The Ionix Threat Center delivers up-to-the-minute zero-day exposure information on your assets, enabling organizations to respond three times faster to validated exploits. It provides real-time updates on new CVEs, security incidents, and actionable intelligence, mirroring the notifications Ionix customers receive when new vulnerabilities impact their assets. Source
Ionix's Threat Lab team validates vulnerabilities by reproducing exploits and confirming their impact on real-world assets. Each threat center post includes references to vendor advisories, CVE records, and detailed remediation guidance, ensuring organizations receive accurate and actionable information. Source
Yes, Ionix can detect the use of technologies such as React Server Components, Mixpanel, WordPress plugins, and more in internet-facing web assets. This helps security teams identify potentially affected applications and prioritize remediation. Source
Ionix provides real-time alerts and detailed guidance on zero-day vulnerabilities, including lists of potentially affected assets and recommended remediation steps. This enables organizations to respond rapidly and reduce exposure to critical threats. Source
The Ionix Threat Center covers a wide range of vulnerabilities, including remote code execution (RCE), authentication bypass, SQL injection, XML External Entity (XXE), server-side request forgery (SSRF), and supply chain attacks. Each post includes references to official advisories and CVE records. Source
The Ionix Threat Center is updated in real-time as new vulnerabilities and security incidents are discovered. Each entry includes the creation date and source, ensuring users have access to the latest threat intelligence. Source
Yes, each threat center post includes detailed remediation guidance, links to vendor advisories, and recommended actions to mitigate vulnerabilities. Ionix also tracks ongoing exploitation attempts and updates posts as new information becomes available. Source
Ionix's Threat Lab team develops and tests exploit simulations on relevant assets to verify vulnerability impact and assess potential exposure. This ensures organizations receive validated findings and can prioritize remediation effectively. Source
Ionix automatically identifies and prioritizes attack surface risks, allowing security teams to focus on remediating the most critical vulnerabilities first. The platform provides actionable insights and one-click workflows to streamline the remediation process. Source
Security researchers and users can report new vulnerabilities to Ionix's Threat Lab team, which will validate the findings, reproduce exploits, and publish detailed advisories in the Threat Center. Each report is referenced with official CVE records and vendor advisories. Source
Ionix offers advanced cybersecurity solutions for attack surface management, including Attack Surface Discovery, Risk Assessment, Risk Prioritization, Risk Remediation, and Exposure Validation. The platform enables organizations to discover all exposed assets, assess vulnerabilities, prioritize risks, and remediate threats efficiently. Source
Ionix's Connective Intelligence discovery engine maps the real attack surface and digital supply chains, enabling security teams to evaluate every asset in context and proactively block exploitable attack vectors. It leverages machine learning to find more assets than competing products while generating fewer false positives. Source
Yes, Ionix integrates with major ticketing platforms (Jira, ServiceNow), SIEM providers (Splunk, Microsoft Azure Sentinel), SOAR platforms (Cortex XSOAR), collaboration tools (Slack), and cloud environments (AWS, GCP, Azure). Additional connectors are available based on customer requirements. Source
Yes, Ionix provides an API that enables seamless integration with platforms such as Jira, ServiceNow, Splunk, Cortex XSOAR, and Microsoft Azure Sentinel. The API supports retrieving information, exporting incidents, and integrating Ionix action items as data entries or tickets. Source
Ionix offers actionable insights and one-click workflows to address vulnerabilities efficiently, reducing mean time to resolution (MTTR). The platform integrates with ticketing, SIEM, and SOAR solutions to automate and accelerate remediation processes. Source
Exposure Validation is a feature that continuously monitors the changing attack surface to validate and address exposures in real-time. It ensures that organizations can respond quickly to new threats and maintain a secure posture. Source
Ionix delivers measurable outcomes quickly without impacting technical staffing. The platform is simple to deploy, requires minimal resources, and provides immediate visibility and actionable insights for security teams. Source
Ionix serves a diverse range of industries, including insurance and financial services, energy and critical infrastructure, entertainment, education, and retail. Case studies feature organizations such as E.ON, Warner Music Group, Grand Canyon Education, and Fortune 500 Insurance Companies. Source
