[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"landing-trending":3,"cve-CVE-2026-78061":85,"landing-articles":135},{"count":4,"next":5,"previous":6,"results":7},156,"http:\u002F\u002Fweb:8606\u002Fapi\u002Ftrending_attacks\u002F?page=2&sorted_by=-published_at",null,[8,15,23,32,40,48,55,62,70,77],{"id":4,"title":9,"summary":10,"published_at":11,"severity":12,"vendor":13,"products":14},"GitLab - Unauthenticated GraphQL Code Injection & CSRF (Public Project\u002FData Deletion)","GitLab is a web-based DevOps platform providing Git repository management, CI\u002FCD pipelines, issue tracking, and project collaboration. The platform exposes a GraphQL API for programmatic access to core functionality.\r\n\r\nCVE-2026-19478 — Critical\r\n\r\nCode injection flaw in the GraphQL API of GitLab CE and EE, via a GraphQL directive. Under certain conditions, a remote unauthenticated attacker can modify or delete public projects and user data, with no authentication and no user interaction — hence the high severity and the risk of data loss and supply-chain compromise. It affects self-managed installations across several branches (18.2 through 18.11, 19.0, 19.1, 19.2). Fixed on August 17, 2026 in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, shipped as an ad hoc critical patch outside the normal cycle. GitLab.com and GitLab Dedicated already run the patched version and need no action. Worth noting: the fixes do not cover the 18.2 through 18.10 branches, which remain within the affected range — those installations must migrate to a patched branch.\r\n\r\nCVE-2026-19650 — High\r\n\r\nCSRF (cross-site request forgery) flaw in the GraphQL multiplex query handler. Improper request validation allows GraphQL mutations to be triggered via GET requests, even though these state-changing operations should not be reachable that way. Unlike the critical flaw, this one requires victim interaction: a targeted user must be lured into opening a specially crafted request, which narrows its scope — but it can still lead to unauthorized state-changing operations server-side. Fixed in the same versions (19.2.4, 19.1.6, 19.0.8, 18.11.11).\r\n\r\nPaths \u002F attack surface:\r\n\r\n\u002Fapi\u002Fgraphql — the GraphQL API endpoint. Both flaws live here: the critical one via a crafted GraphQL directive, the CSRF one via the multiplex query handler accepting mutations over GET.","2026-08-18T13:30:02.192502Z",4,"GitLab",[13],{"id":16,"title":17,"summary":18,"published_at":19,"severity":12,"vendor":20,"products":21},155,"Multiple vulnerabilities in Adobe Campaign Classic - Unauthenticated SQL Injection to RCE &  Unauthenticated Incorrect Authorization to RCE & 2 x Unauthenticated Auth Bypass to RCE","Adobe Campaign Classic is an enterprise marketing automation platform that enables organizations to design, execute, and manage multi-channel customer campaigns at scale.\r\n\r\nCVE-2026-71398: Incorrect Authorization\r\n\r\nCritical authorization bypass vulnerability in Adobe Campaign Classic that allows unauthenticated remote attackers to execute arbitrary code without any user interaction. The vulnerability stems from improper authorization checks in a network-accessible endpoint. An attacker can craft a malicious request to an exposed interface that should be restricted to authenticated and privileged users, but the application fails to properly validate whether the caller possesses the required permissions.\r\nAttack Vector:\r\nThe vulnerability is exploitable over the network with low complexity. An attacker requires no credentials, no pre-authentication, and no user interaction. The attacker can send a specially crafted HTTP\u002FHTTPS request directly to the vulnerable endpoint, bypassing all authorization controls. The scope of impact extends beyond the vulnerable component itself, affecting the entire Adobe Campaign Classic system.\r\nImpact:\r\nA successful exploitation grants the attacker complete control over the Adobe Campaign Classic instance with administrative privileges. The attacker can access the underlying customer database, read sensitive customer records and campaign data, modify campaign configurations and targeting rules, execute arbitrary SQL commands, and potentially pivot to connected systems. The confidentiality, integrity, and availability of the entire system are compromised.