Skip to content
feed: live
>_0dayNews

0dayNews — Vulnerability & Exploit News

$ kev-tracker --recent

Known Exploited Vulnerabilities

full tracker →
CVE-2026-85046
[ HIGH ]CVSS 8.8EPSS 0.5%kev

Type confusion in Chrome V8 allows sandbox code execution

Type confusion in Chrome's V8 engine lets remote attackers run arbitrary code inside the browser sandbox via a crafted HTML page. Actively exploited; update to 152.0.7977.82.

Google / Chrome (before 152.0.7977.82)
CVE-2026-48710
[ MEDIUM ]CVSS 6.5EPSS 36.3%kev

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Kludex / Starlette
CVE-2026-49869
[ CRITICAL ]CVSS 10.0EPSS 1.9%kev

Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

Kestra / Kestra OSS
CVE-2026-59822
[ HIGH ]CVSS 8.2EPSS 0.9%kev

BerriAI LiteLLM Improper Authentication Vulnerability

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.

BerriAI / LiteLLM
CVE-2026-9586
[ HIGH ]EPSS 11.8%kev

Sangoma Switchvox SQL Injection Vulnerability

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Sangoma / Switchvox
CVE-2026-83548
[ HIGH ]EPSS 0.7%kev

Pre-auth SSRF in SonicWall SMA1000 Workplace Interface

Unauthenticated SSRF in the SMA1000 Workplace interface allows remote attackers to reach internal functionality via an unintended access path. Exploited in the wild; chains with CVE-2026-83549 for RCE.

SonicWall / SMA1000
$ latest --more

From the desk

all articles →
~/articles/2026-09-04-all-in-one-wp-migration-cve-2026-19949-sql-injection
All-in-One WP Migration Flaw Hits 3M WordPress Sites
wordpress

All-in-One WP Migration Flaw Hits 3M WordPress Sites

Unauthenticated SQL injection in All-in-One WP Migration and Backup plugin (versions through 7.109) enables data theft and conditional RCE. Update immediately.

read →
~/articles/2026-09-04-elementor-pro-cve-2026-32475-wordpress-webshell
Elementor Pro Flaw Exploited to Backdoor WordPress Sites
wordpress

Elementor Pro Flaw Exploited to Backdoor WordPress Sites

Attackers are exploiting CVE-2026-32475, a critical file upload flaw in Elementor Pro, to deliver webshells to WordPress sites running version 4.2.1 or earlier.

read →
~/articles/2026-09-04-cisco-nexus-9000-cve-2026-20212-critical-rce
Cisco Patches Critical RCE in Nexus 9000 Switches
● Breaking
cisco

Cisco Patches Critical RCE in Nexus 9000 Switches

Cisco has patched a CVSS 9.8 flaw in ten Silicon One Nexus 9000 switches letting unauthenticated remote attackers execute arbitrary code as root. No workaround available.

read →
~/articles/2026-09-03-openai-astra-critical-cybersecurity-threshold
OpenAI's Astra Crosses Critical Cybersecurity Threshold
Analysis
ai tools

OpenAI's Astra Crosses Critical Cybersecurity Threshold

OpenAI's Astra is the first AI model formally designated as capable of autonomously finding and exploiting zero-days across well-defended systems.

read →
~/articles/2026-09-03-crowdstrike-falcon-falconflank-priv-esc-poc
FalconFlank PoC: Privilege Escalation in CrowdStrike Falcon
threat intel

FalconFlank PoC: Privilege Escalation in CrowdStrike Falcon

Researcher Chaotic Eclipse released a public PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon. No CVE assigned. No patch confirmed as of September 3.

read →
~/articles/2026-09-03-cisa-kev-seven-flaws-reverse-shells-miners
CISA Adds Seven Exploited Flaws to KEV Catalog
● Breaking
cisa kev

CISA Adds Seven Exploited Flaws to KEV Catalog

CISA added seven actively exploited vulnerabilities to KEV on September 3, including a critical Sangoma Switchvox SQL injection. Federal agencies face BOD 26-04 remediation deadlines.

read →