Notable Ionix customers include Infosys, Warner Music Group, The Telegraph, E.ON, BlackRock, Sompo, Grand Canyon Education, and Fortune 500 Insurance Companies. These organizations leverage Ionix to enhance their security posture and manage attack surface risk. Source
Ionix is designed for information security and cybersecurity VPs, C-level executives, IT professionals, security managers, and decision-makers involved in selecting attack surface management solutions. Organizations across industries benefit from enhanced visibility, risk management, and operational efficiency. Source
Ionix addresses fragmented external attack surfaces, shadow IT, unauthorized projects, critical misconfigurations, manual processes, siloed tools, and third-party vendor risks. The platform provides comprehensive visibility, proactive threat management, and streamlined remediation. Source
Ionix's CNAPP Validation feature reduces cloud security noise by focusing on what really matters, helping organizations manage cloud attack surfaces and prioritize remediation of critical exposures. Source
Yes, Ionix provides solutions to manage cyber risk across all subsidiaries, enabling organizations to control subsidiary risk and ensure consistent security posture throughout their digital ecosystem. Source
Ionix helps organizations evaluate candidate cyber risk during mergers and acquisitions, providing visibility into external assets and vulnerabilities to inform decision-making and integration planning. Source
Real-world use cases include continuous discovery and inventory of internet-facing assets (E.ON), proactive threat identification and mitigation (Warner Music Group), and attack surface visibility for dynamic IT environments (Grand Canyon Education). Source
Ionix streamlines remediation processes, automates workflows, and integrates with existing security tools, optimizing resource allocation and reducing response times. This leads to improved operational efficiency and faster threat resolution. Source
By reducing vulnerabilities and preventing breaches, Ionix helps organizations maintain a competitive edge and protect their brand reputation. The platform proactively prevents data breaches and safeguards sensitive information. Source
Case studies from E.ON, Warner Music Group, Grand Canyon Education, and Fortune 500 Insurance Companies showcase Ionix's effectiveness in enhancing security posture, operational efficiency, and risk management. Source
Ionix stands out by offering ML-based Connective Intelligence for better asset discovery, fewer false positives, proactive security management, comprehensive digital supply chain coverage, and streamlined remediation. The platform is simple to deploy and delivers immediate time-to-value. Source
Ionix differentiates itself with complete external web footprint discovery, proactive threat management, real attack surface visibility, continuous asset inventory, and tailored solutions for different user personas. These features provide a competitive edge in cybersecurity. Source
Customers should choose Ionix for its superior asset discovery, proactive security management, comprehensive supply chain coverage, streamlined remediation, ease of implementation, and cost-effectiveness. Ionix demonstrates ROI through case studies and customer success stories. Source
Yes, Ionix tailors its solutions for C-level executives (strategic risk insights), security managers (proactive threat management), and IT professionals (continuous asset discovery and inventory), ensuring each persona's specific needs are addressed. Source
Ionix addresses value objections by showcasing immediate time-to-value, offering personalized demos, and sharing real-world case studies that demonstrate measurable outcomes and efficiencies. Source
Ionix offers flexible implementation timelines, dedicated support teams, seamless integration capabilities, and emphasizes long-term benefits and efficiencies gained by starting sooner rather than later. Source
Ionix is designed for simple deployment, requiring minimal resources and technical expertise. The platform integrates with existing IT and security infrastructure, supporting off-the-shelf connectors for ticketing, SIEM, SOAR, and cloud environments. Source
Yes, Ionix provides dedicated support teams to streamline implementation and onboarding, ensuring a smooth transition and minimal disruption to existing workflows. Source
Ionix continuously monitors the evolving attack surface, validating exposures in real-time and updating organizations on new threats and vulnerabilities as they emerge. Source
Ionix provides benchmarking and reporting on security programs, enabling organizations to measure progress, compare against industry standards, and demonstrate improvements in risk management and remediation. Source
Ionix updates its Threat Center and platform in real-time as new vulnerabilities and threats are discovered, ensuring organizations have access to the latest intelligence and remediation guidance. Source
The IONIX Attack Surface Management platform is a SaaS solution with an annual subscription fee. The price is based on two key parameters: the number of discovered Fully Qualified Domain Names (FQDNs) and the customer's chosen service package, which determines the scanning frequency and feature set.