\r\n\r\nCVE-2026-27302\r\n\r\nCritical authorization bypass vulnerability affecting Adobe Campaign Classic. Similar to CVE-2026-71398, it allows remote unauthenticated attackers to bypass authorization controls and execute arbitrary code. However, this vulnerability specifically affects campaign management and workflow orchestration functionality within the platform.\r\nAttack Vector:\r\nThis vulnerability is network-accessible and requires no authentication, credentials, or user interaction. An attacker can remotely exploit this flaw by sending crafted requests to the affected endpoint. The low complexity of exploitation makes this vulnerability particularly dangerous, as script-based attacks can be automated and deployed at scale.\r\nImpact:\r\nExploitation allows attackers to modify active marketing campaigns, alter customer segmentation rules, inject malicious logic into automated workflows, and redirect customer data to attacker-controlled infrastructure. An attacker could also disable or delete critical campaigns, disrupt customer communications, and compromise the integrity of all campaign-related data. The scope of the vulnerability extends beyond the direct component, affecting customer data flows and business operations.\r\n\r\nCVE-2026-48449\r\n\r\nCritical authorization vulnerability that was disclosed on July 29, 2026. Like the other authorization bypass flaws, it permits unauthenticated remote code execution within Adobe Campaign Classic. This vulnerability affects builds 7.4.3 and earlier, with a fix released in build 9398 on August 13, 2026.\r\nAttack Vector:\r\nThe vulnerability is accessible over the network without authentication or user interaction. The low complexity attack vector means that exploitation requires minimal technical skill and can be easily automated. Attackers can discover vulnerable instances through standard port scanning and web reconnaissance techniques.\r\nCritical Exposure Window:\r\nThis vulnerability created a significant security risk window of approximately two weeks between discovery (July 29) and intermediate patching (August 13). Organizations running Adobe Campaign Classic v7.4.3 build 9397 or earlier were exposed to unauthenticated remote code execution during this period. The final comprehensive patch was released as part of security update v7.4.4 build 9400 on August 11, 2026.\r\nImpact:\r\nSuccessful exploitation grants the attacker root or administrative-level access to the Adobe Campaign Classic instance. Attackers can steal customer lists and personal data, modify campaign content and delivery parameters, create backdoor accounts for persistent access, and disrupt campaign execution and delivery pipelines.\r\n\r\nCVE-2026-48381\r\n\r\nSQL injection vulnerability in Adobe Campaign Classic caused by inadequate input sanitization. User-controlled input is incorporated into SQL queries without proper escaping or parameterized query mechanisms. An attacker can inject malicious SQL code through specially crafted input, allowing arbitrary database manipulation and code execution within the database engine context.\r\nAttack Vector:\r\nThe vulnerability is exploitable over the network without authentication. However, it presents higher complexity compared to the authorization bypass flaws, requiring attackers to understand the application's database schema and SQL syntax to craft effective payloads. Despite this increased complexity, the attack is still feasible for attackers with moderate technical capabilities.\r\nRoot Cause:\r\nThe vulnerability arises from the application's failure to properly neutralize special characters and SQL metacharacters in user input before constructing dynamic SQL statements. Input validation and output encoding are insufficient, allowing attacker-controlled strings to alter the structure and logic of SQL queries.