Cisco published CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager. Landon Rice at VulnCheck showed that a single percent-encoded POST to /%6a_security_check plus a reserved Viptela username mints an admin JSESSIONID, because getRequestURI()…
oxfemale
October 14, 2026
25 min read
197 
AnyDesk233 AnyPwn is a pre-approval remote code execution bug in AnyDesk Linux 8.0.2. The session protocol's mode-5 handler trusts a remote payload length,…
kernel774 Aftermath Labs statically recover 815 of 865 Tencent-VM virtualized functions across four ACE kernel drivers (94.2 percent). Architecture, CET RDSSPQ/INCSSPQ, phantom SEH…
AI Agents549 Eddie Zhang / Project Black: Claude refuses an LSASS dumper; DeepSeek builds one EDR still catches; uncensored Qwen 3.8 27B on two…
RCE354 Mobeta patch-diff of VMSA-2026-0006: vCenter 8.0.3 syslog dynafile traversal (CVE-2026-59310) and SASL SRP A=N auth bypass (CVE-2026-59309), both pre-auth 9.8. Templates, Ghidra,…
RCE412 CVE-2026-65660 SharePoint EditingPageParser bypass via RegisterDirective.GetHtml quote rewrite, XamlServices memshell, and ToolPane on AddGallery.aspx for pre-auth RCE when anonymous view is on.…
kernel591 Connor McGarr on ETW’s undocumented SecurityTrace bit: QUERY wants Antimalware-PPL, STOP does not, and a user-mode ControlTrace hook lets admin consume Threat-Intelligence…
AI Agents469 Adam Chester’s SpecterOps research on disposable Mythic agents: from a vibe-coded abomination to a two-hour Oracle harness that one-shots stage-0 implants in…
kernel727 Asim Manizada’s four Linux LPEs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill. Decade-old bugs, userns for three, DiagSpill needs only SCTP. Patch 5.10.270 / 6.6.157…
Exploit Development660 Gen Threat Labs: CVE-2026-51990 one-click RCE in Sogou IME — sgbiz: argument injection, skincenter CEF, Chromium 80 unsandboxed. UNC3569 dropped GRAYRABBIT in…
Exploit Development1k Pruva REPRO-2026-00354: CVE-2026-85706 unauthenticated GitLab file read via commits.json defeating Workhorse, file.path sink, %zz echo, Files API trailing-slash variant. CVSS 10.0. Patch…
Exploit Development521 Jonathan Johnson’s first public RE of WESP on Insider 29661: wesp.sys + espclient.dll, EspFilterPort, WESP://Permission and AM-PPL, process-create queues, a working consumer…
Exploit Development719 QED’s CVE-2026-19174: three constants overflow in V8’s wasm deserializer, 102.4 MiB instead of 921.6, overlapping RWX JIT, renderer RCE without a heap-sandbox…