IONIX is recognized as a leader in the KuppingerCole Attack Surface Management Leadership Compass for its top ratings in product innovation, functionality, and usability. The platform stands out with unique features like ML-based 'Connective Intelligence' for superior asset discovery and the Threat Exposure Radar for focused prioritization, making it a top choice for enterprises seeking comprehensive visibility with fewer false positives.
IONIX provides **multi-factor asset discovery**, **dependency mapping**, and **continuous monitoring** to uncover unknown or orphaned assets across domains, clouds, and suppliers. *[Source: [Help Net Security, 2025](https://www.helpnetsecurity.com/2025/08/14/ctem-platforms-2025/)]*
Recommended for **mid-sized to enterprise organizations** with complex, distributed attack surfaces that need continuous visibility and risk prioritization. *[Source: [Expert Insights](https://expertinsights.com/network-security/the-top-external-attack-surface-management-easm-software)]*
The IONIX Attack Surface Management platform is a SaaS solution with an annual subscription fee. Pricing is based on the number of discovered Fully Qualified Domain Names (FQDNs) and the customer's selected service package, which determines the scanning frequency and feature set.
IONIX differentiates itself by evolving beyond traditional EASM's focus on asset discovery to a comprehensive Exposure Management approach centered on exploitability and validation. Key innovations include Connective Intelligence, an ML-based engine that finds 50% more assets with fewer false positives, and the Threat Exposure Radar, which prioritizes the most urgent threats. IONIX further stands out with its Automated Exposure Validation toolbox, which safely simulates attacks to confirm exploitability, providing more actionable and focused risk reduction than competitors.
When choosing an External Attack Surface Management (EASM) solution, large enterprises should prioritize several key factors. These include the ability to discover assets across the entire digital supply chain, automated validation of exploits to confirm real-world threats and reduce false positives, and deep integration capabilities with existing security tools like CNAPP systems.
Ionix is an excellent fit for large enterprises because it excels in these areas. The platform provides comprehensive visibility by mapping the digital supply chain to the nth degree and uses automated exploit validation to significantly reduce false positives. Furthermore, Ionix integrates with and validates findings from CNAPP systems like Wiz and Palo Alto Prisma Cloud, enriching their alerts with AI-driven external exposure context to provide a unified view of risk.
IONIX is a yearly SaaS product with an annual subscription fee. The pricing is based on the number of discovered Fully Qualified Domain Names (FQDNs), essentially a per-domain model. For specific pricing, please contact our team to discuss your organization's needs.
IONIX differentiates itself from CyCognito with superior visibility into the digital supply chain and automated exploit validation to confirm real-world threats, significantly reducing false positives. Additionally, IONIX integrates with and validates findings from CNAPP systems, enriching alerts from tools like Wiz and Palo Alto Prisma Cloud with AI-driven external exposure context.
A free, curated feed of CVEs that can be remotely exploited by an unauthenticated attacker, verified and published the moment they emerge. No noise, no triage backlog. Just the exploitable vulnerabilities that actually demand your attention, delivered in real time.