\r\nImpact:\r\nAn attacker exploiting this vulnerability can execute arbitrary SQL commands with the privileges of the Adobe Campaign Classic database user. This allows extraction of sensitive data including customer records, campaign data, configuration details, and authentication credentials from the database. The attacker can also modify or delete critical data, manipulate campaign logic, and potentially execute code within the database engine context (depending on database platform and permissions).\r\n\r\n\r\n\r\nPaths probed:\r\n\u002Fnl\u002Fjsp\u002Flogon.jsp — the console logon endpoint.\r\n\u002Fnl\u002F — the application root.\r\n\r\nMatchers (product detection — any one confirms ACC):\r\nSession cookies — NMSUID, NMSESSUID, NMSCOOKIE, AMCGLOBALID in response headers. Strongest signal: specific to the Neolane\u002FAdobe Campaign stack, issued pre-auth on first contact.\r\nLogin title — \"Adobe Campaign Classic login\" in the body. Confirms the Classic product line (vs Adobe-hosted Standard).\r\nSystem markers — \"Adobe Campaign System\" \u002F \"ACS (Adobe Campaign System)\" in the body. Backup confirmation when the title is customized or localized away.\r\n\r\nVersion extractors (opportunistic enrichment, not primary):\r\nX-Powered-By header — product\u002Fversion token.\r\nServer banner — primary and secondary product\u002Fversion tokens.\r\nX-Generator header — version string.\r\n\u003Cmeta name=\"generator\"> — version in HTML body.","2026-08-18T08:15:28.589698Z","Adobe",[22],"Adobe Campaign Classic",{"id":24,"title":25,"summary":26,"published_at":27,"severity":12,"vendor":28,"products":29},154,"NetScaler ADC & NetScaler Gateway - Pre-Auth Heap Overflow Leading to Full Remote Code Execution","NetScaler is an enterprise-grade application delivery controller (ADC) and gateway solution designed to optimize, secure, and load-balance web applications and remote desktop traffic.\r\n\r\nCVE-2026-8452\r\n\r\nThe critical vulnerability is a pre-authentication heap-based buffer overflow stemming from an XML normalization flaw during SAML authentication handling. By sending a maliciously crafted SAML request containing an oversized attribute, an unauthenticated remote attacker can corrupt the system's memory. This leads to a complete denial of service through the crash of the core packet processing engine or allows the attacker to bypass operating system protections to achieve remote code execution (RCE) with root privileges. \r\n\r\nSpecifically, the overflow occurs within the core packet processing engine (nsppe) when parsing the PrefixList attribute inside the \u003CInclusiveNamespaces> tag of a SAML assertion. While a crash typically triggers the pitboss watchdog process to restart the appliance, successful exploitation leverages precise heap grooming to overwrite function pointers, subverting memory mitigations and stabilizing code execution directly within the NetScaler kernel space.","2026-08-17T14:15:55.211970Z","Citrix",[30,31],"NetScaler ADC","NetScaler Gateway",{"id":33,"title":34,"summary":35,"published_at":36,"severity":12,"vendor":37,"products":38},153,"PeerTube — Unauthenticated Actor Rebinding to Playlist Takeover","PeerTube is an open-source, ActivityPub-federated video streaming platform that emphasizes decentralization and peer-to-peer content delivery. It is designed to be self-hosted, allowing communities and organizations to run their own video platforms with federation capabilities across the PeerTube network.\r\n\r\nGHSA-37jf-59fg-9hpr\r\n\r\nAn unauthenticated attacker on the public internet can craft a malicious ActivityPub Update activity claiming to be from any remote PeerTube account. The vulnerable instance will accept this activity and rebind the `url` field of the actor without verifying that the signing key actually belongs to the claimed actor. By exploiting this lack of verification, an attacker can redirect the actor's `url` to a controlled server, bypassing subsequent playlist update verification checks. This allows changing any playlist's metadata (name, public UUID) without authentication or authorization.