6 dispatches · latest 09 SEP 2026 · all keywords →
A missing authorization check on the logical-decoding path means any account with REPLICATION can dlopen an arbitrary file as the postgres OS user — 12 years old, fixed this month, and not even on KEV yet. Fix your box tonight.
IXON's OT-focused VPN client writes config from a local endpoint that checks no credentials, then feeds it to a root subprocess with CRLF un-neutralized. CVSS 9.6 — and the injected config survives reboots while your VPN keeps working perfectly.
A homelabber narrates getting pwned by CVE-2026-60004 with receipts — the scanner timeline, the miner hashes, and a public POC repo the attacker clearly cloned.
CVE-2026-83548 is a pre-auth CVSS 10.0 SSRF in the SMA1000 Work Place interface that chains with post-auth command injection into unauth RCE on internet-facing remote-access gateways. Exploited in the wild, KEV due date Sep 5.
CVE-2026-8452 is a Citrix NetScaler flaw the vendor rated as high-severity DoS, but watchTowr Labs demonstrated unauthenticated RCE. CISA added it to KEV Aug 26 with a Saturday due date.
A Git hook planted through Gitea's diffpatch endpoint gives unauthenticated attackers RCE as the Gitea service account. ~5,000 instances are exposed and the KEV due date is today.