Strix found a critical auth bypass in etcd, one of the most used open-source components in cloud infrastructure.
Now published as CVE-2026-33413 (CVSS 8.8).
Read the full writeup:
strix.ai/blog/where-oth…
🚨 Fortinet just disclosed CVE-2026-39808 and CVE-2026-39813 - 2 critical vulnerabilities affecting FortiSandbox. No active exploitation itw reported as of yet.
Scan your infrastructure to find vulnerable instances:
CVE-2026-39808: github.com/rxerium/rxeriu…
CVE-2026-39813: github.com/rxerium/rxeriu…
CVE-2026-39808 (CVSS 9.1):
An Improper Neutralization of Special Elements used in an OS Command ('OS command injection') vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
CVE-2026-39813 (CVSS 9.1):
A Path Traversal vulnerability [CWE-24] in FortiSandbox JRPC API may allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests.
Patches are available as per vendor advisories:
fortiguard.fortinet.com/psirt/FG-IR-26…fortiguard.fortinet.com/psirt/FG-IR-26…
‼️ CVE-2025-58434 and CVE-2025-59528: Flowise Dual CVE PoC
GitHub: github.com/kartik2005221/…
The two vulnerabilities chain naturally: CVE-2025-58434 provides unauthenticated account takeover, which satisfies the authentication requirement for CVE-2025-59528, achieving unauthenticated RCE in a single automated run.
Tomcat JMX Proxy exposed without auth?
Wrote a blog about how I got shell on a production Tomcat behind Cloudflare despite the deploy API being locked down, WAF blocking payloads, and CDN filtering template syntax.
8 dead ends. Then AccessLogValve + docBase + relaxedQueryChars + EL injection. 14 requests to RCE.
Tool + nuclei template included!
hackt.us/from-tomcat-jm…#bugbountytips #bugbounty
Praetorian's Khael Kugler found and disclosed a critical vulnerability in AperiSolve, the popular steganography analysis tool used widely in CTFs and the security community.
🚨 CVE-2026-34977 – CVSS 9.3 Unauthenticated RCE via command injection in the JPSeek analyzer functionality. When uploading JPEGs, a password gets interpolated directly into a bash command without sanitization — giving immediate access to the host or container.
🔧 Version 3.2.1 patched.
Advisory ➡ buff.ly/sbumVHn
CVE ➡ buff.ly/P0ZPpvc#CVE#OffensiveSecurity
CVE-2026-39912 - Unauthenticated account takeover on Xboard/V2Board. The loginWithMailLink endpoint returns the magic link in the API response. Two requests, zero credentials, full account access.
chocapikk.com/posts/2026/xbo…
Next, Next, SYSTEM: Exploiting NSIS installer bugs to escalate privileges in Zscaler Client Connector
In this blog post I show how patch gaps in Zscaler's bundled NSIS versions led to LPE..
includes PoCs and yara rule to help you find other affected s/w
blog.amberwolf.com/blog/2026/apri…
Here's a video PoC for Azure Entra ID SignIn Log Bypass in action. I had to make it to help MSRC replicate it (lol). You'll see how simple this bypass was.
No worries admins, Microsoft says that it was only a "Moderate" issue.
The Story of a Perfect Exploit Chain: 6 bugs that looked harmless until they became pre-auth RCE in a security appliance. 🎄✨
This write-up is a real-life hacker’s POV story. It is not a list of bugs. It is the human thought process of how an exploit chain forms.
You start with one question.
What does this appliance actually do with my request?
From there, small wins stack into momentum until 6 bugs collapse into one pre-auth RCE.
My holiday basically disappeared into this write-up… and I’m so glad it did. Happy New Year, everyone!
Had noted elevated honeypot activity towards the WEB-INF pathway and while some of these may not be related to CVE-2025-68645, for reference here are all the paths targetting WEB-INF/web.xml from the past 7 days.
/CDGServer3/ClientAjax
payload: command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp
/SupportPortlet/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
/costModule/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
/faces/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
/h/rest?javax.servlet.include.servlet_path=/WEB-INF/web.xml
/myaccount/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
/secureader/javax.faces.resource./WEB-INF/web.xml.jsf?ln=..
/service/~webrt/nc.uap.lfw.file.action.DocServlet
payload: pageId=login&disp=/WEB-INF/web.xmlpageId=login&disp=/WEB-INF/web.xml
🚨 Critical (CVSS 10) tagged CVE-2025-52691 affecting SmarterMail software
I've created a script to detect vulnerable instances: github.com/rxerium/CVE-20…
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
While the vulnerability affects SmarterMail versions Build 9406 and earlier, the CSA advises users and administrators of affected product versions to update to SmarterMail version Build 9413 immediately:
csa.gov.sg/alerts-and-adv…
ℹ️ Note: A wide range of online services are currently experiencing disruptions due to a technical issue affecting Cloudflare's global network; incident not related to country-level internet disruptions or filtering
There's a lot going on in the AI threats space, and we're psyched to share a little sampling of our view into how actors are leveraging AI to bolster capabilities across a range of adversary use cases. Give it a gander & enjoy direct-to-VT malware links :D
cloud.google.com/blog/topics/th…
415 Followers 188 FollowingMoony Li, Virtualization & Kernel Vulnerability hunt and exploit for Windows,OSX,Android,iOS. SandBox system development and research. Buddhist of 阿弥陀佛
805 Followers 3 FollowingWe are a premier information security consulting firm specializing in information security, vulnerability research and #0day exploit development. #infosec
1K Followers 87 FollowingAn open-eyed man falling into the well of weird warring state machines. I talk about reverse engineering, vulnerability research and exploit development.
717 Followers 1 FollowingSetting the standard for trust and integrity in zero-day vulnerability and exploit intelligence exchange.
📅 Book a meeting https://t.co/rwZuhUuZ7V
3K Followers 1K FollowingTo catch an adversary you must become one. Always deliver more than expected !!!!!! All post are educational purposes only. prompt Library ⬇️ URL
24K Followers 2 FollowingSSD provides the support you need to turn your experience uncovering security vulnerabilities into a highly paid career. [email protected]
1K Followers 1K FollowingResearcher: vulnerability, financial and essential services, and intervention - works with Money Advice Trust and Personal Finance Research Centre, Uni Bristol
1K Followers 182 FollowingProgram analysis, prog. langs researcher. Dedaub co-founder. My crypto/vulnerability activity is on @dedaub, not on this account. DO NOT DM HERE, not checking.
240 Followers 583 FollowingSenior Security Researcher @ Microsoft MORSE.
Computer stuff all around, Car Hacking and Vulnerability Research
Private account: my views and not my employer's
7K Followers 187 FollowingRanked as the #1 security researcher for Google Play Security Rewards Program. The founder of @OversecuredInc Android and iOS vulnerability scanners
452 Followers 234 FollowingSoftware Engineer
Game Developer
ML and Artificial Life
Vulnerability Researcher
Co-creator of SSBM 1.03 with @ssbmhax (Rest In Peace)
1K Followers 975 Following"Vulnerability researcher" doing Bug Bounty on free time (https://t.co/j46EMrTT5T) Also doing some Reverse on many targets but find no vuln 😒