\r\nThe attack is triggered by a remote ActivityPub Update activity sent to the vulnerable instance and requires only network connectivity to a PeerTube server. No credentials or prior access is needed.","2026-08-14T14:27:13.425049Z","",[39],"PeerTube",{"id":41,"title":42,"summary":43,"published_at":44,"severity":45,"vendor":46,"products":47},152,"Multiple vulnerabilities in n8n - Code Execution via Repo-Local Git Config & Path Traversal to RCE & JS Task Runner Sandbox Escape to RCE","n8n is an open-source, fair-code workflow automation platform that lets users connect apps, APIs, and services through a visual node-based editor to build automated workflows, with self-hosted and cloud deployment options.\r\n\r\nGHSA-m87g-qr43-ccvc — Code execution in the n8n Git node via unchecked repository-local git configuration\r\n\r\nThe n8n Git node executed certain values from a repository's local git configuration without neutralizing them. When such a value was present in a repository's configuration, any subsequent Git node operation against that repository ran it in the context of the n8n process user, resulting in remote code execution. The flaw was not reachable through the Git node's own configuration controls, which already restrict which keys can be set directly; exploitation therefore required a separate file-write vulnerability elsewhere to plant the malicious value first. Rated High (CVSS 7.7). Affected: \u003C 1.123.69, \u003C 2.33.4, \u003C 2.34.1. Note that the advisory text and metadata disagree on the exact fixed versions — align on the higher bounds (1.123.69 \u002F 2.33.4 \u002F 2.34.1) to be safe.\r\n\r\nGHSA-6h4x-896x-fw5m — RCE in the n8n main process via path traversal in MCP node-schema loading\r\n\r\nThe @n8n\u002Fworkflow-sdk node-schema loader built a node's schema module path directly from the attacker-supplied node-type string, without filtering path-traversal sequences. An authenticated user holding global:member privileges could reference arbitrary files through directory traversal, leading to code execution inside the n8n main process. This issue affects the 2.x branch only. Rated High (CVSS 8.7), the most severe of the three. Affected: \u003C 2.33.4, \u003C 2.34.1.\r\n\r\nGHSA-m3hg-p5r9-fg9h — JavaScript task runner VM sandbox escape via EventEmitter prototype pollution leading to RCE\r\n\r\nThe JavaScript task runner's prototype-freezing routine covered globalThis functions but missed internal module constructors such as EventEmitter. An authenticated user with Code node access could exploit this gap to run arbitrary commands inside the runner container. Because the polluted prototype is a single process-wide object, the corruption persisted across every other tenant's Code node execution subsequently scheduled on that shared runner (though not on the host). On v1.x instances that had not enabled task runners, Code node JavaScript executes directly in the main n8n process, where the impact of a comparable escape could be significantly higher. Rated High (CVSS 7.2). Affected: \u003C 1.123.69, \u003C 2.33.4, \u003C 2.34.1.","2026-08-12T09:00:17.505396Z",3,"n8n",[46],{"id":49,"title":50,"summary":51,"published_at":52,"severity":12,"vendor":37,"products":53},151,"WordPress ARVE Plugin — Hardcoded Backdoor Auth Bypass to Admin","Product Overview\r\n\r\nThe Advanced Responsive Video Embedder (ARVE) is a popular WordPress plugin designed to seamlessly embed videos from multiple hosting platforms—such as YouTube and Vimeo—making them fully responsive across all device screen sizes.\r\n\r\nCVE-2026-18072\r\n\r\nCritical supply-chain vulnerability discovered in version 10.8.7 of the ARVE plugin, where a malicious backdoor was introduced via a compromised developer account. The flaw intercepts global incoming HTTP requests through the WordPress init hook, allowing unauthenticated attackers to execute arbitrary code or gain full administrative control over the website by sending specific parameters.