Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1104 results
criticalbug_reportVulnerability8,300+ Gitea servers unpatched against exploited RCE flaw CVE-2026-60004
Gitea versions prior to 1.27.1. Over 8,300 Internet-exposed instances remain vulnerable. Affects self-hosted Gitea installations with default open registration enabled.
criticalbug_reportVulnerabilityUnitree G1 EDU robot vulnerable to dual root RCE via network and BLE
Unitree G1 EDU humanoid robot. Firmware versions not definitively confirmed; researcher tested V1.5.2. G1 (non-EDU) and other Unitree robot models have unconfirmed applicability. Both vulnerabilities grant root access on the Locomotion PC.
criticalbug_reportVulnerabilityServiceNow AI Platform: Three CVSS 10.0 flaws enable unauthenticated RCE
ServiceNow AI Platform versions: Xanadu (before Patch 11 HF 7a), Yokohama (before Patch 12 HF 3b / Patch 13 HF 4), Zurich (before Patch 7b HF 3 through Patch 12 depending on branch), Australia (before Patch 2 HF 3 through Patch 5).
criticalbug_reportVulnerabilityZBT routers ship with factory implants granting root access via network
ZBT (Shenzhen Zhibotong Electronics) routers and white-labeled variants. CVE-2026-74233 (DARKLANTERN) affects 16+ models including WE1326, WE826-T2, WE5926, WG3526 on firmware builds from 2019-2020.
criticalbug_reportVulnerabilityServiceNow AI Platform: 3 critical unauthenticated flaws patched
ServiceNow AI Platform (formerly Now Platform): Xanadu Patch 11, Yokohama Patch 12-13, Zurich Patch 7-12, Australia Patch 2-5. Affects cloud (auto-patched) and self-hosted instances.
criticalbug_reportVulnerabilityPaperCut NG/MF zero-day exploited in wild; all versions affected
All versions of PaperCut NG and PaperCut MF print management software. Primary risk: Internet-exposed Application Servers with public-facing web interfaces.
criticalbug_reportVulnerabilityNext.js critical RCE flaws in AVIF processing and Windows path traversal
Next.js versions 13.4–15.5.23 and 16.0–16.3.2. CVE-2026-75604 (Windows path traversal, CVSS 9.0) affects Windows-hosted servers using Pages Router or App Router without Cache Components.
highbug_reportVulnerabilityWeekly roundup: 296K IoT botnet, water system attacks, SharePoint RCE
Multiple products and sectors: 296,000 IoT devices compromised by Dysphoria botnet; 100+ water systems targeted (details not provided in excerpt); SharePoint RCE vulnerability chain (CVE/version unspecified); Android banking apps targeted by Octagon…
criticalbug_reportVulnerabilityApache Log4j2 deserialization filter bypass enables remote code execution
Apache Log4j2 logging library. Specific affected versions not disclosed in available information. Impacts Java applications using Log4j2 with deserialization features enabled.
criticalbug_reportVulnerabilityVeeam ONE authentication bypass requires immediate patching
Veeam ONE backup management platform. Specific affected versions not disclosed in available information. Authentication bypass vulnerability allows unauthorized access.
highbug_reportVulnerabilityAmazon Kiro IDE prompt injection enables data exfiltration via Powers
Amazon Kiro IDE version 0.7.45 on Windows. Vulnerability fixed in version 0.8.140. Latest version is 1.0.337. Affects both trusted and untrusted workspaces when malicious workspace files are opened.
highbug_reportVulnerabilityAustralia arrests two TeamPCP members behind global supply chain attacks
Over 1,000 organizations worldwide affected by supply chain attacks targeting open-source software and developer platforms. Confirmed victims include Trivy, LiteLLM, Telnyx, SAP, TanStack packages, European Commission, Mistral AI, OpenAI, and GitHub.…
highbug_reportVulnerabilityNCSC warns of increased targeting of internet-exposed OT systems globally
Organizations with operational technology (OT) systems exposed to the internet across multiple sectors globally, including UK critical national infrastructure and non-CNI sectors.
criticalbug_reportVulnerabilityTeamPCP supply chain attack compromised Trivy, KICS, LiteLLM; 1000+ orgs hit
Open-source tools: Trivy scanner, Checkmarx KICS, LiteLLM AI gateway. Attack spanned GitHub Actions, Docker Hub, npm, PyPI, OpenVSX ecosystems. Over 1,000 organizations potentially compromised, 500,000+ credentials stolen, 300GB+ data exfiltrated.
highbug_reportVulnerabilityAustralian police arrest two TeamPCP members behind supply chain attacks
Global software supply chain: hundreds of open-source packages on GitHub, NPM, and other repositories compromised since late 2023. Victims include 2,500+ organizations using LiteLLM AI gateway, 3,800+ GitHub repositories, and developers across major…
highbug_reportVulnerabilitySpark RAT campaign targets Cambodia via OPSWAT driver exploit
Organizations and individuals in Cambodia. Campaign abuses vulnerable OPSWAT AppRemover driver (ardrv.sys, CVE-2026-36425) via BYOVD technique. Targets systems running Microsoft Defender, Huorong Internet Security, Tencent PC Manager, and Qihoo 360.