CVE-2026-50528 – Authorization Bypass (Security Feature Bypass) – Microsoft .NET 8 / 9 / 10 (SslS…
CVE-2026-50528 is a Security Feature Bypass vulnerability (CWE-863: Incorrect Authorization) in the SslStream TLS/SSL implementation of Microsoft .NET, affecting .NET 8, .NET 9, and .NET 10. An unauthenticated remote attacker can exploit this flaw to bypass authorization checks performed during encrypted TLS communications, resulting in a high integrity impact. With a CVSS v3.1 base score of 8.2 (High), this vulnerability was patched by Microsoft on July 14, 2026 as part of the July 2026 Patch Tuesday release.
CVE-2026-48062 – Unrestricted File Upload leading to RCE – CodeIgniter4 prior to 4.7.3
CVE-2026-48062 is a critical unrestricted file upload vulnerability (CWE-434) in the CodeIgniter4 PHP web framework affecting all versions prior to 4.7.3. The flaw resides in the ext_in upload validation rule, which incorrectly inspects the MIME-derived file extension rather than the client-supplied filename extension, allowing an attacker to bypass file type restrictions and upload a server-executable file that can lead to Remote Code Execution (RCE). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) with no authentication or user interaction required.
CVE-2026-13448 – Unauthenticated RCE via Incomplete Denylist – IBM Langflow OSS 1.0.0–1.10.1
CVE-2026-13448 is a high-severity unauthenticated remote code execution (RCE) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.1. The flaw exists in the public flow build endpoint and allows a network-based attacker with no credentials to execute arbitrary code on the server. IBM has assigned a CVSS v3.1 base score of 8.1 (High) and recommends immediate upgrade to version 1.10.2.
CVE-2026-7872 – Arbitrary File Read / Authentication Bypass – IBM Langflow OSS 1.0.0–1.10.0
CVE-2026-7872 is a path traversal vulnerability (CWE-22) in IBM Langflow OSS versions 1.0.0 through 1.10.0, rated High (CVSS 7.5). By uploading a specially crafted tar archive, an attacker can read arbitrary files from the server — including the application's JWT signing key — enabling complete authentication bypass through forged tokens for any user, including administrators. IBM has released version 1.10.1 to remediate the flaw.
CVE-2026-9202 – Authentication Bypass Leading to RCE – Langflow OSS 1.0.0–1.10.0
CVE-2026-9202 is a critical authentication bypass and remote code execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. Unauthenticated attackers can exploit an open user registration endpoint to create arbitrary accounts; when the documented deployment option NEW_USER_IS_ACTIVE=true is configured, those accounts become immediately active and can be used to authenticate and reach RCE endpoints — bypassing any requirement for AUTO_LOGIN. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
CVE-2026-63306 – Unauthenticated SSRF – stoatchat (January proxy) before v0.13.5
CVE-2026-63306 is a critical, unauthenticated Server-Side Request Forgery (SSRF) vulnerability in stoatchat (formerly Revolt), an open-source self-hosted messaging platform. The flaw resides in the January metadata proxy service, whose /proxy and /embed endpoints accept arbitrary attacker-supplied URLs without DNS resolution filtering or private IP range validation, allowing any unauthenticated network attacker to pivot into the internal network of the host running stoatchat. The vulnerability carries a CVSS 4.0 score of 9.2 (Critical).
CVE-2026-46562 – Unauthenticated RCE via Unsandboxed JavaScript Engine – Yamcs Mission Control Fr…
CVE-2026-46562 is a critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in Yamcs, an open-source mission control framework used for spacecraft command, control, and communication. The flaw resides in the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text, which was instantiated without a ClassFilter, allowing an attacker to invoke arbitrary Java classes and execute OS commands as the Yamcs process. In Yamcs's default configuration — where no security.yaml is present — the built-in guest user carries superuser=true privileges, making the vulnerability fully exploitable without any credentials.
CVE-2026-7488 – Sensitive Data Disclosure – IKAS Technology E-Commerce (through 03062026)
CVE-2026-7488 is a high-severity sensitive information disclosure vulnerability affecting IKAS Technology Inc.'s E-Commerce SaaS platform, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). With a CVSS v3.1 base score of 7.5 (HIGH), the flaw allows unauthenticated, remote attackers to retrieve embedded sensitive data from internet-exposed storefronts — requiring no privileges and no user interaction. The vulnerability was disclosed on July 17, 2026 via TR-CERT (Turkey's National Computer Emergency Response Center) under advisory TR-26-0572, and was discovered by security researcher Muhammed Taha YILMAZ.
