All CosmicBytez Labs articles tagged #Active Exploitation, across news, security advisories, how-to guides, and projects.
Microsoft warns of a CVSS 10.0 RCE flaw in Entra ID (CVE-2026-69836) exploited in the wild. No customer action required — Microsoft patched it server-side.
CVE-2026-73570, a CVSS 8.9 command injection flaw in Zimbra Collaboration, is actively exploited in the wild for unauthenticated RCE via SNMP.
CISA added a critical Ray framework flaw to its KEV catalog. The vulnerability enables browser-based RCE in AI/ML distributed computing workloads.
Netherlands NCSC warns hackers are actively exploiting a macOS authentication bypass in Screen Sharing after public exploit code emerged, deploying Monero miners.
Active exploitation attempts targeting an unpatched GeoServer zero-day began within hours of public disclosure. No patch available — restrict access now.
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 5, 2026 — a critical Langflow RCE, an Apache Tomcat encryption flaw, and an N-able N-central authentication bypass — all confirmed under active exploitation with a federal patch deadline of August 7.
Arista Networks has released an emergency patch for a maximum-severity command injection zero-day in on-premises VeloCloud Orchestrator deployments that is being actively exploited in the wild.
Threat actors are actively exploiting an unpatched remote code execution vulnerability in Alibaba's FastJson Java library, targeting US enterprises with no authentication or user interaction required.
Attackers are actively exploiting CVE-2026-16723, a critical remote code execution flaw in Alibaba's Fastjson 1.x library affecting Spring Boot...
A high-severity path traversal vulnerability in the open-source developer platform Windmill (CVE-2026-29059, CVSS 7.5) is under active exploitation,...
Attackers are actively exploiting a critical authentication bypass in the official Gitea Docker image, allowing unauthenticated users to impersonate any...
CISA has added a high-severity Microsoft SharePoint Server remote code execution vulnerability to its Known Exploited Vulnerabilities catalog following...
A critical pre-authentication remote code execution flaw in Progress Kemp LoadMaster (CVE-2026-8037, CVSS 9.6) is under active exploitation attempts,...
A critical CVSS 9.8 authentication bypass vulnerability in Oracle E-Business Suite's Payments module is being actively exploited in the wild, according to...
A CVSS 9.8 unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is being actively exploited, with threat...
Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in Langflow, to write arbitrary files on exposed servers....
Cisco has disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability in Catalyst SD-WAN Manager with a CVSS score of 7.8. No patch is…
Belgium's national cybersecurity authority (CCB) has issued an urgent warning that threat actors are actively exploiting a recently patched critical Windows…
Palo Alto Networks warns that CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect, is under active exploitation by hackers attempting...
Palo Alto Networks warns that CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS GlobalProtect and Prisma Access, is being actively exploited by...
Drupal is warning that hackers are actively attempting to exploit a 'highly critical' SQL injection vulnerability, CVE-2026-9082, announced earlier this...
Microsoft has disclosed two Windows Defender vulnerabilities under active exploitation in the wild, including CVE-2026-41091 — a privilege escalation flaw...
Trend Micro has patched an Apex One zero-day vulnerability actively exploited in attacks targeting Windows systems. The flaw, discovered in the company's...
Microsoft has issued emergency patches for two Windows Defender vulnerabilities that were actively exploited as zero-days before fixes were available....
Attackers are actively exploiting a critical vulnerability in the Funnel Builder WordPress plugin to inject malicious JavaScript into WooCommerce checkout...
Threat actors are actively exploiting CVE-2026-42208, a critical pre-authentication SQL injection vulnerability in the LiteLLM open-source LLM gateway,...
A high-severity SSRF vulnerability in LMDeploy, a widely used open-source LLM deployment toolkit, was actively exploited in the wild less than 13 hours...
Threat actors are mass-exploiting a critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin, uploading PHP webshells to...
Shadowserver found over 6,400 Apache ActiveMQ servers exposed online and vulnerable to ongoing attacks exploiting a high-severity code injection...
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
A critical authentication bypass vulnerability in nginx-ui, a popular open-source web-based Nginx management interface, is being actively exploited to...
Attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in the Ninja Forms File Uploads premium add-on for...
Fortinet has released emergency out-of-band patches for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that enables...
Fortinet has released an emergency weekend security update for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that is...
Hackers are actively exploiting a critical memory overread vulnerability tracked as CVE-2026-3055 in Citrix NetScaler ADC and NetScaler Gateway appliances...
Threat intelligence firm Defused confirms active in-the-wild exploitation of a critical vulnerability in Fortinet's FortiClient EMS platform....
F5 has reclassified a BIG-IP APM vulnerability from denial-of-service to critical remote code execution, warning that attackers are actively exploiting...
CISA has added CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in the Langflow AI framework, to its Known Exploited...
CISA has added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog after...
Security researchers at Defused Cyber and watchTowr have detected active reconnaissance targeting CVE-2026-3055, a critical CVSS 9.3 memory overread flaw...
A critical unauthenticated RCE vulnerability in F5 BIG-IP APM is being actively exploited in the wild. Malicious traffic targeting access policy virtual...
CISA has added two Roundcube Webmail vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2025-49113 (CVSS 9.9, deserialization RCE) and...
A critical pre-authentication OS command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access with CVSS 9.9 is being...
A high-severity use-after-free vulnerability in Chrome's CSS engine is being actively exploited in the wild. Google's first in-the-wild Chrome zero-day of...
Actively exploited Windows Shell vulnerability bypasses SmartScreen protection, allowing malicious files to execute without security warnings. Patch...