Lab Information

A severe Dokploy OS command injection vulnerability threatens self-hosted Platform as a Service (PaaS) environments. Tracked in vulnerability note VU#280377 and assigned CVE-2026-72878, this criti…

CWE-78: Improper Neutralization of Special Elements used in an OS Command CVSS 3.1: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The alert never fired. The antivirus console stayed green. And yet, somewhere in a 300-line config file, a single word had changed.

TL;DR Security researchers published technical details and a functional exploit for a critical D-Link DAP-1360 vulnerability. Tracked as CVE-2026-95675, this flaw allows unauthenticated attackers …

Welcome to the ELTE OffSec Series. In this series, I will walk you through machines prepared by the ELTE Faculty of Informatics, covering…

Welcome to the ELTE OffSec Series. In this series, I will walk you through machines prepared by the ELTE Faculty of Informatics, covering…

TL;DR On September 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory detailing multiple Eufy robot vacuum vulnerabilities. These critical security flaws e…

TL;DR watchTowr has published a technical analysis and a public proof-of-concept for CVE-2026-88771, a Citrix NetScaler flaw already exploited in the wild as a zero-day. The pre-authentication com…

A single crafted email can give attackers a shell on an unpatched Zimbra mail server. Microsoft Threat Intelligence has now mapped how attackers exploit Zimbra CVE-2026-73570 in the wild. Accordin…

TL;DR Attackers are exploiting a MediaWiki RCE flaw tracked as CVE-2026-100382. This CVSS 10 unauthenticated RCE sits in the popular External Data extension. Details and a proof-of-concept are pub…

TL;DR Digi International disclosed CVE-2026-75937, a critical Digi DAL OS vulnerability scored 9.4 on CVSS 4.0. One crafted HTTP POST to the web admin interface can run commands as root. Digi has …

TL;DR Progress has fixed CVE-2026-91140, a critical Progress DataDirect vulnerability in its Autonomous REST Connector AI Model Generator agents. A crafted OpenAPI or Swagger file could run comman…

Difficulty: medium

TL;DR CERT/CC and maintainers at mogh.tech disclosed CVE-2026-110005, a critical OS command injection flaw in the Komodo Periphery agent. The Komodo Periphery vulnerability carries a CVSS 3.1 base…

TL;DR Threat actors are actively exploiting CVE-2026-110447, a critical OS command injection flaw in the Nextcloud Collabora Online Built-in CODE Server app (richdocumentscode). Rated 9.2 on the C…

TL;DR SonicWall released security updates to fix two high-severity flaws in SonicWall NSM On-Prem deployments. Tracked as CVE-2026-96540 (CVSS 8.8) and CVE-2026-100232 (CVSS 7.2), these SonicWall …

Documenting what I learned about Windows CMD while exploring TryHackMe.

TL;DR On October 20, 2026, Apache disclosed six Apache CouchDB vulnerabilities, led by a CVSS 9.3 command execution flaw. CouchDB 3.5.3 fixes all of them. Apache also published four flaws in the r…

TL;DR On October 22, 2026, CISA published advisory ICSA-26-295-01 covering nine Kiloview E3 vulnerabilities in the company’s NDI video encoder. Two command injection flaws score CVSS 9.9 and…