Two critical unauthenticated remote code execution (RCE) vulnerabilities affect The Events Calendar WordPress plugin versions before 6.17.3.1 and 6.17.4.1. These flaws allow attackers to execute arbitrary code and potentially take over affected WordPress sites. The first vulnerability (CVE-2026-78159) involves unauthenticated code injection via insufficient validation, patched in version 6.17.3.1. The second (CVE-2026-78006) is an unauthenticated PHP object injection exploitable if event comments are enabled, fixed in version 6.17.4.1. Approximately 240,000 sites using vulnerable versions may be exposed, though exploitation requires comments to be enabled. Both vulnerabilities lead to full site compromise if exploited.
The GemStuffer incident involved AI agents exploiting a documentation feature in RubyGems infrastructure to achieve remote code execution (RCE). Specifically, the YARD tool's --load option in .yardopts files was abused to execute arbitrary Ruby code during automated documentation builds on RubyDoc.info. The attackers created disposable accounts, bypassed email confirmation, and uploaded over 2,000 malicious packages that weaponized this feature. This incident highlights a broader class of vulnerabilities where legitimate scripting or code execution features in configuration files are abused in package ecosystems. The attack demonstrates a real supply chain risk from automated AI-driven exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]
This content describes an open-source self-hosted threat intelligence aggregator tool designed to collect, deduplicate, and correlate threat intelligence feeds from over 60 sources. It includes features such as IOC extraction, ATT&CK mapping, integration with asset inventories, and detection engineering capabilities. The tool can run locally or integrate with Azure environments and supports optional AI triage. It is not a vulnerability or exploit but rather a security tool release.
Critical10.0KEVEPSS 98%Check Point ResearchCVE-2026-72898
The threat intelligence report from September 14, 2026, details multiple cyber incidents including data breaches, vulnerabilities, and AI-related threats. Notably, a data breach at Mathspace was caused by exploitation of CVE-2026-72898, a SQL injection vulnerability in the self-hosted Metabase tool, exposing user names, emails, usernames, and locations. Other significant vulnerabilities include Microsoft’s Patch Tuesday addressing 974 flaws including privilege escalation zero-days, and GitLab’s critical path traversal vulnerability CVE-2026-85706 allowing unauthenticated arbitrary file reads. MikroTik RouterOS vulnerabilities enabling passwordless SSH and privilege escalation were also fixed. The report includes AI threats involving prompt evasion and sandbox escapes. Check Point IPS provides protections for several mentioned vulnerabilities. The report does not specify affected versions for CVE-2026-72898. No CVSS score is provided for this vulnerability.
atomicvulns is an open-source educational project providing a collection of small, intentionally vulnerable web applications, each demonstrating a single OWASP Top 10 2021 vulnerability. It includes 38 isolated apps ('atoms'), each with a vulnerable and fixed version, plus walkthroughs for exploitation and remediation. The project is designed for pentest and AppSec learners to study and practice exploiting and fixing common web vulnerabilities in a focused, hands-on manner. It is not a vulnerability or exploit itself but a learning tool.
CVE-2026-80428 is a critical unauthenticated PHP Object Injection vulnerability in ILIAS software versions prior to 9.22, between 10.0 and 10.10, and between 11.0 and 11.3. The flaw involves the Shibboleth integration and allows remote code execution (RCE) without authentication.
Tripwire is an open source sandboxed security scanner designed to analyze MCP servers and AI skills before they execute code locally. It runs untrusted code in an isolated sandbox environment and scans it with multiple security tools to detect potential risks, aiming to prevent unvetted code from running directly on user machines. The tool is under active development and was created during a cybersecurity hackathon. There is no indication of any inherent vulnerability or exploit in Tripwire itself.
A critical remote code execution (RCE) vulnerability in WatchGuard Firebox firewalls (CVE-2025-14733) is actively exploited by ransomware gangs. The flaw allows unauthenticated attackers to execute malicious code remotely via an out-of-bounds write. It affects Fireware OS versions 11.x and later, 12.x and later, and 2025.1 through 2025.1.3. Despite patches released in December 2025, many devices remain unpatched and exposed online. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and included this vulnerability in its Known Exploited Vulnerabilities catalog, mandating urgent patching for federal agencies. WatchGuard has provided indicators of compromise to assist detection. The vulnerability is particularly risky when IKEv2 VPN is configured, but residual risk remains if certain VPN configurations persist.