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE by Aug 29
Citrix NetScaler ADC and NetScaler Gateway appliances with Gateway VPN or AAA virtual server configurations. CVE-2026-8452 (high severity). Over 22,000 NetScaler ADC and 1,800 Gateway instances exposed online globally.
highbug_reportVulnerabilityGPUThor Rowhammer defeats ECC on NVIDIA RTX A6000, enables root escalation
NVIDIA Ampere workstation GPUs with GDDR6 memory: RTX A6000 (48GB), RTX A5000 (24GB), RTX A4500 (20GB), RTX A4000 (16GB). Attack requires unprivileged CUDA kernel execution. Other NVIDIA GPUs tested (A10, L4, L40, RTX 4090, A30) showed no bit flips.
criticalbug_reportVulnerabilityWatchGuard Agent RCE flaws require immediate patching
WatchGuard Agent (specific versions not disclosed in available data). Remote code execution vulnerabilities affecting WatchGuard Agent software used for endpoint management and authentication.
criticalbug_reportVulnerabilityAvada WordPress theme RCE chain affects sites with theme + plugin active
Avada WordPress theme versions up to 7.16 and Fusion Builder plugin versions up to 3.16. Exploitation requires both components to be active simultaneously.
highbug_reportVulnerabilityGPUThor Rowhammer attack bypasses NVIDIA GPU ECC for DoS and root access
NVIDIA Ampere-class workstation GPUs with GDDR6 memory: RTX A4000, RTX A4500, RTX A5000, RTX A6000. Server-class A100 GPUs vulnerable to privilege escalation.
highbug_reportVulnerabilityCoordinated attacks target AI infrastructure for credential theft and cryptomining
AI infrastructure platforms: LiteLLM gateways (CVE-2026-42271, CVE-2026-48710), RAGFlow deployments, and Kestra workflow environments. All exposed instances with administrative surfaces reachable from the internet are at risk.
highbug_reportVulnerabilityMicrosoft SharePoint RCE chain (CVE-2026-55040 + CVE-2026-63520) exploited
Microsoft SharePoint Server (on-premises). CVE-2026-55040: JWT authentication bypass. CVE-2026-63520: Business Connectivity Services RCE. Over 8,700 SharePoint servers exposed online. Specific vulnerable versions not disclosed in article.
criticalbug_reportVulnerabilityUbiquiti patches three max-severity RCE flaws in UniFi products
Ubiquiti UniFi Protect Application (fixed in 7.2.105+), UniFi Talk Application (fixed in 5.3.2+), and UniFi OS Server (5.1.21 and earlier). Over 100,000 UniFi OS instances exposed online.
criticalbug_reportVulnerabilityUnpatched Kaltura mwEmbed flaws enable file read and RCE via deserialization
Kaltura mwEmbed (html5lib) v2.45, v2.103, and all earlier v2.x releases exposing mwEmbedLoader.php. Affects customer installations and Kaltura's shared multi-tenant CDN infrastructure.
criticalbug_reportVulnerabilityGitea CVE-2026-60004 RCE exploited in wild; CISA orders 3-day patch
Gitea self-hosted Git service versions prior to 1.27.1. Approximately 5,000 instances exposed online. Default configurations with self-registration enabled are exploitable by unauthenticated attackers.
highbug_reportVulnerabilityAttackers abuse npm mirrors as free hosting for Cloudflare phishing pages
npm registry and public mirrors (UNPKG, npmmirror). Organizations using these mirrors to serve package content. At least 24 malicious packages identified hosting fake Cloudflare CAPTCHA pages.
highbug_reportVulnerabilityBEC fraud campaign surges against Austrian orgs via impersonation
Austrian organizations across all sectors; targets finance, accounting, and HR departments. Attack vectors include email impersonation, compromised supplier accounts, and hijacked email threads. No specific product vulnerabilities exploited.
highbug_reportVulnerabilityDDoS campaign disrupts Norway's shared government digital infrastructure
Norway's Digitaliseringsdirektoratet (Digdir) shared government infrastructure, including ID-porten (public login), eSignering (electronic signatures), secure digital mail, government forms, and data exchange services.
criticalbug_reportVulnerabilityOAuth2 Proxy authentication bypass allows unauthorized access
OAuth2 Proxy (specific versions not disclosed in available data). All deployments using OAuth2 Proxy for authentication are potentially at risk.