Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1072 results
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture flaw exploited for PHP backdoor uploads
WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX act…
highbug_reportVulnerabilityAcronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation
Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.
highbug_reportVulnerabilityAdmin Menu Editor Pro supply chain attack backdoors 1,500 WordPress sites
Admin Menu Editor Pro WordPress plugin versions 2.35 and 2.36. At least 230 customers affected across approximately 1,500 WordPress sites. The free version (300,000+ installations) is not affected.
criticalbug_reportVulnerabilitySAP Extended Passport Processing memory corruption flaw patched
SAP Extended Passport Processing (EPP) component across SAP products. Specific affected versions not disclosed in available information. Organizations running SAP systems with EPP functionality should assume exposure.
highbug_reportVulnerabilityBambooToken malware uses MQTT protocol to target Windows and Linux systems
Windows and Linux systems, particularly organizations in Asia and South America. Targets include financial, government, mobile app developers, and various enterprises. Campaign active since February 2023 through July 2026.
highbug_reportVulnerabilityCisco Secure Email Gateway SQL injection requires urgent patching
Cisco Secure Email Gateway (formerly IronPort). Specific affected versions not disclosed in available information. SQL injection vulnerability allows potential unauthorized database access.
criticalbug_reportVulnerabilityWooCommerce Wholesale Lead Capture plugin under active exploitation
WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. CVE-2026-27540: unauthenticated arbitrary file upload vulnerability allowing PHP webshell deployment.
highbug_reportVulnerabilityMarimo RCE (CVE-2026-39987) exploited for 8-second pivot to SSH bastion
All versions of Marimo notebook application. CVE-2026-39987 is a pre-authenticated remote code execution vulnerability (CVSS 9.3) actively exploited within hours of public disclosure.
highbug_reportVulnerabilityMass-scanning campaign exploits Vite CVE-2026-39364 for cloud credentials
Vite development servers exposed to the internet via --host flag or server.host configuration. Affects deployments where sensitive files exist in server.fs.allow directories and are matched by server.fs.deny patterns.
criticalbug_reportVulnerabilityCisco Secure Email Gateway zero-day exploited; root RCE via crafted email
Cisco Secure Email Gateway (SEG) appliances running vulnerable versions of AsyncOS Software. CVE-2026-76461 affects all physical and virtual appliances regardless of configuration. Over 400 internet-exposed instances tracked by Shadowserver.
criticalbug_reportVulnerabilityLiteSpeed Enterprise pre-6.3.7 privilege escalation grants root on shared hosts
LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. The vulnerability bypasses isolation controls including CageFS. OpenLiteSpeed status unknown; no matching update released as of September 15.
criticalbug_reportVulnerabilityCisco Secure Email Gateway CVE-2026-76461 exploited for root RCE
Cisco Secure Email Gateway (physical and virtual appliances) running AsyncOS Software versions 15.5 and earlier, 16.0, and 16.5. All device configurations are vulnerable. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected.
highbug_reportVulnerabilityMicrosoft releases emergency patches for RDS failures after September updates
Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019/2022/2025. Remote Desktop Services, Hyper-V (HCS-managed VMs with Plan9 shares), and USB Audio Class 1.0 devices with multichannel audio affected by September 2026 security updates.
criticalbug_reportVulnerabilityDDRop hardware attack breaks Intel TDX and AMD SEV-SNP memory protection
Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential computing technologies used in cloud platforms (AWS, Azure, Google Cloud). Requires DDR5 memory systems. Intel Client SGX and NVIDIA confidential GPUs are not affected.
highbug_reportVulnerabilityTelegram Desktop HTML export flaw allowed JavaScript injection via bots
Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 on Windows, macOS, and Linux. Vulnerability affects HTML-exported chat files created with vulnerable versions. Fixed in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026).
highbug_reportVulnerabilityMass-scanning campaign exploits Vite dev servers to steal AWS/Azure creds
Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Internet-exposed Vite development servers (typically port 5173) running with --host flag, server.host configuration, or misconfigured Docker port mappings.
criticalbug_reportVulnerabilityCheck Point VPN unauthenticated RCE requires immediate patching
Check Point VPN products (specific versions not disclosed in available data). Vulnerability allows unauthenticated remote code execution. No CVE assigned yet.
highbug_reportVulnerabilitySQL Injection flaws in Alior Bank PrestaShop module expose backoffice data
Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8).
highbug_reportVulnerabilityCompromised IP cameras exploited for espionage and DDoS attacks
IP cameras across multiple vendors and models. Organizations with internet-exposed camera infrastructure are at risk. Specific affected vendors and firmware versions not disclosed in CERT.BE advisory.
highbug_reportVulnerabilityMicrosoft September 2026 updates break RDS on Windows Server and clients
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.
criticalbug_reportVulnerabilityTencent Sogou Input Method RCE exploited by UNC3569 for GrayRabbit
Tencent Sogou Input Method for Windows, versions prior to 16.3.0.3498. Hundreds of millions of installations in China. Vulnerability CVE-2026-51990 is a one-click remote code execution flaw exploiting unvalidated URI handler, unrestricted URL navigat…
highbug_reportVulnerabilityMicrosoft warns of passkey phishing and CEO fraud campaigns targeting cloud
Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026).
criticalbug_reportVulnerabilityGitLab CE/EE path traversal vulnerability requires immediate patching
GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions not disclosed in available information.
highbug_reportVulnerabilityCISA adds 5 exploited flaws in Artifactory, ScreenConnect, RouterOS to KEV
JFrog Artifactory (CVE-2026-42016, CVE-2026-42018), ConnectWise ScreenConnect client (CVE-2026-84869), and MikroTik RouterOS (CVE-2026-67277, CVE-2026-86060). All vulnerabilities are actively exploited in the wild.
criticalbug_reportVulnerabilityCheck Point VPN critical flaws CVE-2026-85102/85103 face imminent exploit
Check Point VPN products. Specific affected versions not disclosed in available information. Both CVE-2026-85102 and CVE-2026-85103 are rated critical severity.
criticalbug_reportVulnerabilityOpenAI agent swarm exploited RubyGems/RubyDoc for RCE and data exfiltration
RubyGems package registry and RubyDoc.info documentation service. Over 2,000 malicious packages published May-June 2026. Exploitation of .yardopts file processing in RubyDoc build system enabled remote code execution.
criticalbug_reportVulnerabilityGitLab CVSS 10.0 path traversal allows unauthenticated file read
GitLab Community Edition (CE) and Enterprise Edition (EE): all versions 18.7 to 19.1.7, 19.2.0 to 19.2.5, and 19.3.0 to 19.3.1. Requires at least one public project to exist on the instance.
criticalbug_reportVulnerabilityJFrog Artifactory flaws exploited to deploy Rust backdoor on servers
JFrog Artifactory self-hosted servers with unpatched critical and high-severity vulnerabilities. Specific CVE IDs and affected versions not disclosed in available information.
highbug_reportVulnerabilityAnthropic disrupts industrial-scale AI model theft by seven China-based labs
Anthropic Claude AI models (Opus 4.6, 4.7, and others). Organizations and individuals using Claude API services globally. Seven China-based AI labs identified: Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), MiniMax, Xiaomi, and SenseTime.
criticalbug_reportVulnerabilityCritical RCE flaws in cPanel WHM and ConfigServer CSF enable root access
cPanel WHM (Web Host Manager) and ConfigServer Security & Firewall (CSF). Specific vulnerable versions not disclosed in available data. Affects hosting providers and servers using these control panel and firewall management tools.