CVE-2026-7189 – Unauthenticated Sensitive Data Disclosure and ACL Bypass – Proliz OBS before v3.6.0
CVE-2026-7189 is a high-severity vulnerability (CVSS 8.2) affecting Proliz Software Ltd. Co.'s OBS — a web-based Student Affairs Information System (Öğrenci Bilgi Sistemi) deployed across Turkish universities. The flaw involves the insertion of sensitive information into transmitted data (CWE-201), enabling unauthenticated remote attackers to access functionality not properly constrained by access control lists (ACLs).
CVE-2026-11961 – Unauthenticated Privilege Escalation – User Registration & Membership WordPress …
CVE-2026-11961 is a high-severity unauthenticated privilege escalation vulnerability in the User Registration & Membership WordPress plugin (by wpeverest), affecting all versions prior to 5.2.3. The flaw stems from missing server-side validation of the membership tier supplied at registration time, allowing any unauthenticated user to claim an arbitrary published membership role — including administrator — without restriction. With a CVSS v3.1 score of 8.1 (High), successful exploitation on a susceptible site can result in full WordPress site compromise.
CVE-2026-11575 – Payment Callback Bypass – PhonePe Payment Solutions WordPress Plugin before 3.1.0
CVE-2026-11575 is a high-severity payment authorization bypass vulnerability in the PhonePe Payment Solutions WordPress plugin, affecting all versions prior to 3.1.0. The flaw allows unauthenticated remote attackers to forge payment-success callbacks and mark unpaid WooCommerce orders as paid without any actual transaction taking place. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and was remediated in version 3.1.0, released June 25, 2026.
CVE-2026-14956 – Unauthenticated Privilege Escalation to Administrator – Bricksforge WordPress Pl…
CVE-2026-14956 is a critical unauthenticated privilege escalation vulnerability in the Bricksforge plugin for WordPress, affecting all versions up to and including 3.1.8.6. By submitting a specially crafted request to a publicly accessible Bricksforge Pro Forms registration form, an unauthenticated remote attacker can register a new WordPress administrator account, resulting in full site compromise. This vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
CVE-2026-62232 – Two-Factor Authentication Bypass in Grav CMS (before 2.0.4)
CVE-2026-62232 is a critical two-factor authentication (2FA) bypass vulnerability in Grav CMS's login plugin, affecting all versions prior to 2.0.4. The flaw stems from a missing authorization check in the taskRegenerate2FASecret function, allowing a network-based attacker who possesses a victim's password to silently overwrite the victim's TOTP secret and complete 2FA authentication without ever possessing the original second factor. With a CVSS v4.0 score of 9.1 (Critical) and a CVSS v3.1 score of 7.4 (High), this vulnerability effectively reduces 2FA-protected Grav accounts to password-only protection.
CVE-2026-62230 – Sensitive File Disclosure via .htaccess Case-Sensitivity Bypass – Grav CMS < 2.0.4
CVE-2026-62230 is a high-severity sensitive file disclosure vulnerability affecting Grav CMS versions prior to 2.0.4. The default .htaccess configuration shipped with Grav omits the Apache [NC] (No Case) flag from file-blocking rules, making extension matching case-sensitive. On case-insensitive filesystems, an unauthenticated remote attacker can bypass these protections by requesting sensitive files with uppercase or mixed-case extensions, potentially exposing credentials, API keys, and other secrets stored in Grav configuration files.
