The asset you didn’t pentest is the one attackers exploit. See 5 real attack chains 5 real attack chains

(CVE-2026-119618) Apache HTTP Server Remote Code Execution via mod_http2

9.8 | Critical November 12, 2026

A race condition in Apache HTTP Server's mod_http2 module lets an unauthenticated remote attacker corrupt heap memory, opening a path to remote code execution on the web server.

9.8 | Critical

(CVE-2026-88243) Windows DHCP Server Remote Code Execution via Out-of-Bounds Read

November 11, 2026 Research post

10.0 | Critical

(CVE-2026-89103) SAP Gateway Authentication Bypass via Default Access Control List

November 10, 2026 Research post

8.1 | High

(CVE-2026-123158) OpenSSH Password Authentication Bypass on musl Linux

November 9, 2026 Research post

9.2 | Critical

(CVE-2026-111497) .NET and ASP.NET Core Memory Corruption

October 28, 2026 Research post

9.2 | Critical

php2shell (CVE-2026-109618, 109619) Critical PHP Remote Code Execution

October 21, 2026 Research post

9.8 | Critical

(CVE-2026-108097) Drupal Core Field UI Remote Code Execution

October 21, 2026 Research post

10.0 | Critical

(CVE-2026-103849) Adobe Commerce Template Injection Remote Code Execution

October 14, 2026 Research post

9.9 | Critical

(CVE-2026-89110) SAP NetWeaver Visual Composer Broken Access Control

October 13, 2026 Research post

9.3 | Critical

(CVE-2026-107406) NetScaler ADC and Gateway Remote Code Execution via SAML

October 11, 2026 Research post

9.5 | Critical

(CVE-2026-107406) NetScaler ADC and Gateway Remote Code Execution via SAML

October 11, 2026 Research post

9.3 | Critical

(CVE-2026-21589) Atlassian Data Center Arbitrary File Access via Path Traversal

October 7, 2026 Research post

8.3 | High

(CVE-2026-94483) Next.js Server-Side Request Forgery via Image Optimization

October 5, 2026 Research post

9.8 | Critical

(CVE-2026-84411) MikroTik RouterOS Unauthenticated Root RCE via Web Management

October 4, 2026 Research post

8.7 | High

(CVE-2026-86858) ServiceNow AI Platform Unauthenticated Privilege Escalation via GraphQL

October 1, 2026 Research post

9.8 | Critical

(CVE-2026-94545) Next.js Remote Code Execution via ImageResponse SVG Injection

September 23, 2026 Research post

8.7 | High

(CVE-2026-69197) Umbraco CMS Protected Content Disclosure via Delivery API Expansion

September 22, 2026 Research post

9.8 | Critical

(CVE-2026-70756) Oracle WebLogic Server Takeover via T3 and IIOP

September 16, 2026 Research post

9.8 | Critical

(CVE-2026-76461) Cisco Secure Email Gateway Root RCE via Email Parsing

September 15, 2026 Research post

9.8 | Critical

(CVE-2026-78006) The Events Calendar Remote Code Execution via PHP Object Injection

