The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]

CVE-2026-59310 is a critical directory traversal vulnerability in the VMware vCenter Syslog server that enables unauthenticated remote code execution. Patched by Broadcom on July 29, 2026, it has been actively exploited by advanced persistent threat actors and ransomware gangs to gain remote access and persistence via reverse SSH. CISA has included this vulnerability in its Known Exploited Vulnerabilities Catalog and ordered rapid remediation for government systems. Over 450 exposed VMware vCenter servers remain online, with unknown patch status. This vulnerability is one of several VMware flaws exploited in recent ransomware campaigns targeting virtual infrastructure.

Bleeping Computer

Detailed information about CISA: Critical VMware RCE flaw now exploited by ransomware gangs. Get real-time updates, technical details, and mitigation strategies

CISA: Critical VMware RCE flaw now exploited by ransomware gangs - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

CISA: Critical VMware RCE flaw now exploited by ransomware gangs

AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. [...]

The threat landscape is shifting as AI technologies accelerate the timeline from vulnerability disclosure to exploitation, reducing defenders' reaction time. The analysis emphasizes the importance of proactive security measures like exploitability validation to assess real risk, security control testing to verify defenses, and autonomous pentesting to identify weaknesses continuously. These approaches aim to close exposure gaps preemptively in a post-mythos era where traditional patch-waiting strategies are insufficient.

Detailed information about What Zero-Day Response Should Be in the Post-Mythos Era. Get real-time updates, technical details, and mitigation strategies.

What Zero-Day Response Should Be in the Post-Mythos Era - Live Threat Intelligence - Threat Radar | OffSeq.com

What Zero-Day Response Should Be in the Post-Mythos Era

A vulnerability in a2ui-project a2ui up to version 0.10.6 allows remote injection via manipulation of the primaryColor argument in the Angular Renderer component's z.any function. This issue affects the file renderers/web_core/src/v0_9/schema/server-to-client.ts and has a medium severity rating. A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is available to address this vulnerability.

The vulnerability exists in the a2ui-project a2ui software up to version 0.10.6, specifically in the Angular Renderer component within the z.any function of the file renderers/web_core/src/v0_9/schema/server-to-client.ts. Manipulating the argument primaryColor can lead to injection attacks remotely. The vulnerability is tracked as CVE-2026-92213 with a CVSS 3.1 score of 5.5 (medium severity). A patch identified by commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b is suggested to remediate the issue.

GCVE Database

Detailed information about A vulnerability was detected in a2ui-project a2ui up to 0.10.6. (CVE-2026-92213). Get real-time updates, technical details, and mitig

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. (CVE-2026-92213) - Live Threat Intelligence - Threat Radar | OffSeq.com

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. (CVE-2026-92213)

CVE-2026-92216 is an open redirect vulnerability in the a2ui-project a2ui component affecting versions up to 0.10.7. The issue exists in the openUrl function of the Binder component, allowing remote attackers to manipulate URLs and redirect users to unintended locations. The vulnerability has a medium severity rating with a CVSS score of 4.3. The project has been informed but has not yet responded or issued a fix.

The vulnerability CVE-2026-92216 affects the a2ui-project a2ui up to version 0.10.7. It is located in the openUrl function within the renderers/web_core/src/v0_9/rendering/generic-binder.ts file of the Binder component. The flaw allows an attacker to perform an open redirect by manipulating URL parameters, potentially redirecting users to malicious sites. The issue can be exploited remotely without privileges and requires user interaction. The project was notified early but has not provided a response or patch.

Detailed information about A vulnerability was found in a2ui-project a2ui up to 0.10.7. (CVE-2026-92216). Get real-time updates, technical details, and mitigati

A vulnerability was found in a2ui-project a2ui up to 0.10.7. (CVE-2026-92216) - Live Threat Intelligence - Threat Radar | OffSeq.com

A vulnerability was found in a2ui-project a2ui up to 0.10.7. (CVE-2026-92216)

EspoCRM versions through 10.0.8 use PHP's non-cryptographically secure rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs. This weak token generation allows remote unauthenticated attackers to guess tokens, potentially confirming opt-ins, accepting or declining event invitations on behalf of other contacts, and accessing event details. The vulnerability has a medium severity with a CVSS score of 4.8.

EspoCRM versions up to 10.0.8 generate tokens for lead-capture opt-in, event invitation, and campaign URLs using PHP's rand() function, which is not cryptographically secure. This results in roughly 31-bit tokens that can be guessed by remote unauthenticated attackers. Successful guessing enables attackers to confirm opt-ins, manipulate event invitations for other contacts, and access event details without authorization.

Detailed information about EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs ins

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a… (CVE-2026-92298) - Live Threat Intelligence - Threat Radar | OffSeq.com

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a… (CVE-2026-92298)

Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70495, which describes the same vulnerability. Please use CVE-2026-70495 instead.

Detailed information about Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70495, which describes the same vulnerability. (CVE-202

Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70495, which describes the same vulnerability. (CVE-2026-66789) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-66789 has been rejected

Official rejection reason

Replacement CVE