Emerging Threats

• Emerging Threats

Emerging Threat: (CVE-2026-29145) Apache Tomcat Authentication Bypass

An authentication bypass vulnerability in Apache Tomcat and Tomcat Native can allow unauthorized access to CLIENT_CERT-protected resources when OCSP soft-fail is disabled, bypassing the mutual TLS access control that the certificate validation policy was intended to enforce.

• Emerging Threats

Emerging Threat: (CVE-2026-23869) React Server Components Denial of Service

A denial of service vulnerability in React Server Components allows an unauthenticated remote attacker to send a specially crafted HTTP request that triggers excessive CPU consumption.

• Emerging Threats

Emerging Threat: (CVE-2026-1281 & CVE-2026-1340) Ivanti EPMM Unauthenticated RCE via Code Injection

Two critical pre-authentication code injection flaws in Ivanti EMM, exploited as zero-days since before their disclosure.

• Emerging Threats

Emerging Threat: (CVE-2026-34197) Apache ActiveMQ Remote Code Execution via Jolokia API

A remote code execution vulnerability in Apache ActiveMQ Classic’s Jolokia JMX-HTTP bridge allows an authenticated attacker to load a malicious Spring XML configuration and execute arbitrary commands.

• Emerging Threats

Emerging Threat: (CVE-2026-0740) Ninja Forms File Upload Unauthenticated RCE

A critical unauthenticated arbitrary file upload flaw in the Ninja Forms – File Uploads WordPress plugin allows attackers to bypass extension validation and upload PHP webshells, enabling full remote code execution on the underlying web server.

• Emerging Threats

Emerging Threat: (CVE-2026-35616) Fortinet FortiClient EMS Improper Access Control

A critical improper access control flaw in Fortinet FortiClient EMS allows unauthenticated attackers to bypass API authentication and execute unauthorized code or commands on the management server, with active exploitation observed in the wild.

• Emerging Threats

Emerging Threat: (CVE-2026-20093) Cisco IMC Authentication Bypass

An authentication bypass in the Cisco Integrated Management Controller allows an unauthenticated remote attacker to reset any user’s password via a single crafted HTTP request, granting full administrative control over the server hardware below the operating system layer.

• Emerging Threats

Emerging Threat: (CVE-2026-27876) Grafana Remote Code Execution via SQL Expressions

A critical arbitrary file write vulnerability in Grafana’s SQL expressions feature can be chained with a Grafana Enterprise plugin to achieve full remote code execution on the underlying host.

• Emerging Threats

Emerging Threat: Axios npm Supply Chain Attack Drops Remote Access Trojan (RAT)

Two malicious axios releases published to npm delivered a RAT dropper that executes silently at install time. Source code, cloud credentials, SSH keys, and pipeline secrets on affected systems should be considered exposed.

• Emerging Threats

Emerging Threat: F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)

A critical unauthenticated remote code execution vulnerability in F5’s BIG-IP Access Policy Manager allows attackers to execute arbitrary code on internet-facing appliances without any credentials or user interaction. Organizations running affected BIG-IP APM versions that have not yet patched, should treat their systems as potentially compromised.