Vulnerabilities & Exploits
CVEs, zero-days, patching and exploited weaknesses.
NVIDIA NEMO CLAW Networking Vulnerability Enables Ollama API Access for AI Agent Corruption
Research on NVIDIA's NEMO CLAW vulnerability that allows attackers to exploit a flaw to gain unauthenticated access to local model servers through the Ollama API, paving the way for AI agent corruption.
CERT Polska Warns of Active Zimbra RCE Exploitation as Attackers Target CVE-2026-73570
Polish Computer Emergency Response Team CERT Polska has warned that threat actors are actively exploiting a critical remote code execution vulnerability (CVE-2026-73570) in Zimbra Collaboration Suite, affecting SNMP monitoring components with enabled notifications.
Qualys Joins List of Accellion FTA Victims After Zero-Day Exploitation
Cybersecurity firm Qualys discloses it was the latest victim of Accellion FTA server hack using a zero-day vulnerability, with Clop ransomware extorting the firm by leaking stolen files.
npm Mirror Networks Exploited as Free Hosting for Cloudflare CAPTCHA Phishing
Threat actors exploit npm and its mirror services to host malicious HTML pages that impersonate Cloudflare Turnstile CAPTCHAs, redirecting visitors to attacker-controlled domains. The npm registry serves as free, trusted storage for phishing pages that bypass security filters by leveraging legitimate infrastructure.
PaperCut issues second emergency patch for two chained exploits
PaperCut NG and MF print management software receives Emergency Patch Release 2 for two chained vulnerabilities allowing unauthenticated remote code execution, with CVE-2026-81578 (authentication bypass, CVSS 8.8) and CVE-2026-82078 (unsafe class-loading, CVSS 9.4).
CISA Sounds the Alarm on Actively Exploited Windows IKE Extension RCE Flaw
CISA has added CVE-2026-33824, a critical-severity remote code execution vulnerability in the Windows IKE Extension (MS-IKEE) component, to its catalog of actively exploited vulnerabilities. The flaw allows unauthorized attackers to execute code over a network by sending maliciously crafted packets to unpatched Windows systems via UDP ports 500 or 4500. CISA ordered FCEB agencies to patch within three days per Binding Operational Directive 26-04.
CISA Directs Federal Agencies to Patch Two Critical TrueConf Server Flaws
CISA has added two critical TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered U.S. Federal Civilian Executive Branch agencies to patch them within two weeks. The flaws are CVE-2026-72529 (missing authentication, remote script execution) and CVE-2026-72530 (code injection, sandbox escape for remote code execution). Kaspersky attributes exploitation to the Head Mare hacktivist group since at least July 2026.
Huntress exposes 155x password-spray surge leveraging MFA blind spots
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign targeting Microsoft's Azure CLI from an IPv6 range controlled by LSHIY LLC, with 81 million login attempts and 78 account compromises in a two-week window. The attacks exploited MFA gaps via the legacy ROPC OAuth grant and poorly scoped Conditional Access policies.
CISA Directs Federal Agencies to Remediate Actively Exploited Citrix NetScaler RCE Flaw
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities Katalog, ordering Federal Civilian Executive Branch agencies to patch Citrix NetScaler appliances by August 29, 2026 per BOD 26-04. The memory overflow flaw affects NetScaler ADC and Gateway appliances with Gateway VPN or AAA virtual servers.
GiveWP WordPress Plugin CVE-2026-82222: Unauthenticated Remote Code Execution Vulnerability
A maximum-severity vulnerability in the GiveWP WordPress donation plugin allows unauthenticated attackers to execute arbitrary server commands through a chain of three exploits involving unsafe deserialization, attacker-controlled serialized objects, and a gadget chain in bundled libraries. The flaw (CVE-2026-82222) affects versions through 4.16.7.1 and was fixed in 4.16.7.2.
Windows Named Pipes Security: Risks and Mitigations for Interprocess Communication
Article outlines how Windows named pipes provide fast IPC but have weak default access controls that can expose privileged services. Covers identity verification, authorization, impersonation, security descriptors, remote access risks, and defense-in-depth mitigation strategies.
Certighost CVE-2026-54121: How a Standard Domain User Can Turn an Enterprise CA into a Domain Controller
Certighost (CVE-2026-54121) allows a low-privileged domain user to coerce an Enterprise Certification Authority into issuing a valid authentication certificate for a Domain Controller. The patch is the easy part; the deeper privilege and trust issues linger.