September 14, 2026 Research post

10.0 | Critical

(CVE-2026-44756) SAP Remote Code Execution via Extended Passport Processing

September 10, 2026 Research post

7.5 | High

(CVE-2026-67281) MikroTik RouterOS Unauthenticated File Read via WebFig

September 7, 2026 Research post

8.1 | High

(CVE-2026-81891) elFinder Remote Code Execution via ZIP Extraction MIME Bypass

September 2, 2026 Research post

9.0 | Critical

(CVE-2026-75604) Next.js Remote Code Execution via Windows Path Traversal

August 31, 2026 Research post

8.6 | High

(CVE-2026-21580) Confluence Privilege Escalation via Unauthenticated Stored XSS

August 22, 2026 Research post

9.9 | Critical

(CVE-2026-60702) Oracle WebLogic Server Takeover via T3 and IIOP

August 19, 2026 Research post

GeoServer Zero-Day SQL Injection via jsonArrayContains

August 18, 2026 Research post

9.1 | Critical

(CVE-2026-19478) GitLab Unauthenticated Project Deletion via GraphQL Directive

August 18, 2026 Research post

8.8 | High

(CVE-2026-26035) FortiWeb Admin Authentication Bypass via RADIUS Admin Groups

August 13, 2026 Research post

9.1 | Critical

(CVE-2026-71362) Adobe Commerce Account Takeover via Session Identity Flaw

August 13, 2026 Research post

7.5 | High

(CVE-2026-72766) n8n Arbitrary File Read and SSRF via Send Email Node

August 12, 2026 Research post

8.6 | High

(CVE-2026-20349) Cisco ASA and FTD Denial of Service via Remote Access SSL VPN

August 12, 2026 Research post

9.8 | Critical

(CVE-2026-10579) JBoss EAP Authentication Bypass via PicketLink SAML

August 12, 2026 Research post

9.8 | Critical

(CVE-2026-34265) SAP NetWeaver ABAP Memory Corruption via DIAG Protocol Parsing

August 11, 2026 Research post

9.4 | Critical

(CVE-2026-58048) cPanel & WHM Database Privilege Escalation via Database Rename

August 9, 2026 Research post

9.8 | Critical

(CVE-2026-60004) Gitea Remote Code Execution via diffpatch Git Hooks

July 30, 2026 Research post

9.3 | Critical

(July 2026 Release) Apache Traffic Server Denial of Service and Access Control Bypass

July 30, 2026 Research post

(CVE-2026-6949) Samba DNS Server Crash via TSIG Name Compression

July 30, 2026 Research post

9.8 | Critical

(CVE-2026-14512, CVE-2026-14446) IBM WebSphere Application Server Unauthenticated Code Execution and Privilege Escalation

July 29, 2026 Research post

8.1 | High

(CVE-2026-10818) WPForms Pro Arbitrary File Upload Leading to Remote Code Execution

July 27, 2026 Research post

10.0 | Critical

(CVE-2026-60358) Oracle Access Manager Takeover via Authentication Engine

July 27, 2026 Research post

9.9 | Critical

Oracle WebLogic Server Multiple Critical RCE Vulnerabilities (July 2026 CPU)

July 22, 2026 Research post

10.0 | Critical

(CVE-2026-54159) PrestaShop Remote Code Execution via ps_facetedsearch Object Injection

July 21, 2026 Research post

9.8 | Critical

(CVE-2026-63030, CVE-2026-60137) WordPress Core Unauthenticated RCE via wp2shell

July 19, 2026 Research post

5.3 | Medium

(CVE-2026-56164) SharePoint Server Privilege Escalation via Missing Authentication

July 15, 2026 Research post

9.8 | Critical

(CVE-2026-56291) Balbooa Forms Remote Code Execution via Unauthenticated File Upload

July 12, 2026 Research post

9.8 | Critical

(CVE-2026-57517) Control Web Panel Remote Code Execution via SQL Injection

July 8, 2026 Research post

9.8 | Critical

(CVE-2026-40138 & CVE-2026-40139) BeyondTrust Remote Support Authentication Bypass

July 8, 2026 Research post

9.8 | Critical

Emerging Threats: (CVE-2026-20896, CVE-2026-27771) Authentication Bypasses in Self-Hosted Gitea

July 8, 2026 Research post

7.3 | High

(CVE-2026-55957) Apache Tomcat Authentication Bypass via JNDIRealm GSSAPI Binds

July 1, 2026 Research post

9.9 | Critical

(CVE-2026-27577) n8n Remote Code Execution via Workflow Expressions

June 16, 2026 Research post

7.5 | High

(CVE-2026-49975) Apache HTTP Server Denial of Service via HTTP/2 Memory Exhaustion

June 15, 2026 Research post

8.2 | High

(CVE-2026-53721) Nuxt Route-Rule Middleware Bypass via Case-Sensitivity Mismatch

June 15, 2026 Research post

8.6 | High

(CVE-2026-47368) UniFi OS Information Disclosure via Path Traversal

June 15, 2026 Research post

9.8 | Critical

(CVE-2026-44825) Apache Solr Administrative Takeover via Hardcoded Credentials

June 7, 2026 Research post

9.1 | Critical

Emerging Threats: (CVE-2026-8644, CVE-2026-9311, CVE-2026-9319) IBM WebSphere Application Server Identity Spoofing and RCE

June 3, 2026 Research post

9.1 | Critical

(CVE-2026-0257) PAN-OS GlobalProtect Authentication Bypass via Forged Override Cookies

