Desk · Vulnerability intelligence

Exploits

Zero-days, proof-of-concept activity, exploit chains, and emergency patch windows.

Articles: 32
Topics: 20
Page: 2 / 4

Data graphic: one percent-encoded letter, /%50SEMHUB/, gets past WAF rules that block /PSEMHUB/. The attack path runs from the POST request through the WAF, which matches the literal path, to the app server that decodes it, then the PSEMHUB servlet and a web shell or fileless commands, for CVSS 9.8 Critical CVE-2026-35273.

criticalExploits Cve 2026 35273

ShinyHunters Exploits Oracle PeopleSoft CVE-2026-35273 via WAF Bypass

GTIG says UNC6240 (ShinyHunters) is again exploiting PeopleSoft CVE-2026-35273, using /%50SEMHUB/ to slip past WAF rules. Patch, then hunt.

Oct 2 · 5 min

Data graphic: Zyxel GS1900 switches exploited. GreyNoise saw 996 switches harvested in 48 countries on or about 17 August, 564 of them with default credentials; the flaw was patched 16 June, added to CISA KEV 21 September, with a KEV due date of 24 September.

highExploits Cve 2026 7273

Zyxel GS1900 switch overflow exploited on 996 devices, now in CISA KEV

CISA added Zyxel GS1900 flaw CVE-2026-7273 to KEV on 21 Sept. GreyNoise reports a suspected Chinese-speaking actor took data from 996 switches in 48 countries.

Oct 2 · 4 min

Data graphic: a SharePoint vulnerability, CVE-2026-65660, shown as a struck-out 6.5 'medium spoofing' August score beside a large red 8.8 CVSS 3.1 code-injection rating; the update was released 11 Aug and the flaw was added to CISA's Known Exploited Vulnerabilities list on 25 Sep.

highExploits Cve 2026 65660

Microsoft SharePoint CVE-2026-65660 Added to CISA KEV After Rescore to RCE

CISA added SharePoint code injection flaw CVE-2026-65660 to KEV on 25 Sep. Previdian says it was rescored from 6.5 spoofing to 8.8 RCE and saw attack attempts.

Oct 2 · 5 min

Data graphic: timeline of WSO2 CVE-2026-5430. WSO2's advisory and fix on May 3, the CVE record on Aug 6 95 days later , the first forged admin token in a watchTowr honeypot on Sep 13 133 days after the fix , and CISA KEV on Sep 24.

criticalExploits Cve 2026 5430

WSO2 API Manager JWT Bypass Exploited 133 Days After the Fix

Forged admin tokens for WSO2 API Manager flaw CVE-2026-5430 (CVSS 10.0) hit honeypots 133 days after the fix. CISA's KEV entry describes the wrong bug.

Oct 2 · 5 min

Data graphic: a CVSS severity scale showing CVE-2026-94127 for F5 BIG-IP APM rated 9.8 critical.

criticalExploits Cve 2026 94127

F5 BIG-IP APM: An Oversized Bearer Token Is Enough for Unauthenticated RCE

An unauthenticated attacker can run code on F5 BIG-IP APM with one oversized Bearer token — but only when APM is configured as an OAuth Authorization Server.

Oct 2 · 6 min

Data graphic: Apple's CoreGraphics zero-day CVE-2026-86950 , an out-of-bounds write that lets a crafted file run code on iPhone, iPad and Mac, scores CVSS 3.1 8.8 and is exploited per CISA KEV. Fixes are iOS, iPadOS and macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, with a CISA KEV deadline of 2 Oct.

highExploits Cve 2026 86950

Apple Patches CoreGraphics Zero-Day Used Against Targeted iPhone Users

CVE-2026-86950, a CoreGraphics out-of-bounds write hit via a crafted file, was exploited on iOS before 27. Update to iOS 26.7.1, macOS 26.7.1 or 15.8.1.

Oct 2 · 5 min

Data graphic: a timeline of WordPress core flaw CVE-2026-87902 CVSS 4.0 9.2 , zooming into 22 September, the day the fix shipped in 25 releases. Patchstack logged the first exploit attempt at 11:49 UTC and the first pearcmd.php file-write attempt at 15:34 UTC that same day; the bug had been reported 64 days earlier on 20 July, and CISA added it to KEV on 25 September with a 28 September deadline.

highExploits Cve 2026 87902

WordPress Core Flaw CVE-2026-87902 Drew Exploit Attempts on Patch Day

A WordPress core path traversal, CVE-2026-87902, can reach RCE through pearcmd.php. Probes began the day the fix shipped and CISA lists it as exploited.

Oct 2 · 7 min

Data graphic: a huge red 61 over a halftone field, for the 61 days Check Point management servers were exploited through CVE-2026-93616 before a fix. First attacks 23 Jul; fix and CISA KEV listing of both CVEs 22 Sep; CVSS 9.8.

criticalExploits Cve 2026 93616

Check Point Management Servers Were a Zero-Day for Two Months Before the Fix

Attackers exploited Check Point CVE-2026-93616 for root on management servers from 23 July; the fix came 22 September, alongside gateway VPN bug CVE-2026-85102.

Oct 2 · 6 min