The cve.tools Blog

Product updates, the weekly threat signal, and monthly trends — what shipped, what's exploited, and where we're heading.

Follow CVE Pulse on Telegram

splunksiemcve-2026-20253

Splunk Enterprise's open sidecar: the unauthenticated 9.8 that turns your SIEM into a foothold (CVE-2026-20253)

CVE-2026-20253 is an unauthenticated arbitrary file-write in a PostgreSQL sidecar service that Splunk Enterprise 10.x ships alongside Edge Processor, OpAmp and SPL2 pipelines. It scores CVSS 9.8, sits at the 99.87th EPSS percentile, and is on CISA KEV with limited in-the-wild exploitation confirmed. Here's the missing-auth root cause, the exact affected versions, and how to patch — or disable the sidecar — without losing features.

Jul 31, 2026·6 min read

ciscofirewallkev

Cisco baked a password into your firewall manager: CVE-2026-20316

Cisco Secure Firewall Management Center ships with a hard-coded, low-privilege account. It scores CVSS 5.3 - but it is actively exploited, KEV-listed, and Cisco rates it High because it chains to privilege escalation on the box that manages your firewalls.

Jul 31, 2026·8 min read

fastjsonrcedeserialization

No autoType, No Gadget, Still RCE: Inside the fastjson 1.x Zero-Day (CVE-2026-16723)

CVE-2026-16723 is a CVSS 9.0 RCE in fastjson 1.2.68-1.2.83 that needs no autoType and no classpath gadget, is being actively exploited, and is fixed in 1.2.84. Exploit chain, exposure check, detection rules and remediation.

Jul 30, 2026·8 min read

vuln-breakdownaristavelocloud

VeloCloud Orchestrator under attack: CVE-2026-16812 is an unauthenticated 10.0 RCE

CVE-2026-16812 is a CVSS 10.0, unauthenticated OS command-injection flaw in VeloCloud Orchestrator On-Prem. Here's the chain, who's affected, the fixed builds, and how to detect and remediate it.

Jul 29, 2026·8 min read

vuln-breakdownmicrosoftactive-directory

Certighost: how one domain account turns AD CS into a Domain Controller (CVE-2026-54121)

With one ordinary domain account and no admin rights, CVE-2026-54121 ("Certighost") makes an AD CS Certificate Authority issue a Domain-Controller-identity certificate -- a straight line to DCSync and domain takeover. Here's the chain, how to detect it, and how to fix it.

Jul 27, 2026·10 min read

my-stackdecisionsvulnerability-management

Patch the few that matter — and prove you were right to defer the rest

Nobody patches everything. The hard part isn't the ACT pile — it's defending the DEFER pile six months later. Here's how I use My Stack's cut-line policy and append-only decision ledger to do exactly that.

Jul 26, 2026·5 min read

cvezimbraxss

Zimbra's half-click XSS: how a CSS trick let Russian spies read government mail (CVE-2025-66376)

CVE-2025-66376 is a stored XSS in Zimbra's Classic Web Client - a CSS @import trick that runs JavaScript when you open an email. A Russian-aligned actor used it as a zero-day to steal government mail and 2FA codes. What it is, how the chain works, how to detect it, and how to evict it.

Jul 26, 2026·12 min read

sonicwallsma1000ssrf

SonicWall SMA1000: the CVSS 10 "SSRF" that ends in root (CVE-2026-15409)

CVE-2026-15409 is a CVSS 10.0 unauthenticated SSRF in SonicWall SMA1000 appliances, chained to CVE-2026-15410 for root and exploited as a zero-day. Here's the attack chain, who's affected, how to detect compromise, and how to evict — not just patch.

Jul 25, 2026·7 min read

check pointauthentication bypasskev

Check Point SmartConsole auth bypass (CVE-2026-16232): full admin on your firewall manager

CVE-2026-16232 lets an unauthenticated attacker obtain an application login token and log in to the Check Point Management Server as full admin. It's on CISA KEV, exploited in the wild, and gated by two config preconditions. Exposure check, detection rules, and the patch playbook.

Jul 25, 2026·9 min read

winrarzero-daypath-traversal

WinRAR's invisible file: how CVE-2025-8088 hid a zero-day inside an NTFS data stream

CVE-2025-8088 let attackers smuggle malicious files past WinRAR's extraction directory using NTFS Alternate Data Streams. Two threat groups exploited it in the wild before the patch. Here's the mechanism, the disclosure timeline, and why your scanner showed "no public exploit" the whole time.