June 1, 2026 Research post

8.1 | High

(CVE-2026-9256) NGINX Heap Buffer Overflow via Rewrite Module

May 27, 2026 Research post

9.8 | Critical

(CVE-2026-48172) LiteSpeed cPanel Plugin Privilege Escalation to Root

May 27, 2026 Research post

6.5 | Medium

(CVE-2026-9082) Drupal Core SQL Injection on PostgreSQL

May 24, 2026 Research post

10.0 | Critical

(CVE-2026-20182) Cisco Catalyst SD-WAN Authentication Bypass

May 20, 2026 Research post

8.1 | High

(CVE-2026-42945) NGINX Rift Heap Overflow in Rewrite Module

May 20, 2026 Research post

8.1 | High

(CVE-2026-42897) Microsoft Exchange OWA Cross-Site Scripting via Crafted Email

May 20, 2026 Research post

9.8 | Critical

(CVE-2026-45185) Exim Remote Code Execution via BDAT over GnuTLS

May 13, 2026 Research post

7.2 | High

CVE-2026-6973, Authenticated Admin RCE in Ivanti Endpoint Manager Mobile

May 13, 2026 Research post

9.8 | Critical

(CVE-2026-41940) cPanel & WHM Authentication Bypass via CRLF Injection

May 3, 2026 Research post

9.8 | Critical

(CVE-2026-3844) WordPress Breeze Cache Plugin Unauthenticated File Upload

April 29, 2026 Research post

8.8 | High

(CVE-2026-3854) GitHub Enterprise Server RCE via Git Push Injection

April 29, 2026 Research post

9.9 | Critical

(CVE-2026-20147) Cisco ISE Remote Code Execution

April 23, 2026 Research post

9.1 | Critical

(CVE-2026-40372) ASP.NET Core Privilege Escalation via Signature Bypass

April 23, 2026 Research post

9.1 | Critical

(CVE-2026-29145) Apache Tomcat Authentication Bypass

April 20, 2026 Research post

7.5 | High

(CVE-2026-23869) React Server Components Denial of Service

April 15, 2026 Research post

9.8 | Critical

(CVE-2026-1281 & CVE-2026-1340) Ivanti EPMM Unauthenticated RCE via Code Injection

April 9, 2026 Research post

8.8 | High

(CVE-2026-34197) Apache ActiveMQ Remote Code Execution via Jolokia API

April 9, 2026 Research post

9.8 | Critical

(CVE-2026-0740) Ninja Forms File Upload Unauthenticated RCE

April 7, 2026 Research post

9.8 | Critical

(CVE-2026-35616) Fortinet FortiClient EMS Improper Access Control

April 7, 2026 Research post

9.8 | Critical

(CVE-2026-20093) Cisco IMC Authentication Bypass

April 5, 2026 Research post

9.1 | Critical

(CVE-2026-27876) Grafana Remote Code Execution via SQL Expressions

April 5, 2026 Research post

Axios npm Supply Chain Attack Drops Remote Access Trojan (RAT)

March 31, 2026 Research post

9.8 | Critical

F5 BIG-IP Access Policy Manager Remote Code Execution (CVE-2025-53521)

March 30, 2026 Research post

9.3 | Critical

Citrix NetScaler ADC and Gateway Vulnerabilities (CVE-2026-3055 & CVE-2026-4368)

March 26, 2026 Research post

10.0 | Critical

Ubiquiti UniFi Network Application Path Traversal (CVE-2026-22557)

March 22, 2026 Research post

9.8 | Critical

GNU Inetutils telnetd LINEMODE SLC Buffer Overflow (CVE-2026-32746)

March 19, 2026 Research post

9.8 | Critical

HPE Aruba AOS-CX Pre-Auth RCE (CVE-2026-23813 / CVE-2026-23814)

March 15, 2026 Research post

8.8 | High

Microsoft SQL Server Elevation of Privilege Vulnerability (CVE-2026-21262)

March 12, 2026 Research post

10.0 | Critical

Cisco Secure Firewall Management Center Root Compromise (CVE-2026-20079, CVE-2026-20131)

March 8, 2026 Research post

10.0 | Critical

Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127)

February 26, 2026 Research post

10.0 | Critical

Emerging Threat – Dell RecoverPoint for VMs Hardcoded Credential (CVE-2026-22769)

February 24, 2026 Research post

9.8 | Critical

CVE-2026-1731 – BeyondTrust Privileged Access Exposure Risk

February 15, 2026 Research post

9.8 | Critical

CVE-2026-24858 – FortiCloud SSO Authentication Bypass

February 2, 2026 Research post

8.8 | High

CVE-2025-15467 – OpenSSL CMS AuthEnvelopedData Stack-Based Buffer Overflow

January 31, 2026 Research post

9.8 | Critical

CVE-2026-24061 – Telnet Authentication Bypass in GNU Inetutils

January 28, 2026 Research post

10.0 | Critical

CVE-2026-21858, CVE-2025-68613 & CVE-2026-21877 – n8n Workflow Automation Vulnerabilities

January 14, 2026 Research post

10.0 | Critical

CVE-2025-37164 – Critical Unauthenticated Remote Code Execution in HPE OneView

January 14, 2026 Research post

9.8 | Critical

CVE-2025-14733 – Authentication Bypass Vulnerability

December 29, 2025 Research post

10.0 | Critical

CVE-2025-55182 (React2Shell) – React Server Components RCE Vulnerability

December 4, 2025 Research post

10.0 | Critical

CVE-2025-41115 – Critical SCIM Privilege Escalation in Grafana Enterprise

November 24, 2025 Research post