0dayNews — Vulnerability & Exploit News
Known Exploited Vulnerabilities
Type confusion in Chrome V8 allows sandbox code execution
Type confusion in Chrome's V8 engine lets remote attackers run arbitrary code inside the browser sandbox via a crafted HTML page. Actively exploited; update to 152.0.7977.82.
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Kestra OSS OS Command Injection Vulnerability
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
BerriAI LiteLLM Improper Authentication Vulnerability
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Sangoma Switchvox SQL Injection Vulnerability
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Pre-auth SSRF in SonicWall SMA1000 Workplace Interface
Unauthenticated SSRF in the SMA1000 Workplace interface allows remote attackers to reach internal functionality via an unintended access path. Exploited in the wild; chains with CVE-2026-83549 for RCE.
From the desk
N-central Under Active Attack: Patch CVE-2026-86218 Now
BleepingComputer reports N-central servers under active attack one day after N-able's CVSS 10.0 pre-auth RCE disclosure. Update to version 2026.3.1.14 immediately.
Frontend Admin Plugin Flaw Allows WordPress Account Takeover
CVE-2026-75816, scored CVSS 9.8, is an authentication bypass in the Frontend Admin by DynamiApps plugin that allows unauthenticated takeover of any WordPress account on affected sites.
MikroTik Patches Exploited SSH Auth Bypass
CERT Polska confirmed active attacks hijacking MikroTik routers via SSH without credentials. Patch RouterOS to 6.49.21, 7.23.4, or 7.24.2 immediately.
AutoAgent Critical Flaw: Root RCE via Unauthenticated TCP
AutoAgent's TCP server binds to all interfaces and runs commands without authentication, giving remote attackers root access on any exposed installation.
Broadcom Patches Critical RCE in VMware Workstation, Fusion
Broadcom patched two vulnerabilities in VMware Workstation and Fusion, including a critical flaw that lets a VM administrator execute code on the host system.
N-able Patches CVSS 10 Pre-Auth RCE in N-central
N-able's N-central RMM platform has a pre-authentication remote code execution flaw, CVSS 4.0: 10.0, affecting all versions before 2026.3.1.14. Patch immediately.