Emerging Threats

• Emerging Threats

Emerging Threat: (CVE-2026-57517) Control Web Panel Remote Code Execution via SQL Injection

A blind SQL injection in Control Web Panel’s userRes parameter lets attackers with a guessable username gain MySQL root access, enabling full server takeover via a planted PHP webshell.

• Emerging Threats

Emerging Threat: (CVE-2026-40138 & CVE-2026-40139) BeyondTrust Remote Support Authentication Bypass

Two pre-authentication vulnerabilities in BeyondTrust Remote Support and Privileged Remote Access let attackers bypass authentication entirely and gain unauthorized, potentially privileged, access to affected appliances.

• Emerging Threats

Emerging Threats: (CVE-2026-20896, CVE-2026-27771) Authentication Bypasses in Self-Hosted Gitea

Two Gitea vulnerabilities, a Docker default that lets any IP impersonate a user and a container registry flaw exposing private images, leave self-hosted instances open to unauthenticated attackers.

• Emerging Threats

Emerging Threat: (CVE-2026-55957) Apache Tomcat Authentication Bypass via JNDIRealm GSSAPI Binds

A missing authentication check in Apache Tomcat lets attackers bypass GSSAPI-bound directory logins, gaining unauthorized access to any application behind that Realm.

• Emerging Threats

Emerging Threat: (CVE-2026-27577) n8n Remote Code Execution via Workflow Expressions

A code injection flaw in n8n’s expression evaluation lets any authenticated user with workflow edit rights run arbitrary system commands on the host, enabling full server compromise.

• Emerging Threats

Emerging Threat: (CVE-2026-49975) Apache HTTP Server Denial of Service via HTTP/2 Memory Exhaustion

A memory-exhaustion flaw in Apache HTTP Server’s mod_http2 lets an unauthenticated attacker crash HTTP/2 web servers within seconds using a single crafted connection.

• Emerging Threats

Emerging Threat: (CVE-2026-53721) Nuxt Route-Rule Middleware Bypass via Case-Sensitivity Mismatch

A route-rule middleware bypass in Nuxt lets an unauthenticated attacker vary request path casing to slip past path-level controls, reaching routes that routeRules was assumed to protect.

• Emerging Threats

Emerging Threat: (CVE-2026-47368) UniFi OS Information Disclosure via Path Traversal

A path traversal flaw in Ubiquiti’s UniFi OS lets an unauthenticated attacker on the network read arbitrary files from affected gateways and controllers, exposing configuration files and sensitive data.

• Emerging Threats

Emerging Threat: (CVE-2026-44825) Apache Solr Administrative Takeover via Hardcoded Credentials

A hardcoded credentials flaw in Apache Solr’s Basic Authentication setup tool silently installs undocumented admin accounts with default passwords, giving remote attackers full control of affected SolrCloud clusters.

• Emerging Threats

Emerging Threats: (CVE-2026-8644, CVE-2026-9311, CVE-2026-9319) IBM WebSphere Application Server Identity Spoofing and RCE

IBM has disclosed three critical flaws in WebSphere Application Server 8.5 and 9.0, including identity spoofing and two remote code execution paths that let unauthenticated attackers impersonate users or run code.