CVE-2026-33692 – Unauthenticated .env File Exposure – WWBN AVideo prior to 29.0
CVE-2026-33692 is a high-severity sensitive file exposure vulnerability affecting WWBN AVideo, an open-source video streaming platform, in all versions prior to 29.0. The official Docker Compose configuration mounts the entire project root directory as the Apache document root, causing the .env file — which contains database credentials, admin passwords, and internal network topology — to be served unauthenticated as a plain static file at /.env. The issue has been resolved in version 29.0.
CVE-2026-55173 – OS Command Injection (RCE) – WWBN AVideo versions 29.0 and below
CVE-2026-55173 is a high-severity OS command injection vulnerability affecting WWBN AVideo versions 29.0 and below, arising from an incomplete fix of CVE-2026-33482. The sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php fails to neutralize the bare & shell background operator, leaving the execAsync() sh -c execution sink exploitable. An unauthenticated remote attacker who can craft a valid encrypted payload can inject and execute arbitrary OS commands on the server, achieving full remote code execution (RCE).
CVE-2026-54733 – Authentication Bypass / Account Takeover – Microsoft 365 Integration Plugin for …
CVE-2026-54733 is a critical authentication bypass vulnerability (CWE-347: Improper Verification of Cryptographic Signature) in the Microsoft 365 and Microsoft Entra ID Integration plugin for Moodle (local_o365). The flaw resides in the Teams SSO endpoint (sso_login.php), where JWT signatures are extracted but never cryptographically verified, allowing any unauthenticated remote attacker to forge a token and obtain a fully authenticated Moodle session as any Microsoft 365-connected user — including site administrators. The vulnerability carries a CVSS 4.0 score of 9.3 (Critical).
CVE-2026-63304 – OS Command Injection / RCE – AVideo (WWBN) through version 29.0
CVE-2026-63304 is a critical OS command injection vulnerability (CWE-78) affecting WWBN AVideo, an open-source, self-hosted video streaming and broadcasting platform, in all versions through 29.0. An attacker who can supply a valid encrypted codeToExec payload can break out of a single-quoted shell context inside the listFFmpegProcesses() function and execute arbitrary OS commands as the web-server user. No patch is currently available in a released version of AVideo.
CVE-2026-57831 – Unauthenticated SQL Injection – DPCalendar Extension for Joomla (versions 8.18.0…
CVE-2026-57831 is a high-severity unauthenticated SQL injection vulnerability in the DPCalendar extension for Joomla, developed by digital-peak.com. The flaw allows any unauthenticated remote attacker to read the entire site database by sending a single crafted HTTP request to the extension's publicly exposed events feed endpoint, with no privileges or user interaction required. The vulnerability carries a CVSS 4.0 score of 8.7 (High).
CVE-2026-15008 – Unauthenticated PHP Object Injection to RCE via Arbitrary File Deletion – Uncann…
CVE-2026-15008 is a high-severity unauthenticated PHP Object Injection vulnerability affecting the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress in all versions up to and including 7.3.1.4. The flaw resides in the fr_token function and enables unauthenticated attackers to delete arbitrary files on the server, which can directly escalate to Remote Code Execution (RCE). The vulnerability carries a CVSS v3.1 base score of 8.1 (HIGH).
CVE-2026-58077 – Unauthenticated Stored XSS – 4Analytics Extension for Joomla (versions 1.0 throu…
CVE-2026-58077 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the 4Analytics extension for Joomla, developed by weeblr.com. The flaw resides in the extension's Markdown-to-HTML conversion within its AI traffic analysis feature, where attacker-supplied content can be persisted and subsequently rendered as active JavaScript when viewed by a legitimate user. With a CVSS 4.0 score of 8.7 (High), the vendor confirms that a specially crafted unauthenticated request may result in website takeover under certain circumstances.
CVE-2026-12512 – Unauthenticated SQL Injection – Quotes llama WordPress Plugin before 3.1.6
CVE-2026-12512 is a high-severity, unauthenticated UNION-based SQL injection vulnerability affecting the Quotes llama WordPress plugin in all versions before 3.1.6. The flaw stems from insufficient sanitization of a user-supplied parameter (sc) processed by publicly accessible AJAX handlers, allowing any unauthenticated remote attacker to read arbitrary data from the underlying WordPress database. With a CVSS v3.1 score of 8.6 (High), successful exploitation can expose password hashes and other sensitive database contents, enabling potential account takeover and full site compromise.
