cPanel is a very popular hosting framework which is often very difficult to avoid exposing to the internet. The exploit for this weakness gives the attacker root access to cPanel (and from there easy RCE on the system), and the exploit is reliable, well documented, and affects all versions of cPanel except the latest patch. There are well over a million hosts exposed, and though cPanel does have some automated self-upgrade functionality, it can be turned off, and the window before an upgrade (usually up to 24h) is long enough for attacker to have already exploited this weakness. cPanel have provided a script you can use to detect if compromise has already occurred, which can be found here.
Vulnerability intelligence
Updated an hour ago
FeedsTrending now
CVEs trending on social media within the last 24 hours
Hypemeter
Current score
Cold bath
1
CVE-2026-11645 Published Jun 9, 2026Hype score
10
high 8.8
Exploit known
SSLCVE-2026-11645 is an out-of-bounds read and write vulnerability found in the V8 JavaScript engine of Google Chrome. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The vulnerability affects Google Chrome versions prior to 149.0.7827.103, as well as other Chromium-based browsers that utilize the V8 engine. Google has confirmed that an exploit for CVE-2026-11645 exists and is being actively used in the wild.
2
CVE-2026-20245 Published Jun 4, 2026Hype score
10
high 7.8
Exploit known
NetworkTunneling protocolFirmwareCVE-2026-20245 is a command injection vulnerability found in the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager, previously known as SD-WAN vManage. This flaw arises from insufficient validation of user-supplied input, allowing an authenticated attacker with netadmin privileges to upload a specially crafted file. Upon successful exploitation, the attacker can execute arbitrary commands as root on the affected system. Cisco has observed limited instances of this vulnerability being exploited in the wild, with some cases resulting in configuration changes being pushed to edge devices. It is noted that the required netadmin privileges can be obtained either through valid credentials or by leveraging other vulnerabilities, such as CVE-2026-20182 or CVE-2026-20127.
3
CVE-2026-7473 Published Jun 5, 2026Hype score
10
medium 6.9
Exploit known
Arista EOSVXLANGRECVE-2026-7473 describes a vulnerability affecting Arista EOS platforms that have a tunnel decapsulation configuration enabled. This includes configurations such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface. The core issue is that the affected switch will incorrectly decapsulate and forward unexpected tunneled packets if their destination IP matches the configured decapsulation IP. This vulnerability arises because the switch fails to verify the tunnel protocol type, which can lead to the processing of non-configured tunnel traffic. This issue has been reported as being actively exploited in the wild and is included in CISA's Known Exploited Vulnerabilities Catalog.
Known exploited
Sourced from CISA's Known Exploited Vulnerability (KEV) catalog.
- CVE-2026-20245 Published Jun 4, 2026
Hype score
10
high 7.8
Exploit known
NetworkFirmwareTunneling protocolCVE-2026-20245 is a command injection vulnerability found in the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager, previously known as SD-WAN vManage. This flaw arises from insufficient validation of user-supplied input, allowing an authenticated attacker with netadmin privileges to upload a specially crafted file. Upon successful exploitation, the attacker can execute arbitrary commands as root on the affected system. Cisco has observed limited instances of this vulnerability being exploited in the wild, with some cases resulting in configuration changes being pushed to edge devices. It is noted that the required netadmin privileges can be obtained either through valid credentials or by leveraging other vulnerabilities, such as CVE-2026-20182 or CVE-2026-20127.
- CVE-2026-7473 Published Jun 5, 2026
Hype score
10
medium 6.9
Exploit known
Arista EOSVXLANGRECVE-2026-7473 describes a vulnerability affecting Arista EOS platforms that have a tunnel decapsulation configuration enabled. This includes configurations such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface. The core issue is that the affected switch will incorrectly decapsulate and forward unexpected tunneled packets if their destination IP matches the configured decapsulation IP. This vulnerability arises because the switch fails to verify the tunnel protocol type, which can lead to the processing of non-configured tunnel traffic. This issue has been reported as being actively exploited in the wild and is included in CISA's Known Exploited Vulnerabilities Catalog.
- CVE-2026-11645 Published Jun 9, 2026
Hype score
10
high 8.8
Exploit known
SSLCVE-2026-11645 is an out-of-bounds read and write vulnerability found in the V8 JavaScript engine of Google Chrome. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. The vulnerability affects Google Chrome versions prior to 149.0.7827.103, as well as other Chromium-based browsers that utilize the V8 engine. Google has confirmed that an exploit for CVE-2026-11645 exists and is being actively used in the wild.
Insights
See moreOur Security Team's most recent CVE analysis
- Link to CVE page
CVE-2026-41940
critical 9.3
Exploit known
Intruder Insights
Updated Apr 30, 2026
- Link to CVE page
CVE-2026-1340
critical 9.8
Exploit known
Intruder Insights
Updated Jan 30, 2026
This and the similar vulnerability CVE-2026-1281 allow an unauthenticated attacker to execute code remotely on unpatched Ivanti EPMM instances.
A patch is available from Ivanti here and should be installed immediately. There is a page for defenders who need to check if their instance has been compromised here, though this is a work in progress.
Note that this is a temporary patch which will be removed with further version updates. If you update the version of your EPMM instance after patching, you must apply the patch again. A fully patched version of EPMM will be available in future which will permanently fix the vulnerability.
This vulnerability was known to be used in the wild before being disclosed by the vendor. Proof of concept code is now available publicly, so increased attack activity is expected.
- Link to CVE page
CVE-2026-1281
critical 9.8
Exploit known
Intruder Insights
Updated Jan 30, 2026
This and the similar vulnerability CVE-2026-1340 allow an unauthenticated attacker to execute code remotely on unpatched Ivanti EPMM instances.
A patch is available from Ivanti here and should be installed immediately. There is a page for defenders who need to check if their instance has been compromised here, though this is a work in progress.
Note that this is a temporary patch which will be removed with further version updates. If you update the version of your EPMM instance after patching, you must apply the patch again. A fully patched version of EPMM will be available in future which will permanently fix the vulnerability.
This vulnerability was known to be used in the wild before being disclosed by the vendor. Proof of concept code is now available publicly, so increased attack activity is expected.