\r\n\r\nUnauthenticated Detection Method\r\n\r\nTo detect this plugin remotely without authentication, look for specific footprints left in the web application's public source code. The most reliable passive method involves checking the HTML source of pages for injected CSS\u002FJS assets or structural wrapper classes containing wp-content\u002Fplugins\u002Fadvanced-responsive-video-embedder or arve-embed-container. Active detection can also be achieved by directly querying the plugin's readme.txt file via automated scanners like Nuclei or cURL to extract the exact installed version.","2026-08-11T07:44:11.441917Z",[54],"advanced-responsive-video-embedder (WordPress plugin)",{"id":56,"title":57,"summary":58,"published_at":59,"severity":12,"vendor":60,"products":61},150,"Traefik Auth Middleware - Identity Header Spoofing via Underscore Variants","Traefik is a widely used open-source HTTP reverse proxy and load balancer that sits in front of web applications, routing incoming requests and often enforcing authentication before traffic reaches the backend. Its BasicAuth, DigestAuth, and ForwardAuth middlewares are meant to verify who a request is coming from and pass a trusted identity to the services behind it.\r\n\r\nCVE-2026-54763\r\n\r\n Authentication-spoofing flaw that lets an attacker forge the identity or authorization information Traefik passes to backend services. To protect against spoofing, Traefik's auth middlewares strip attacker-supplied identity headers before writing their own trusted value — but they only strip the standard dashed form of the header name and miss the underscore-variant spelling, which many backends treat as identical. An attacker who can reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend — either alongside, or on the unauthenticated ForwardAuth response path instead of, the value Traefik intended to set — allowing them to impersonate another user or elevate their authorization. Rooted in inconsistent handling of header-name casing and formatting (CWE-178, CWE-290, CWE-345), it can lead to unauthorized access to protected routes and backend data wherever Traefik is trusted as the identity gatekeeper. The issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6, which introduce a new underscoreHeadersStrategy configuration option to control how these headers are handled. As of disclosure on July 6, 2026, no public proof-of-concept or in-the-wild exploitation had been reported, though the fix is straightforward to reverse-engineer, so prompt upgrading is advised.\r\n\r\nDetection method: Detection targets the exposed Traefik dashboard by issuing a GET request to \u002Fdashboard\u002F — both on the base URL and on the common :8080 administrative port — while following redirects (since \u002Fdashboard without a trailing slash returns a 301). A match requires both the string Traefik in the response body and a 200 status code, deliberately relying on a version-independent marker rather than build-specific asset hashes (e.g. index-CbBpIoml.js), which change with every release and break detection on the next version. The check stops at the first matching path, keeping the probe lightweight and reliable across Traefik v2 and v3 deployments.","2026-08-10T14:41:17.513441Z","Traefik",[60],{"id":63,"title":64,"summary":65,"published_at":66,"severity":12,"vendor":67,"products":68},149,"Microsoft SharePoint Server - Unauthenticated Deserialization RCE","Microsoft SharePoint Server is an on-premises collaboration and document-management platform that runs on Windows Server and IIS.\r\n\r\nCVE-2026-50522\r\n\r\nCritical (CVSS 9.8) remote code execution flaw that lets an attacker run commands on a SharePoint server without any login or user interaction. The problem is a deserialization weakness (CWE-502): when SharePoint receives a crafted request at its sign-in endpoint, it trusts and rebuilds attacker-supplied data instead of rejecting it, which lets the attacker's code run on the server with the same high privileges as SharePoint itself. Disclosed in Microsoft's July 14, 2026 advisory and demonstrated at Pwn2Own Berlin, it came under active exploitation within hours of a public proof-of-concept on July 20, 2026, with attackers using it to steal the server's machine keys and keep long-term access — which led CISA to add it to its Known Exploited Vulnerabilities catalog. Because the fix is an internal change to how the server handles incoming data, a patched and an unpatched server look the same from the outside, so confirming whether a system is protected requires checking the farm directly rather than scanning it from the network. It affects on-premises SharePoint Server 2016, 2019, and Subscription Edition; SharePoint Online is