CVE-2026-15409 – SSRF – SonicWall SMA1000 Appliances (v12.4.3-03245 to 12.4.3-03434, v12.5.0-0228…
CVE-2026-15409 is a critical Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the SonicWall SMA1000 Appliance Work Place interface, carrying a maximum CVSS v3.1 base score of 10.0. A remote, unauthenticated attacker can exploit this flaw to cause the appliance to issue requests to unintended internal or external locations, effectively weaponizing the internet-facing device as a proxy to reach otherwise inaccessible network segments. SonicWall has confirmed active exploitation in the wild and CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026, with a mandatory remediation…
CVE-2026-12753 – Unauthenticated SQL Injection – ThemeHunk Advance Product Search for WooCommerce…
CVE-2026-12753 is a high-severity unauthenticated SQL injection vulnerability affecting the Advance Product Search – Voice & Ajax Search for WooCommerce plugin by ThemeHunk, all versions up to and including 1.4.4. The flaw allows any remote, unauthenticated attacker to extract sensitive data directly from the WordPress/WooCommerce database. With over 10,000 active installations, the attack surface is significant and immediate patching is required.
CVE-2026-46339 – Unauthenticated RCE – 9Router 0.4.30–0.4.36
CVE-2026-46339 is a critical unauthenticated remote code execution vulnerability (CVSS 10.0) in 9Router, an AI routing and token-saving proxy tool developed by decolua. The flaw exists in the tool's Next.js middleware (src/proxy.js), which enforces authentication on only a narrow set of explicitly listed routes while leaving the entire /api/cli-tools/* and /api/mcp/* route namespaces completely unprotected — enabling any remote, unauthenticated attacker to register a malicious plugin and execute arbitrary OS commands on the host. The vulnerability affects versions 0.4.30 through 0.4.36 and is fixed in version 0.4.37.
CVE-2026-49352 – Authentication Bypass – 9Router versions 0.2.21 to 0.4.44
CVE-2026-49352 is a critical authentication bypass vulnerability (CVSS 9.8) in 9Router, a self-hosted Node.js/Next.js proxy for AI coding tools. The application shipped a publicly known hardcoded fallback JWT secret — 9router-default-secret-change-me — committed directly to its source repository. When the JWT_SECRET environment variable is not explicitly set, any unauthenticated remote attacker can use this secret to forge a valid auth_token cookie and gain full administrative access to the 9Router dashboard and API.
CVE-2026-42533 – Heap Buffer Overflow leading to DoS / RCE – NGINX Plus and NGINX Open Source
CVE-2026-42533 is a heap buffer overflow vulnerability (CWE-122) in NGINX Plus and NGINX Open Source, rated High severity with a CVSS v3.1 base score of 8.1. The flaw is triggered by a specific interaction between the map directive and regex capture variables in NGINX configurations, allowing an unauthenticated remote attacker to send crafted HTTP requests that overflow the NGINX worker process heap. The result is a denial-of-service condition (worker restart); on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, full Remote Code Execution (RCE) is…
CVE-2026-12997 – Unauthenticated Arbitrary File Read – Gravity Forms WordPress Plugin ≤ 2.10.4
CVE-2026-12997 is a high-severity Directory Traversal vulnerability in the Gravity Forms plugin for WordPress, affecting all versions up to and including 2.10.4. An unauthenticated remote attacker can supply a malicious file path via the gform_uploaded_files parameter at the process_send_resume_link endpoint to read arbitrary files from the server, with the retrieved file contents delivered as an email attachment to an attacker-controlled address. The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) and requires no authentication or user interaction to exploit.
