Vulnerability intelligence

Updated 6 minutes ago

Feeds

Trending now

CVEs trending on social media within the last 24 hours

Hypemeter

150100

Current score

Pretty quiet out there

  1. 1

    CVE-2026-16812 Published Jul 27, 2026

    Hype score

    15

    critical 10.0

    Exploit known

    VeloCloud OrchestratorVCO

    CVE-2026-16812 is an OS command injection vulnerability found in Arista Networks VeloCloud Orchestrator (VCO) On-Prem. This flaw allows a remote attacker to execute operating system commands on the VCO host. The vulnerable functionality was originally intended for internal use only but remained remotely accessible. Successful exploitation of CVE-2026-16812 can lead to a compromise of the confidentiality, integrity, and availability of the orchestrator and the data it manages. This vulnerability does not require authentication for exploitation and has been actively exploited in the wild.

  2. 2

    CVE-2025-68686 Published Feb 10, 2026

    Hype score

    15

    medium 5.9

    Exploit known

    FortiOSFortinet FortiOS

    CVE-2025-68686 is an information disclosure vulnerability affecting multiple versions of Fortinet FortiOS, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). This flaw allows a remote, unauthenticated attacker to bypass a previously implemented patch designed to address a symbolic link persistency mechanism. The bypass is achieved through specially crafted HTTP requests, which can lead to the exposure of sensitive data. It is important to note that CVE-2025-68686 acts as a secondary exploitation vector. For this vulnerability to be leveraged, the FortiOS product must have already been compromised at the filesystem level through a separate, prior vulnerability. This means the vulnerability extends the impact of previous compromises by allowing attackers to maintain unauthorized access to sensitive information on already affected FortiOS devices.

  3. 3

    CVE-2026-49176 Published Jul 14, 2026

    Hype score

    12

    high 7.8

    WindowsWindows WalletService

    CVE-2026-49176 is a local privilege escalation vulnerability found in the Microsoft Windows WalletService component. This flaw stems from improper privilege management combined with link-following behavior (CWE-59). An authorized local attacker can exploit this vulnerability to gain SYSTEM-level privileges on affected Windows client and server editions. The WalletService, which manages wallet-related objects and credentials, performs privileged file or object operations without adequately validating the identity or trust boundary of resources it interacts with. Because the service operates with elevated rights, a standard local user can influence these operations to act on attacker-controlled paths, often involving symbolic links, junctions, or mount points. Microsoft addressed this issue through its security update guide, and a public proof-of-concept has been published on GitHub.

See more

Known exploited

Sourced from CISA's Known Exploited Vulnerability (KEV) catalog.

  1. CVE-2026-16812 Published Jul 27, 2026

    Hype score

    15

    critical 10.0

    Exploit known

    VeloCloud OrchestratorVCO

    CVE-2026-16812 is an OS command injection vulnerability found in Arista Networks VeloCloud Orchestrator (VCO) On-Prem. This flaw allows a remote attacker to execute operating system commands on the VCO host. The vulnerable functionality was originally intended for internal use only but remained remotely accessible. Successful exploitation of CVE-2026-16812 can lead to a compromise of the confidentiality, integrity, and availability of the orchestrator and the data it manages. This vulnerability does not require authentication for exploitation and has been actively exploited in the wild.

  2. CVE-2025-68686 Published Feb 10, 2026

    Hype score

    15

    medium 5.9

    Exploit known

    FortiOSFortinet FortiOS

    CVE-2025-68686 is an information disclosure vulnerability affecting multiple versions of Fortinet FortiOS, categorized as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). This flaw allows a remote, unauthenticated attacker to bypass a previously implemented patch designed to address a symbolic link persistency mechanism. The bypass is achieved through specially crafted HTTP requests, which can lead to the exposure of sensitive data. It is important to note that CVE-2025-68686 acts as a secondary exploitation vector. For this vulnerability to be leveraged, the FortiOS product must have already been compromised at the filesystem level through a separate, prior vulnerability. This means the vulnerability extends the impact of previous compromises by allowing attackers to maintain unauthorized access to sensitive information on already affected FortiOS devices.

  3. CVE-2026-50522 Published Jul 14, 2026

    critical 9.8

    Exploit known

    Microsoft OfficeSharePoint

    CVE-2026-50522 is identified as a deserialization vulnerability affecting Microsoft Office SharePoint. This flaw enables an unauthorized attacker to execute code remotely over a network. The vulnerability was addressed as part of Microsoft's July 2026 Patch Tuesday updates.

See more

Insights

See more

Our Security Team's most recent CVE analysis

  1. CVE-2026-50522

    critical 9.8

    Exploit known

    Link to CVE page

    Intruder Insights

    Updated Jul 21, 2026

    This vulnerability allows an unauthenticated attacker who can access a Sharepoint instance to gain code execution. A patch has been available since July 14th in Microsofts 'Patch Tuesday' security rollup.

    A proof of concept exploit has recently been published and this makes patching more urgent as attacks have now been seen in the wild.

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  2. CVE-2026-63030

    critical 9.8

    Exploit known

    Link to CVE page

    Intruder Insights

    Updated Jul 21, 2026

    This is one of two vulnerabilities in a combined chain that allows remote code execution on any stock WordPress installation. CVE-2026-63030 is the entry point — a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check. When combined with CVE-2026-60137, the attacker gains the ability to read any data from the WordPress database with a single HTTP request. An exploit chain has been demonstrated which combines both of these bugs to achieve code execution.

    WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected. Update to WordPress 6.9.5 or 7.0.2 immediately. No plugins, user interaction, or non-default configuration is required to exploit. Given WordPress powers approximately 43% of all websites, the attack surface is enormous.

    WordPress Core contains a pre-authentication route confusion vulnerability in the REST API batch endpoint that, combined with CVE-2026-60137, allows remote code execution.

    WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

  3. CVE-2026-60137

    medium 5.9

    Exploit known

    Link to CVE page

    Intruder Insights

    Updated Jul 23, 2026

    This SQL injection vulnerability is the second half of a critical exploit chain alongside CVE-2026-63030. On its own this vulnerability would require a plugin or theme to pass untrusted input — but when combined with CVE-2026-63030's authentication bypass, it becomes exploitable on stock WordPress with no plugins installed. This vulnerability can be used to gain code execution.

    WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected. Update to WordPress 6.9.5 or 7.0.2 immediately. Both CVEs were patched in the same security release.

    WordPress Core contains an SQL injection vulnerability in WP_Query where a query parameter is inserted directly into SQL without sanitisation when provided as a string value.

    WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.