not affected.","2026-08-10T09:32:36.044856Z","Microsoft",[69],"Microsoft SharePoint Server",{"id":71,"title":72,"summary":73,"published_at":74,"severity":45,"vendor":75,"products":76},148,"WordPress Login Page: Pre-Auth Reflected XSS Chainable to RCE","WHAT IT IS — CVE-2026-64638 is a High severity flaw (CVSS 8.9) on the WordPress login page, published on 6 August 2026 and affecting every version from 4.7 onwards. It lets an attacker run malicious code in the browser of someone visiting the login page, with no account and no prior access to the site. WHY IT HAPPENS — When a login attempt fails, WordPress cleans up the submitted username through two successive filters that interpret the same value differently, and that gap lets attacker-controlled content reach the page. IMPACT — Under specific additional conditions, the flaw can be extended to code execution on the server, giving an attacker full control of the site. WHAT EXPLOITATION REQUIRES — Three conditions must be true at once. (1) The login page must be reachable from the internet, so an interface restricted to an internal network, a VPN or an IP allowlist is out of scope. (2) The attacker must get an administrator to open a page they control, typically through a targeted email or message, while that administrator is already logged in to the site in the same browser; a link to the site alone is not enough. (3) The account targeted must be an Administrator, as lower privileges yield nothing useful. IN SHORT — This is a targeted social engineering scenario, not an attack that scales automatically across sites. HOW WE REPORT IT — A confirmed Qualified vulnerability means an affected version, a login interface exposed to the internet, and a positive response to the test we send to prove the flaw is reachable. A warning means the affected version is present but exploitation could not be demonstrated, either because no login interface is exposed or because the request is blocked upstream, as Cloudflare and Wordfence do by default; the flaw is still there and the block is a mitigating layer rather than a fix, so it needs attention, just with less urgency. RECOMMENDATION — Update to 7.0.3, 6.9.6 or 6.8.7 depending on the branch, or move straight to 7.0.3, keeping in mind automatic minor updates may already have applied the fix. Because the attack depends on an administrator clicking a malicious link, pair the update with user awareness: administrators should not follow links to the administration area received by email or messaging, and should close administrative sessions when not in use. Where operationally feasible, restricting login page access to trusted networks adds a durable layer of protection. ----- ⚠️ NOTE — Some of your assets may appear under \"Warning\" here while also being covered by a related qualified vulnerability. Exploitability has been verified across your entire attack surface, but this specific view does not display non-pentested assets as \"impacted\" — a limitation of how this menu is built, not a gap in coverage. Please refer to the \"Qualified vulnerability\" menu for the authoritative list of affected assets.","2026-08-07T17:12:04.208270Z","wordpress",[75],{"id":78,"title":79,"summary":80,"published_at":81,"severity":12,"vendor":82,"products":83},145,"WordPress Login Page — Pre-Auth Reflected XSS Chainable to RCE","WordPress is an open-source PHP\u002FMySQL content management system (CMS) powering roughly 41% of all websites, built around a theme-and-plugin architecture and a REST API for blogs, sites, and e-commerce.\r\n\r\nCVE-2026-64638\r\n\r\nPre-authentication reflected XSS on the WordPress login screen, patched in 7.0.3 on August 6, 2026 with backports through the 4.7 branch. It needs no privileges and no extra victim interaction for the XSS itself.\r\n\r\nThe root cause is a parser differential in WordPress's own sanitization pipeline: the failed-login username survives strip_tags() as inert text (a tag-like string with whitespace after the opening \u003C) but is later re-interpreted as valid HTML by wp_kses_post(), yielding attacker-controlled DOM on the login page. Those elements hijack core's user-profile.js (loaded there for password resets) by clobbering the undefined ajaxurl variable, steering a same-origin REST request, then abusing REST JSONP (with _envelope=1 to wrap 401s in an outer HTTP 200) to run JavaScript in the site's origin. A nonce-based CSP with strict-dynamic did not stop it.