Exploit Public-Facing App

WP Maps Pro bug exploited to create admin accounts on WordPress sites

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-22018 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Week in review: Infostealer dropped via FortiClient EMS flaw, exploited Trend Micro Apex One flaw

CVE-2026-21711 A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

CVE-2025-23167 A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

CVE-2026-40510 OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c

CVE-2026-40034 gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule

CVE-2026-48962 IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

CVE-2026-9804 Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read

LLMReaper - DOM Based AI Conversation Exfiltration via Browser Extensions

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Exploit Code Published for Critical Flowise RCE Vulnerability

NCSC-2026-0172 [1.00] [H/H] Kwetsbaarheid verholpen in Palo Alto Networks PAN-OS en Prisma Access

Cybercrime Crew Claims It Hacked Mike Lindell’s MyPillow

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

Russia-aligned crime group Greyvibe extensively uses AI in attacks

[webapps] YAMCS yamcs-core 5.12.7 - LDAP Injection

[webapps] YAMCS yamcs-core 5.12.7 - User Enumeration

[webapps] YAMCS yamcs-core 5.12.7 - No Rate Limiting

[remote] Notepad++ 8.9.6 - Arbitrary Code Execution

AI helps Russian-speaking GreyVibe run five parallel attack chains on Ukrainian targets

Metasploit Wrap Up 05/29/2026

NCSC-2026-0171 [1.00] [H/M] Kwetsbaarheid verholpen in Starlette

No fix yet for critical RCE bug in open-source Git service Gogs - exploit module is out

Zapier security flaws could have exposed millions of user accounts

New threat actor JINX-0164 targets crypto firms with macOS malware

North Korean hackers Kimsuky target South Korea with new malware variants