Netlas.io

CVE-2026-58115: Actively exploited RCE in Node-RED, 10.0 rating 🔥 Disclosed in August'26, the missing-authentication vulnerability in Node-RED allows unauthenticated remote attackers to execute arbitrary system commands on exposed hosts. This CVE was assigned by Siemens, but other products and standalone Node-RED instances may also be affected. This flaw is currently being actively exploited in the wild! 👉 nt.ls/fvYGg

CVE-2026-116241 and others: RCE via OS command injection and other new pgAdmin 4 vulnerabilities, up to 9.4 rating 🔥 The pgAdmin Development Team recently disclosed fifteen new vulnerabilities in pgAdmin 4. The most severe is an incomplete fix for CVE-2026-17566 that allows an attacker to execute arbitrary operating system commands on the pgAdmin host by using a specially crafted program clause. 👉 nt.ls/g1pCL

Actively exploited RCE and other new WordPress vulnerabilities, no CVE assigned yet, 8.1 rating 🔥 The recently disclosed unauthenticated race-condition vulnerability in the WordPress Core update process can lead to remote code execution. This flaw is known to be actively exploited in the wild! Other disclosed vulnerabilities include stored XSS, DoS, information disclosure, and authorization weaknesses. 👉 nt.ls/UTiOc

☀️Fingerprinting Exposed Solar Inverters with Netlas In March 2025, Forescout's SUN:DOWN report showed that reaching enough inverters at once could nudge the grid. And a surprising number of them are reachable. See what inverters reveal about themselves — and how Netlas turns that into a map. 👉 netlas.io/blog/fingerprintin…

CVE-2026-103594 and others: Multiple vulnerabilities in WatchGuard Fireware OS, up to 9.5 rating 🔥 WatchGuard disclosed seventeen vulnerabilities in Fireware OS. The most severe flaws allow unauthenticated attackers to cause a DoS condition and potentially execute arbitrary code or invoke privileged system-level administrative actions. 👉 nt.ls/g5Xka

CVE-2026-115188 and others: Multiple vulnerabilities in Mautic, up to 9.9 rating 🔥 The Mautic project disclosed multiple vulnerabilities in the open-source Mautic marketing automation platform, including remote code execution (RCE) via unrestricted file upload, sandbox escape, PHP object injection, blind SQL injection, stored XSS, and other security flaws. 👉 nt.ls/PmA2e

CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264: Four CVEs in Ruby’s regular expression engine, discovered by GitLab, up to 10.0 rating 🔥 Last week, the Ruby team released patches for several bugs in Ruby’s regular expression engine (Onigmo). GitLab found that these bugs could be exploited for RCE on GitLab servers. The same risk applies to any other Ruby application that compiles user-supplied regular expressions. 👉 nt.ls/1j93T

CVE-2026-114625: Actively exploited SQL injection flaw in Arista VeloCloud Orchestrator, 9.9 rating 🔥 Arista has disclosed a new SQL injection vulnerability in VeloCloud Orchestrator that allows any authenticated user to gain operator privileges and impersonate a local user with "superuser operator" privileges. This issue is known to be actively exploited! 👉 nt.ls/Z5tBM

📟Fingerprinting Exposed Siemens S7 PLCs with Netlas In 2010, Stuxnet targeted Siemens PLCs. Over 15 years later, thousands still expose their model, firmware version, and internal names on TCP port 102. See how a few Netlas queries narrow thousands of exposed S7 services to the ones worth a closer look. 👉 netlas.io/blog/fingerprintin…

🎥Turning Recon Data into Findings with Netlas In his video, ZACK0X01 walks through the reconnaissance and scanning workflow behind his AI agent, showing how Netlas turns raw recon data into actionable findings. You'll see how certificate and favicon hash searches find assets missed by subdomain enumeration, and how scanning reveals services and tech in JSON. 👉 youtube.com/watch?v=v9v9eGpy…

CVE-2026-110264 and others: 12 new vulnerabilities in GitLab, up to 10.0 rating 🔥 GitLab has disclosed 12 new vulnerabilities affecting GitLab CE & EE. The most severe allows an unauthenticated remote attacker to execute arbitrary code on the GitLab server. 👉 nt.ls/dxdTf

CVE-2026-109618 & CVE-2026-109619: Two RCE vulnerabilities in PHP (PHP2Shell), rating 9.2 for both 🔥 Today the PHP security team released an emergency update addressing two critical vulnerabilities in the PHP core, which allow unauthenticated remote code execution as the web worker account. Details of the two vulnerabilities were disclosed by researchers yesterday, ahead of today’s release. 👉 nt.ls/MDn37

🔍Using Netlas in Houdin One ThreatFox indicator, one default certificate, and Netlas data in between: Houdin traces how a single alert turns into a list of servers running CyberStrikeAI, an open-source platform for AI-assisted attacks. 👉 netlas.io/blog/using_netlas_…

Token-based API guard authentication bypass in Laravel, no CVE assigned yet, 9.2 rating ‍🔥 An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by Laravel's built-in TokenGuard when configured with a standard token-based API guard. This flaw affects applications using certain MySQL or MariaDB database configurations. 👉 nt.ls/kfDww

Multiple vulnerabilities in Roundcube, no CVE assigned 🤷🏻‍♂️ The Roundcube project today disclosed multiple vulnerabilities in Roundcube Webmail, including IMAP command injection, mail header injection, SSRF, CSRF, XSS, and other security issues. 👉 nt.ls/Hq2Fn

🤝Netlas supported the DRIFT Linux project DRIFT Linux is an open-source, not-for-profit project in digital forensics, OSINT, and cybersecurity. It shares knowledge and builds tools for incident investigation. Netlas has supported independent research within the project. In the future, we hope to see Netlas integrated into DRIFT Linux as one of its tools. Read more about project: driftlinux.org

CVE-2026-89067, CVE-2026-87093, and others: 12 new vulnerabilities in Progress MOVEit Transfer, up to 8.8 rating ‍🔥 Progress Software has disclosed twelve new vulnerabilities in MOVEit Transfer, including authentication bypass, local privilege escalation, SQL injection, and XSS. Successful exploitation could allow an attacker to gain unauthorized access or administrative control and could also lead to data exposure, service instability, and resource exhaustion. 👉 nt.ls/JYNPz

⚙️Hunting Exposed LLM Infrastructure with Netlas In this new article by CyberBit, we explore how any publicly accessible instance of a self-hosted LLM platform can reveal the models it uses and even the runtime environment on which the AI service operates. 👉 netlas.io/blog/hunting_expos…