Jul 24, 2026·6 min read

checkpointvpnikev1

Check Point VPN: the IKEv1 flaw that lets attackers log in with no password (CVE-2026-50751)

CVE-2026-50751 is a CVSS 9.3 unauthenticated authentication bypass in Check Point Remote Access / Mobile Access VPN: a deprecated-IKEv1 logic flaw lets attackers log in with no valid password, key or certificate. Exploited as a zero-day, on CISA KEV, and linked to Qilin ransomware.

Jul 24, 2026·10 min read

sonicwallsma1000ssrf

SonicWall SMA1000: the CVSS 10 "SSRF" that ends in root (CVE-2026-15409)

Jul 23, 2026·7 min read

servicenowdata-exposureaccess-control

Count(er) Strike: how a leaked row count exposes restricted ServiceNow data (CVE-2025-3648)

CVE-2025-3648 lets low-privilege and even anonymous users infer restricted ServiceNow data from a leaked record count. Here is the mechanism, the exploitation chain, and how to shut it down.

Jul 22, 2026·10 min read

vuln-breakdownmicrosoftsharepoint

SharePoint's quiet 9.1: an unauthenticated auth-bypass that unlocks a still-unpatched RCE (CVE-2026-55040)

CVE-2026-55040 is an unauthenticated authentication bypass in on-prem SharePoint Server. It's not on KEV and has no public exploit - but a working Pwn2Own-grade exploit exists, it impersonates any user via forged JWTs, and patching it now breaks an unauthenticated-RCE chain whose second half is still unpatched. Who's exposed, how the chain works, and how to fix it.

Jul 21, 2026·12 min read

cvegithub-actionsci-cd

CVE-2026-44359: how one pull request could hijack Meshtastic's build pipeline

meshtastic/firmware ran its CI on pull_request_target and executed attacker fork code with signing keys and a write token. Here's the chain, the blast radius, and how to find and fix the same pattern in your own repos.

Jul 20, 2026·8 min read

my-stackvulnerability-managementkev

I gave cve.tools my software inventory. Here's exactly what it does with it.

I run My Stack on my own machines. Here's the real setup, the real matches, the parts it gets wrong, and the daily patch queue it leaves me — screenshots and all.

Jul 19, 2026·9 min read

wordpressrcesql-injection

wp2shell: how two WordPress core bugs chain into unauthenticated RCE (CVE-2026-63030)

wp2shell chains CVE-2026-63030 (REST batch-route confusion) with CVE-2026-60137 (author__not_in SQL injection) into an unauthenticated RCE on default WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. WordPress shipped an emergency fix and forced auto-updates on 17 July 2026 -- here's the mechanism, the honest exploitation picture, and the patch/verify playbook.

Jul 19, 2026·10 min read

cve-2026-48276adobe coldfusionrce

ColdFusion's quiet twin: the CVSS-10 file-upload RCE hiding behind the one everyone's patching (CVE-2026-48276)

CVE-2026-48276 is a CVSS 10.0, unauthenticated ColdFusion file-upload RCE from Adobe's APSB26-68. It has no public exploit yet - but it's fixed by the same update as the KEV'd, actively-exploited CVE-2026-48282. Here's the chain, who's affected, detection rules, and why 'mitigated the loud one' isn't 'patched.'

Jul 18, 2026·14 min read

patch-bypassrcefreescout

Patch, then patch again: how CVE-2026-28289 turned FreeScout's fix into zero-click RCE

The FreeScout 1.8.206 fix for CVE-2026-27636 was bypassed in six days by CVE-2026-28289 — a zero-width-space trick OX Research escalated to zero-click, unauthenticated RCE. Fixed in 1.8.207. A textbook case for why a patch is a milestone, not a finish line.

Jul 18, 2026·7 min read

vuln-breakdownmicrosoftsharepoint

SharePoint's next 9.8: an unauthenticated RCE that was exploited before the patch shipped (CVE-2026-58644)

CVE-2026-58644 is an unauthenticated, CVSS 9.8 deserialization RCE in on-prem SharePoint, exploited as a zero-day and on CISA KEV with a 2026-07-19 deadline. Here's the chain, who's affected, and why you must rotate machine keys after patching.

Jul 17, 2026·11 min read