\r\n\r\nEscalation to PHP execution (pwn.ai's \"XSS2Shell\" chain, built on Yibelo's SOME technique) is conditional, not automatic: it requires a logged-in Administrator to click an attacker page, plus Application Passwords, the admin's unfiltered_html\u002Fupload_plugins capabilities, writable plugin storage, and a lack of hardening against PHP execution from inactive plugin directories. Disabling Application Passwords breaks that specific chain but not the underlying XSS — so updating to 7.0.3 (or the relevant backport) is the real fix. No in-the-wild exploitation was reported as of August 7.","2026-08-07T14:44:53.712668Z","Automattic",[84],"WordPress",{"id":86,"cve_id":87,"summary":88,"published":89,"cvss_data":90,"is_remote":111,"cwes":112,"cpes":114,"technologies":115,"references":116,"score":124,"epss_score":125,"epss_percentile":126,"is_kev":127,"cisa_kev_date_added":6,"cisa_kev_due_date":6,"cisa_ssvc":128,"exploits":134},380609,"CVE-2026-78061","A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib\u002Femail-sync\u002Fimap-client.ts of the component Email Sync. Executing a manipulation of the argument host\u002Fport can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.","2026-08-23T04:17:00Z",{"cvss_v2.0":91,"cvss_v3.1":99,"cvss_v4.0":106},{"version":92,"baseScore":93,"accessVector":94,"vectorString":95,"authentication":96,"integrityImpact":97,"accessComplexity":98,"availabilityImpact":97,"confidentialityImpact":97},"2.0",6.5,"NETWORK","AV:N\u002FAC:L\u002FAu:S\u002FC:P\u002FI:P\u002FA:P","SINGLE","PARTIAL","LOW",{"scope":100,"version":101,"baseScore":102,"attackVector":94,"baseSeverity":103,"vectorString":104,"integrityImpact":98,"userInteraction":105,"attackComplexity":98,"availabilityImpact":98,"privilegesRequired":98,"confidentialityImpact":98},"UNCHANGED","3.1",6.3,"MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L","NONE",{"Safety":107,"version":108,"Recovery":107,"baseScore":109,"Automatable":107,"attackVector":94,"baseSeverity":103,"valueDensity":107,"vectorString":110,"exploitMaturity":107,"providerUrgency":107,"userInteraction":105,"attackComplexity":98,"attackRequirements":105,"privilegesRequired":98,"subIntegrityImpact":105,"vulnIntegrityImpact":98,"integrityRequirement":107,"modifiedAttackVector":107,"subAvailabilityImpact":105,"vulnAvailabilityImpact":98,"availabilityRequirement":107,"modifiedUserInteraction":107,"modifiedAttackComplexity":107,"subConfidentialityImpact":105,"vulnConfidentialityImpact":98,"confidentialityRequirement":107,"modifiedAttackRequirements":107,"modifiedPrivilegesRequired":107,"modifiedSubIntegrityImpact":107,"modifiedVulnIntegrityImpact":107,"vulnerabilityResponseEffort":107,"modifiedSubAvailabilityImpact":107,"modifiedVulnAvailabilityImpact":107,"modifiedSubConfidentialityImpact":107,"modifiedVulnConfidentialityImpact":107},"NOT_DEFINED","4.0",5.3,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",true,[113],"CWE-918",[],[],[117,118,119,120,121,122,123],"https:\u002F\u002Fgithub.com\u002Fvas3k\u002FTaxHacker\u002F","https:\u002F\u002Fgithub.com\u002Fvas3k\u002FTaxHacker\u002Fissues\u002F148","https:\u002F\u002Fgithub.com\u002Fvas3k\u002FTaxHacker\u002Fpull\u002F170","https:\u002F\u002Fvuldb.com\u002Fcve\u002FCVE-2026-78061","https:\u002F\u002Fvuldb.com\u002Fsubmit\u002F881825","https:\u002F\u002Fvuldb.com\u002Fvuln\u002F394301","https:\u002F\u002Fvuldb.com\u002Fvuln\u002F394301\u002Fcti",0.47,0.00366,0.29829,false,{"timestamp":6,"automatable":129,"tech_impact":130,"exploitation":131,"cisa_decision":132,"cisa_remediation_timeline":133},"no","partial","none",{},"FSU",[],{"count":136,"next":137,"previous":6,"results":138},26,"http:\u002F\u002Fweb:8606\u002Fapi\u002Farticles\u002F?page=2&sorted_by=-published_at",[139,146,152,158,165,172,180,187,191,195],{"id":136,"title":140,"summary":141,"published_at":142,"type":143,"link":144,"image_url":145},"DGFiP Cyberattack 2026: Inside the Attacker","Two distinct attacks hit