires no authentication and results in full device compromise, enabling attackers to intercept, redirect, or manipulate all network traffic passing through the device.

Updated Aug 10, 2026 · CVSS 9.8

A critical unauthenticated command injection vulnerability exists in the urlfilter function of MSI Radix AXE6600 router firmware v781521, allowing remote attackers to execute arbitrary commands with root privileges. Given the CVSS score of 9.8 and remote exploitability without authentication, this vulnerability poses severe risk to any network using affected devices, potentially enabling full network compromise, traffic interception, or pivot points for further attacks.

Updated Aug 10, 2026 · CVSS 9.8

Metabase has disclosed a maximum-severity (CVSS 10.0) zero-day vulnerability being actively exploited in the wild, allowing unauthenticated remote attackers to inject arbitrary SQL and gain administrative access to Metabase instances. No CVE identifier has been assigned yet, but exploitation has already been observed, making this an urgent patching priority for any organization running Metabase for business intelligence or analytics.

Updated Aug 9, 2026 · CVSS 10

A critical unauthenticated buffer overflow vulnerability affects D-Link DWR-M961 routers running hardware version C1 with a specific firmware build. Remote attackers can send crafted overly long strings to the test4, ssid2, and username fields of the quicksetup.cgi interface to achieve arbitrary command execution or crash the device. With a CVSS score of 9.8, this flaw poses a severe risk to any exposed device, enabling full device takeover, network pivoting, or denial of service.

Updated Aug 9, 2026 · CVSS 9.8

A critical buffer overflow vulnerability exists in D-Link DWR-M961 routers (hardware version C1, firmware 1.1.2_C1_202602110044) in the app.cgi web management interface. A remote, unauthenticated attacker can trigger the flaw by submitting an overly long string to the netAcc.addlist[].name field, enabling arbitrary command execution or causing a denial of service. Given the CVSS score of 9.8, this vulnerability poses a severe risk to any network relying on the affected device for connectivity or perimeter security.

Updated Aug 9, 2026 · CVSS 9.8

A critical unauthenticated command injection vulnerability affects D-Link DWR-M961 routers (hardware version C1, firmware 1.1.2_C1_202602110044). Remote attackers can execute arbitrary commands with root privileges via the netDig.ping.dst parameter in the app.cgi interface, enabling full device takeover. With a CVSS score of 9.8, this vulnerability poses severe risk to any network relying on affected devices for connectivity.

Updated Aug 9, 2026 · CVSS 9.8

A critical unauthenticated command injection vulnerability affects D-Link DWR-M961 routers running firmware prior to 1.1.5_C1_202607071108. Attackers can exploit the fota_url parameter in the LTE FOTA upgrade interface to execute arbitrary commands with root privileges, potentially leading to full device compromise. Given the CVSS score of 9.8 and remote exploitability, this poses a severe risk to any network relying on this device for connectivity.

Updated Aug 9, 2026 · CVSS 9.8

A critical, previously unknown SQL injection vulnerability in Metabase, a widely used open-source business intelligence and analytics platform, was exploited in zero-day attacks to breach customer instances and exfiltrate data. Confirmed victims include Framework and Tally, both of which have publicly disclosed the incidents. The flaw allows attackers to bypass authentication and query controls to access sensitive underlying database contents.

Updated Aug 8, 2026

CISA has added CVE-2026-8037, a command injection vulnerability in Progress LoadMaster, to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation in the wild. Federal civilian agencies are required under BOD 26-04 to remediate this vulnerability on a prioritized timeline due to its potential to grant attackers total control of affected assets.

Updated Aug 8, 2026

CVE-2026-8037 is an unauthenticated command injection vulnerability in Progress LoadMaster that allows attackers to execute arbitrary commands on the appliance via unsanitized input on multiple management endpoints. CISA has added this to its Known Exploited Vulnerabilities catalog with a short remediation window, indicating active exploitation in the wild. Organizations using LoadMaster for load balancing and application delivery, including in front of internal services, should treat this as an urgent patching priority.

Updated Aug 8, 2026

MIT CSAIL researchers demonstrated a new microarchitectural attack called Interrupt Injection that bypasses existing Spectre v2 mitigations on Intel and AMD CPUs by timing a hardware interrupt to re-poison the branch predictor immediately after the kernel sanitizes it. The attack was proven on an AMD Zen 2 system running Linux 6.14 with all default Spectre v2 defenses enabled, allowing an unprivileged local process to leak protected kernel or cross-process data via speculative execution.

Updated Aug 7, 2026

A newly disclosed Linux kernel vulnerability dubbed Zapscape (CVE-2026-64561) affects KVM/x86's shadow MMU and can allow an attacker with kernel-level privileges inside a nested L1 guest VM to escape isolation and execute code on the host. This poses significant risk to cloud and virtualization providers that expose nested virtualization to untrusted or semi-trusted tenants.

Updated Aug 7, 2026