Trending now

CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability impacting SonicWall SMA 1000 Series appliances. This flaw resides within the SMA1000 Appliance WorkPlace interface. Exploitation of CVE-2026-15409 can allow remote, unauthenticated attackers to compel the appliance to initiate requests to unintended network locations. This vulnerability has been observed in active exploitation, frequently in conjunction with CVE-2026-15410. SonicWall has released firmware patches to address this issue and advises customers to upgrade their appliances and investigate for potential compromise.

CVE-2026-58644 is a vulnerability found in Microsoft Office SharePoint, categorized as a deserialization of untrusted data flaw. This vulnerability enables an unauthorized attacker to execute code over a network. The flaw affects multiple versions of Microsoft SharePoint Server, including Subscription Edition, 2019, and 2016. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-58644 to its Known Exploited Vulnerabilities Catalog, indicating that it is being actively exploited.

CVE-2026-25089 is an operating system (OS) command injection vulnerability affecting Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. This flaw, categorized as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), allows an unauthenticated, remote attacker to execute unauthorized commands on the appliance. The vulnerability is triggered by sending specially crafted HTTP requests, specifically exploiting a second-order command injection within the JSON input of the "start VNC" feature in the web-based management interface. Successful exploitation of CVE-2026-25089 can lead to the execution of arbitrary OS commands on the underlying system. Affected versions include FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, all FortiSandbox 4.2 versions, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5.

CVE-2026-39808 is an operating system (OS) command injection vulnerability affecting Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw stems from the improper neutralization of special elements used in OS commands, which allows attackers to inject malicious commands into system operations. Successful exploitation of CVE-2026-39808 enables remote attackers to execute unauthorized code or commands on the target system. This can be achieved without requiring any authentication or user interaction, typically through specially crafted HTTP requests to an API endpoint.

CVE-2026-58536 is an elevation of privilege vulnerability found in the Windows Cloud Files Mini Filter Driver. This flaw is categorized as a "use after free" vulnerability. An authorized attacker can exploit this vulnerability to locally elevate their privileges within the system. Microsoft addressed CVE-2026-58536 as part of its July 2026 Patch Tuesday release, which included fixes for numerous other vulnerabilities across various products.

CVE-2025-62221 is an elevation of privilege vulnerability affecting the Windows Cloud Files Mini Filter Driver. It stems from a use-after-free issue within the driver. An attacker with local access and some privileges can exploit this vulnerability to gain SYSTEM-level privileges. Successful exploitation of CVE-2025-62221 allows an attacker to gain full control of a Windows system. The attack complexity is low, and no user interaction is required. This vulnerability is actively being exploited.

CVE-2026-27509 describes a vulnerability found in specific firmware versions of the Unitree Go2 robot. This flaw stems from the absence of DDS (Data Distribution Service) authentication or authorization for the `rt/api/programming_actuator/request` topic, which is managed by `actuator_manager.py`. As a result, a network-adjacent and unauthenticated attacker can connect to DDS domain 0. They can then publish a specially crafted message containing arbitrary Python code. This code is subsequently written to the robot's disk under `/unitree/etc/programming/` and linked to a physical controller keybinding. When this keybinding is activated, the injected code executes with root privileges and persists even after the robot reboots. The affected firmware versions include V1.1.7 through V1.1.9, and V1.1.11 (EDU).

CVE-2026-27510 is a remote code execution vulnerability impacting Unitree Go2 quadruped robot firmware versions 1.1.7 through 1.1.11, specifically when these robots are used in conjunction with the Unitree Go2 Android application (com.unitree.doggo2). The vulnerability arises from a lack of integrity protection and validation for user-created programs. The Android application stores these programs, which can contain Python code, in a local SQLite database. When a user initiates a program via a controller keybinding, the application transmits the program's content, including the Python code, to the robot without any cryptographic signing or integrity verification. This allows for the injection of arbitrary Python code, which is then executed with root privileges on the robot by its `actuator_manager.py` component. An attacker with local access to the Android device could tamper with these stored programs, or a malicious program distributed through the application's community marketplace could lead to unauthorized code execution on any robot that imports and runs it.

CVE-2025-5777 is a vulnerability affecting NetScaler ADC and NetScaler Gateway. It is caused by insufficient input validation, which leads to a memory overread. The vulnerability can be exploited on devices configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. An unauthorized attacker could potentially grab valid session tokens from the memory of internet-facing NetScaler devices by sending a malformed request. Successful exploitation could allow the attacker to gain access to the appliances.

CVE-2026-56434 is a use-after-free vulnerability found in the `ngx_http_ssi_module` of NGINX Plus and NGINX Open Source. This flaw specifically manifests when Server-Side Includes (SSI), `proxy_pass`, and `proxy_buffering off` directives are configured simultaneously. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this vulnerability by controlling responses from an upstream server. This can trigger a use-after-free condition within the NGINX worker process, potentially leading to limited modification of memory contents or a restart of the NGINX worker process.