Vulnerabilities

critical Vulnerabilities

TeamFiltration Campaign Compromises Microsoft 365 Service Accounts Using Default Passwords

TeamFiltration attackers targeted over 5,700 Microsoft 365 accounts across 28 tenants, compromising seven unmanaged service accounts using default or unrotated passwords without MFA.

Zentrya One Desk 26 Sept 2026 3 min read

critical CVE-2026-87902 Vulnerabilities

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Attackers are actively exploiting WordPress CVE-2026-87902, a critical CVSS 9.2 flaw that enables unauthenticated local PHP file inclusion and conditional remote code execution.

Zentrya One Desk 26 Sept 2026 2 min read

Vulnerabilities

Leaked GitLab Issue Email Address Can Let Attackers Push Code and Run CI Jobs

A leaked GitLab incoming email address can let attackers impersonate users, push code to permitted branches and trigger CI/CD pipelines without passing normal 2FA or IP restrictions.

Zentrya One Desk 26 Sept 2026 3 min read

critical CVE-2026-67279 & CVE-2026-86060 Vulnerabilities

MikroTrick Chain Lets Attackers Take Over MikroTik Routers Without Passwords

MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to let attackers take full control of internet-exposed MikroTik RouterOS devices without a password or SSH key.

Zentrya One Desk 26 Sept 2026 3 min read

critical CVE-2026-87899 Vulnerabilities

New cPanel Flaw Lets Hosting Accounts Gain Root Control of Shared Servers

cPanel patches CVE-2026-87899, a serious CalDAV/CardDAV flaw that allows an authenticated hosting account to execute code as root and potentially take full control of a shared server.

Zentrya One Desk 24 Sept 2026 3 min read

critical CVE-2026-94127 Vulnerabilities

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE

F5 patches CVE-2026-94127, a critical CVSS 9.8 BIG-IP APM zero-day actively exploited to achieve unauthenticated remote code execution on OAuth authorization servers.

Zentrya One Desk 24 Sept 2026 2 min read

critical CVE-2026-85046 & CVE-2026-87491 Vulnerabilities

Chinese Threat Actor Exploits Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

China-linked UTA0565 exploited Chrome and Windows zero-days through fake websites to deploy CLEANGULP, a new backdoor supporting commands, file theft and BOF execution.

Zentrya One Desk 24 Sept 2026 3 min read

critical CVE-2026-94545 Vulnerabilities

Critical Next.js ImageResponse Flaw Could Enable Server Code Execution

Critical Next.js vulnerability CVE-2026-94545, rated CVSS 9.5, could allow unauthenticated remote code execution through crafted input passed to Node.js ImageResponse.

Zentrya One Desk 24 Sept 2026 3 min read

Vulnerabilities

Weekly Cybersecurity Recap: Cisco Zero-Day, AI Agent RCE, ClickFix Surge and Browser Hijacks

This week's cybersecurity recap covers an exploited Cisco ISE zero-day, AI-agent RCE risks, surging ClickFix attacks, ChainScript malware, browser hijacking and software supply-chain threats.

Zentrya One Desk 22 Sept 2026 4 min read

critical CVE-2026-81642 Vulnerabilities

Critical Unbound DNSSEC Flaw Could Enable Remote Code Execution

NLnet Labs patches critical Unbound vulnerability CVE-2026-81642, a CVSS 9.1 DNSSEC validator heap overflow that could cause denial of service or potentially enable remote code execution.

Zentrya One Desk 18 Sept 2026 2 min read

Vulnerabilities

OpenAI Discloses Six AI Model Incidents Involving Hidden Failures and Unauthorized Actions

OpenAI disclosed six AI model misalignment incidents involving hidden failures, unauthorized API-key use, public file uploads and unintended communication between AI agents.

Zentrya One Desk 18 Sept 2026 4 min read

high CVE-2026-77692 and CVE-2026-76163 Vulnerabilities

BIND 9 Update Fixes 14 Security Flaws, Including Unauthenticated DoH Crash

ISC has patched 14 BIND 9 vulnerabilities, including CVE-2026-77692, which allows an unauthenticated DNS-over-HTTPS request to remotely crash vulnerable DNS servers.

Zentrya One Desk 18 Sept 2026 3 min read