vulnerability Multiples vulnérabilités dans Synacor Zimbra Collaboration (19 août 2026) Multiple vulnerabilities have been discovered in Synacor Zimbra Collaboration, allowing attackers to execute arbitrary code remotely, perform server-side request forgery (SSRF), and inject remote code via XSS. The ENISA reports that CVE-2026-73570 is actively being exploited, and users of Zimbra Collaboration versions… CERT-FR · Aug 19, 2026 High CVE-2026-73570CVE-2026-10631CVE-2026-50054zimbravulnerabilityssrf
vulnerability Johnson Controls Metasys A vulnerability in Johnson Controls Metasys allows a low-privilege user to inject malicious code via a crafted URL, potentially leading to session hijacking and unauthorized access across multiple versions. The vulnerabi… CISA Advisories · Aug 13, 2026 Critical CVE-2026-34491cve-2026-34491xsscisa
threat-intel 'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft The ‘Jewelbug’ APT group, operating out of China, balances state-sponsored espionage and cryptocurrency theft, targeting governments, military organizations, and corporations globally. They utilize a custom command-and-c… Dark Reading · Aug 13, 2026 High CHMISOcyber espionagecryptocurrency theftnation-state
supply-chain BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins A supply chain attack originating from BdThemes, a WordPress plugin vendor, has been discovered, allowing threat actors to create rogue administrator accounts and install malicious plugins across WordPress sites. The att… The Hacker News · Aug 11, 2026 High CVE-2026-18072CVE-2026-64638wordpresssupply-chainxss
vulnerability Multiples vulnérabilités dans Roundcube (10 août 2026) Multiple vulnerabilities have been discovered in Roundcube Webmail, allowing attackers to execute arbitrary code remotely, compromise data confidentiality, and forge server-side requests. These flaws exist in versions 1.… CERT-FR · Aug 10, 2026 High vulnerabilitywebmailsecurity
vulnerability New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP A high-severity cross-site scripting (XSS) vulnerability in WordPress's login screen allows attackers to execute PHP code on a server, potentially leading to database compromise and full system control. The vulnerability… The Hacker News · Aug 7, 2026 High CVE-2026-64638xsswordpresscve-2026-64638
vulnerability Multiples vulnérabilités dans WordPress (07 août 2026) Multiple vulnerabilities have been discovered in WordPress, including remote code execution and privilege escalation, potentially leading to data compromise. These flaws are primarily affecting older versions of the plat… CERT-FR · Aug 7, 2026 High CVE-2026-64638wordpressvulnerabilityssrf
vulnerability Multiples vulnérabilités dans Progress MOVEit Transfer (31 juillet 2026) Multiple vulnerabilities have been discovered in Progress MOVEit Transfer, allowing attackers to inject code remotely and bypass security policies. These flaws are impacting versions of the software prior to 2026.0.3 and… CERT-FR · Jul 31, 2026 High CVE-2026-10697CVE-2026-15966CVE-2026-15967cvexsssecurity
vulnerability Johnson Controls OpenBlue Employee Johnson Controls has released a security advisory (JCI-PSA-2026-09) addressing critical vulnerabilities in its OpenBlue Employee system. These vulnerabilities – including stored XSS, HTML injection, and file upload flaws… CISA Advisories · Jul 30, 2026 High CVE-2026-21662CVE-2026-34495CVE-2026-34497vulnerabilityxsshtml injection
threat-intel Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation Russian threat actors, linked to Laundry Bear (TA488), are exploiting a vulnerability in Microsoft Outlook Web Access (OWA) to maintain persistent access to email accounts within U.S. and European government entities and… The Hacker News · Jul 30, 2026 High CVE-2026-42897CVE-2025-66376USEUxsscredential theftpersistence
vulnerability Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root OpenWrt has released version 24.10.8 to address a critical vulnerability (CVE-2026-53921) in its DHCPv6 stack, allowing unauthenticated attackers to execute code as root on devices running the firmware. The vulnerability… The Hacker News · Jul 28, 2026 High CVE-2026-53921CVE-2026-62948CVE-2026-62947dhcpv6stack-overflowluci
vulnerability Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th) A scan targeting ESAFENET CDG, a Chinese-focused document management system, revealed weak default passwords and vulnerabilities, including SQL injection and XSS. Threat actors are leveraging existing exploit scripts to… SANS Internet Storm Center · Jul 26, 2026 Medium CNdefault passwordsql injectionxss
threat-intel Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets Russian state-sponsored threat actors, dubbed ‘Laundry Bear,’ have been exploiting a zero-day vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite to target Western governments and enterprises, including US and U… Dark Reading · Jul 23, 2026 High CVE-2025-66376NLUSUAzimbraxssphishing
threat-intel Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes A Russian state-sponsored espionage group exploited a zero-click vulnerability in Zimbra's webmail client to steal email data, two-factor codes, and credentials from Western government and commercial organizations since… The Hacker News · Jul 23, 2026 High CVE-2025-66376USUKCJzero-dayxsscredential theft
vulnerability Multiples vulnérabilités dans les produits Mitel (23 juillet 2026) Multiple vulnerabilities have been discovered in Mitel products, allowing attackers to execute arbitrary code remotely and inject malicious code via XSS. These vulnerabilities affect various versions of MiCollab and Open… CERT-FR · Jul 23, 2026 High vulnerabilityremote code executionxss
vulnerability Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities Zimbra has released patches to address nine security vulnerabilities, including a critical SNMP command injection flaw and several XSS vulnerabilities. These fixes are vital to mitigate potential code execution and email… The Hacker News · Jul 21, 2026 Medium CVE-2026-50055snmpxsscommand-injection
vulnerability Zimbra Update Patches Critical Vulnerabilities Zimbra has released a critical security update to address several vulnerabilities, including a command injection flaw and XSS defects, that could allow attackers to execute commands and steal emails. The update is essent… SecurityWeek · Jul 21, 2026 Critical CVE-2026-50055CVE-2026-10631CVE-2026-50054command injectionxssssrf
vulnerability Rockwell Automation FactoryTalk DataMosaix Rockwell Automation has issued a security advisory regarding a critical vulnerability (CVE-2026-9292) in its FactoryTalk DataMosaix Private Cloud software. An authenticated attacker can inject malicious scripts that are… CISA Advisories · Jul 16, 2026 Critical CVE-2026-9292cve-2026-9292xsscwe-79
vulnerability Vulnérabilité dans Ruby on Rails (16 juillet 2026) A vulnerability in Ruby on Rails versions prior to 1.7.1 allows for remote code injection via XSS. This means attackers could potentially execute malicious code on vulnerable systems, requiring immediate patching to prev… CERT-FR · Jul 16, 2026 Medium rubyrailsxss
vulnerability ABB T-MAC Plus ABB has identified and addressed several vulnerabilities in its T-MAC Plus Terminal Management System, primarily related to improper configuration and access controls. These vulnerabilities could allow an attacker to exe… CISA Advisories · Jul 14, 2026 High CVE-2025-14771CVE-2025-14772CVE-2025-14773iisxsscwe-552