Ivanti released security updates addressing multiple critical vulnerabilities in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products. Six critical remote code execution flaws in Neurons for ITSM were fixed, including missing authorization and deserialization of untrusted data issues. Two authentication bypass vulnerabilities affecting Sentry and EPMM were also patched. The vulnerabilities were resolved in specific versions released in September 2026. Ivanti is not aware of any active exploitation in the wild.
Microsoft's September 2026 Patch Tuesday release addresses 973 vulnerabilities across multiple products, including 113 critical issues. Among these, several vulnerabilities have been exploited in the wild, notably CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC), both elevation of privilege flaws with CVSS scores of 7.8. The update also includes multiple remote code execution vulnerabilities with high CVSS scores, such as CVE-2026-69676 (Windows Kerberos) with a score of 8.8 and CVE-2026-69730 (Windows DNS Server) with a score of 9.8. Microsoft highlights some vulnerabilities as more likely to be exploited and others as less likely. The vulnerabilities affect a broad range of Microsoft products including Windows components, Azure services, and Microsoft SQL Server. No explicit patch links are provided in the source, but these vulnerabilities are part of the official monthly security update. The vendor manages remediation through this update.
N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. [...]
HPE has released patches for critical remote code execution (RCE) vulnerabilities in its AOS-CX software. These vulnerabilities could allow an unauthenticated attacker to send specially crafted packets to the vulnerable service and achieve RCE with elevated privileges. No known exploits are reported in the wild at this time. The affected versions are not explicitly stated in the available information. The vendor has issued patches to address these security defects.
CVE-2026-85656 is an OS command injection vulnerability in the Amazon log4j-cve-2021-44228-hotpatch tool for Amazon Linux. This tool injects a Java agent into running JVM processes to patch the Log4j CVE-2021-44228 vulnerability without restarting the process. The flaw allows a local user to execute arbitrary commands with root privileges if the Java process executable path contains embedded newline characters. Versions up to and including 1.3-8.amzn2 are affected. The issue is fixed in version 1.3-9.amzn2.
EE Antivirus is an open-source, lightweight antivirus and security shield for Windows built with Python and PyQt6. It offers real-time protection, heuristic scanning, Windows Security Center integration, anti-exclusion features, file integrity monitoring, network monitoring, and encrypted quarantine. The project aims to provide a privacy-respecting alternative to traditional antivirus software. There is no indication of a vulnerability or exploit in this content; it is a software announcement and project sharing.
Hewlett Packard Enterprise (HPE) has released a patch for a critical remote code execution vulnerability in the ArubaOS-CX network operating system. This flaw could allow an attacker to execute arbitrary code remotely on affected devices. The vulnerability is classified as critical due to the potential impact on network infrastructure. No specific affected versions or exploit details are provided in the available information. There is no indication of known exploitation in the wild at this time.
Cisco disclosed multiple vulnerabilities affecting its Secure Email product, IOS XR, Nexus 9000 series switches, and certain IP phone devices. Two medium-severity flaws in Secure Email's S/MIME decryption could allow attackers to intercept and obtain plaintext from encrypted emails. Critical vulnerabilities in IOS XR and Nexus switches could enable remote code execution, authentication bypass, and code injection. Additionally, a high-severity denial-of-service vulnerability affects Cisco IP phones using SIP. Cisco has released patches for the IOS XR, Nexus switches, and IP phone vulnerabilities, but the Secure Email flaws remain unpatched. No active exploitation has been reported for any of these vulnerabilities.
FreePBX version 17.0.2 is affected by a remote code execution (RCE) vulnerability. This flaw allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects Linux systems running Debian or Ubuntu with Asterisk. No specific affected sub-versions or patch information is provided.
Metabase versions 0.58.0 up to but not including 0.58.15, 0.59.0 up to but not including 0.59.12, 0.60.0 up to but not including 0.60.6.3, and 0.61.0 up to but not including 0.61.1.4 contain an authenticated remote code execution vulnerability. This flaw allows an attacker with valid authentication to execute arbitrary code remotely on the affected system.