A CVSS 8.7 TP-Link router command injection flaw allows unauthenticated remote code execution. Patch CVE-2026-11834 to stop this DHCP option vulnerability.

When there’s no file to read and no time delay to measure: proving Remote Code Execution using Burp Collaborator and DNS callbacks.

Internal Application Compromise: SQL Injection, Command Injection, and KeePass-Based Privilege Escalation in a Full Attack Chain.

TL;DR Attackers began exploiting the Kemp LoadMaster RCE vulnerability, tracked as CVE-2026-8037, on June 29, 2026. That timing matched the public release of proof-of-concept exploit code. The fla…

TL;DR CISA published an advisory for five StoneFly Storage Concentrator vulnerabilities on 30 June 2026. Two rate a maximum CVSS score of 10.0. Both let an unauthenticated attacker run commands as…

TL;DR IBM disclosed a critical CVSS 9.8 flaw, tracked as CVE-2026-12943, in its Power Hardware Management Console (HMC). This IBM Power HMC vulnerability allows unauthenticated attackers to run ar…

TL;DR BMC disclosed a critical flaw in Control-M/Server tracked as CVE-2026-10539. The Control-M command injection bug scores 9.5 on CVSSv4. It lets an unauthenticated attacker run commands on the…

Ubiquiti released a UniFi security advisory, Bulletin 066. It fixes 25 flaws in UniFi products. One bug in the UniFi Connect app scores a top mark of 10.0. Several more are critical. They allow co…

A remote code execution flaw affects Network UPS Tools, the widely used NUT monitoring suite. The bug, CVE-2026-54161, carries a CVSS score of 8.1. It can run commands as root on the monitoring ho…

TL;DR Mitel published two advisories. The first covers a MiCollab command injection bug rated critical at CVSS 9.8, which an unauthenticated attacker can reach over the network. The second covers …

TL;DR: TP-Link patched a TP-Link command injection flaw in the Archer AXE75 V1 router. Tracked as CVE-2026-9044, it carries a CVSS v4.0 score of 8.5. Firmware 1.5.6 Build 20260623 fixes the issue.…

TL;DR Cisco patched seven Cisco IOS XE vulnerability issues in an August 2026 hardening release. Two are Critical, led by CVE-2026-20272 at CVSS 9.8. Cisco found them internally and reports no act…

Author: Nilanjan Chowdhury

A beginner-friendly walkthrough covering web enumeration, command injection, internal service discovery, credential leakage, and privilege…

⚠️ Lab Setup : Everything below was done in a controlled local lab using DVWA (Damn Vulnerable Web Application) for practice and…

TL;DR Two critical Puwell IP Camera vulnerabilities now have public details and proof-of-concept exploit code. Both score 9.3 on the CVSS scale. Together they let a remote attacker bypass login an…

TL;DR Dell patched two critical flaws in Virtual Storage Integrator (VSI) for VMware vSphere Client. The worst, CVE-2026-67261, allows unauthenticated remote code execution as root, scoring CVSS 9…

TL;DR TP-Link disclosed five vulnerabilities across its ISP-managed networking gear. The flaws hit mesh systems, routers, PON devices, and xDSL modems. The worst allow authentication bypass and co…