France","2026-08-17T00:00:00Z","hacks","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fdgfip-cyberattack-2026-inside-attacker-mind","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002Fdc38d33696-1787055371\u002Fdgfip-2026.png",{"id":147,"title":148,"summary":148,"published_at":149,"type":150,"link":151,"image_url":37},24,"CVE-2026-64638 : XSS2Shell, faille du login WordPress","2026-08-10T00:00:00Z","cve","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fcve-2026-64638-xss2shell-faille-login-wordpress",{"id":153,"title":154,"summary":155,"published_at":149,"type":150,"link":156,"image_url":157},25,"CVE-2026-64638: XSS2Shell, a WordPress Login Vulnerability","Pre-auth XSS on wp-login.php, patched August 6. What is actually exploitable, and how to read it in your Patrowl report.","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fxss2shell-critical-wordpress-login-vulnerability-2026","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F904e61748b-1786369212\u002Fxss2shell.png",{"id":159,"title":160,"summary":161,"published_at":162,"type":150,"link":163,"image_url":164},23,"How Agentic AI Hunts Down CVEs Before Attackers Do","38 vulnerability sources monitored around the clock, pentester-validated proof of exploitability, an alert within hours. See how it works.","2026-08-05T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fproactive-threat-hunting-agentic-ai-cve","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F804988ce7b-1785930160\u002Fproactive-threat-hunting-how-agentic-ai-tracks-cves.png",{"id":166,"title":167,"summary":168,"published_at":169,"type":143,"link":170,"image_url":171},22,"AI Agent Incident: OpenAI HuggingFace — Risks and Lessons","An autonomous AI agent escaped its sandbox via a JFrog Artifactory zero-day, compromised HuggingFace via privilege escalation and stolen credentials. Reconstructed timeline and security lessons.","2026-07-31T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fai-agent-incident-openai-huggingface-risks","[Image URL from Kirby]",{"id":173,"title":174,"summary":175,"published_at":176,"type":177,"link":178,"image_url":179},21,"SaaS Under Watch: What Your SDLC Doesn","Your pipeline is green. Your real exposure may have changed without you knowing it. The complete guide for software vendors.","2026-07-29T00:00:00Z","security tips","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fsecuring-saas-application-software-vendor","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F20d6ec0cd0-1785331401\u002Fapplication-security.png",{"id":181,"title":182,"summary":183,"published_at":184,"type":150,"link":185,"image_url":186},18,"Wp2shell: WordPress Security Flaws","Deep dive into wp2shell vulnerabilities (CVE-2026-63030 & CVE-2026-60137) in WordPress 7.0.2. Detection guide and fixes to secure your sites.","2026-07-20T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fwp2shell-critical-wordpress-vulnerabilities","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F97aa11e60b-1784565821\u002Fminiature-wp2shell.png",{"id":188,"title":182,"summary":189,"published_at":184,"type":150,"link":190,"image_url":186},19,"Deep dive into wp2shell vulnerabilities (CVE-2026-63030 & CVE-2026-60137) in WordPress. Detection guide and fixes to secure your sites.","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fwp2shell-critical-wordpress-vulnerabilities-copier",{"id":192,"title":182,"summary":189,"published_at":184,"type":150,"link":193,"image_url":194},20,"https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fwp2shell-critical-wordpress-vulnerabilities-2026","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F97aa11e60b-1784567602\u002Fminiature-wp2shell.png",{"id":196,"title":197,"summary":198,"published_at":199,"type":177,"link":200,"image_url":201},17,"SAST vs DAST vs IAST vs RASP: Which One Do You Need?","Four methods, four moments in the application risk cycle. Compare SAST, DAST, IAST and RASP — and see which one fits your stack, your team and your code access.","2026-07-13T00:00:00Z","https:\u002F\u002Fpatrowl.io\u002Fen\u002Fblog\u002Fsast-vs-dast-vs-iast-vs-rasp","https:\u002F\u002Fpatrowl.io\u002Fmedia\u002Fsite\u002F1d32e651a8-1784299758\u002Fsast-dast-iast-rasp.png"]