TL;DR CISA published ICS advisory ICSA-26-204-01 on July 23, 2026. It covers three flaws in Johnson Controls C-CURE 9000 and victor application servers. The most severe C-CURE 9000 vulnerability, …

TL;DR Ruby on Rails has patched a critical Rails Active Storage flaw. Tracked as CVE-2026-66066 and rated 9.5 CVSS, it lets an unauthenticated attacker read arbitrary files from the server. Stolen…

TL;DR: A public proof-of-concept now targets CVE-2026-66373, a Redis RCE flaw in the RESTORE command. The double-free bug lets an authenticated attacker corrupt memory and run code. Redis fixed it…

TL;DR: A public proof-of-concept now targets CVE-2026-42530, an NGINX HTTP/3 RCE flaw rated CVSS 9.2. The use-after-free sits in the QPACK code of the HTTP/3 module. F5 fixed it in NGINX Open Sour…

TL;DR IBM disclosed four IBM WebSphere vulnerabilities in late July 2026. Two of them, CVE-2026-14512 and CVE-2026-14446, each score 9.8 CVSS. A new server-side request forgery flaw, CVE-2026-1452…

TL;DR: Researchers at depthfirst released a working proof-of-concept for a GitLab RCE that runs commands as the git user. The chain abuses two memory corruption bugs in Oj, a native Ruby JSON pars…

TL;DR: The CodeIgniter4 team patched four security flaws in release v4.7.4. The most severe, a CodeIgniter4 RCE vulnerability tracked as CVE-2026-63223, scores CVSS 9.8. It can lead to remote code…

TL;DR OpenAM 16.1.2 patches four security flaws in the open-source access management server. Three of these OpenAM vulnerabilities lead to remote code execution. The worst, CVE-2026-62379, allows …

From spotting an exposed developer portal to bypassing authentication with a single path trick.

TL;DR: A critical Rails Active Storage RCE flaw, CVE-2026-66066 (CVSS 9.5), lets an unauthenticated attacker read server files and potentially run code through crafted image uploads. A public Meta…

Link : https://tryhackme.com/room/hh-beachbar-d849f7f7 Difficulty : Easy

TL;DR Gitea 1.27.1 patches a critical Gitea vulnerability, CVE-2026-59774, rated CVSS 9.8. An unauthenticated attacker can read arbitrary server files through a public repository, then escalate to…

TL;DR Veeam patched a maximum-severity Veeam ONE vulnerability. CVE-2026-64633 allows remote unauthenticated code execution and scores a perfect CVSS 10.0. Admins should update to build 13.1.0.703…

TL;DR Veeam patched four flaws in Veeam Service Provider Console. Two are critical. One is an unauthenticated credential-theft bug rated CVSS 9.5. The other is an arbitrary file write that enables…

TL;DR: The pgAdmin Development Team patched a pgAdmin 4 RCE flaw tracked as CVE-2026-17566, rated CVSS 9.4. Version 9.17 also fixes a credential-cloning bug and an AI Assistant bypass, alongside f…

TL;DR The Django team shipped security releases 6.0.8 and 5.2.17 on August 4, 2026. They fix four flaws, led by a high-severity Django vulnerability, CVE-2026-15307. In some setups, it can enable …

TL;DR A researcher found six SGLang vulnerabilities, and the worst allow unauthenticated remote code execution. SGLang serves large language models such as DeepSeek and Qwen. CERT/CC published the…

TL;DR CVE-2026-63077 is a critical unauthenticated remote code execution flaw in JetBrains TeamCity. An attacker who reaches the server can run OS commands without credentials. CISA confirmed the …

TL;DR SAP released its August 2026 Patch Day on August 11, with 28 new security notes. The headline flaw, CVE-2026-58231, scores a maximum CVSS 10.0. Several critical code injection bugs also enab…