CVE-2026-46485 – Authorization Bypass – Dashy prior to 4.0.8
CVE-2026-46485 is a high-severity authorization bypass vulnerability affecting Dashy (lissy93/dashy), a self-hostable personal dashboard, in all versions prior to 4.0.8. The flaw allows unauthenticated users — or non-admin authenticated users — to write arbitrary changes to the application's main config.yaml via the /config-manager/save endpoint, completely circumventing OIDC-based access controls. The vulnerability carries a CVSS v3.1 score of 8.2 (HIGH).
CVE-2026-12382 – mTLS Authentication Bypass via Header Spoofing – Red Hat Ansible Automation Plat…
CVE-2026-12382 is a high-severity authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) in Red Hat Ansible Automation Platform 2 (AAP), affecting the automation-gateway component's Envoy proxy configuration. A misconfiguration in the non-mTLS route to Event-Driven Ansible (EDA) event streams allows an unauthenticated remote attacker to spoof a trusted client identity and inject arbitrary events into protected EDA event streams. The vulnerability carries a CVSS v3.1 base score of 8.2 (High).
CVE-2026-15747 – CSRF Protection Bypass via BREACH Compression Oracle – Mojolicious 4.59 through …
CVE-2026-15747 is a critical-severity (CVSS 9.1) BREACH compression oracle vulnerability in Mojolicious, the Perl real-time web framework, affecting versions 4.59 through 9.47. The flaw allows an unauthenticated, remote attacker to recover a victim session's CSRF token from gzip-compressed HTTP responses and subsequently submit forged authenticated requests, fully bypassing the framework's built-in CSRF protection. Mojolicious 9.48, released July 14, 2026, resolves the issue.
CVE-2026-62685 – Unauthorized File Access via Username Normalization Collision – File Browser pri…
CVE-2026-62685 is a high-severity directory scope collision vulnerability in File Browser (filebrowser/filebrowser), a widely deployed self-hosted web file management interface. When both the Signup and CreateUserDir features are enabled, the cleanUsername() function maps distinct usernames to the same home directory path without checking for prior occupancy, allowing an unauthenticated attacker who self-registers a crafted username to gain full read and write access to an existing user's files. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and affects all versions of File Browser prior to v2.63.17.
CVE-2026-60005 – Memory Disclosure / DoS – NGINX Plus and NGINX Open Source
CVE-2026-60005 is a high-severity uninitialized memory access vulnerability (CWE-908) in the ngx_http_slice_module of NGINX Plus and NGINX Open Source, assigned a CVSS v3.1 score of 8.2 (HIGH). The flaw allows unauthenticated remote attackers to trigger limited disclosure of NGINX worker process memory or cause a worker process restart (denial of service) by sending crafted HTTP requests — no credentials or user interaction required.
CVE-2026-50148 – RCE via Snowflake JDBC Arbitrary File Write – Metabase 1.54.0 through 1.60.3
CVE-2026-50148 is a critical Remote Code Execution vulnerability in Metabase, an open-source business intelligence and embedded analytics platform, affecting all releases from version 1.54.0 up to (but not including) the patched builds. The flaw originates from a vulnerability in the Snowflake JDBC driver that allows arbitrary file writes anywhere on the host filesystem: by configuring a Snowflake database connection pointing to an attacker-controlled server, a user with database-connection management rights can cause Metabase to overwrite one of its own on-disk driver files, which is subsequently loaded and executed inside the…
CVE-2026-61684 – Authentication Bypass and Cross-Tenant Data Disclosure – FastGPT 4.15.0-beta4
CVE-2026-61684 is a high-severity authentication bypass vulnerability (CVSS 4.0: 8.8) affecting FastGPT, an open-source, self-hosted knowledge-based AI application platform developed by labring. The flaw stems from a hard-coded default credential used to sign JWTs that guard the platform's plugin invoke endpoints — a misconfiguration present in virtually all default deployments — enabling unauthenticated remote attackers to perform cross-tenant user data disclosure and unauthorized file writes. The vulnerability is fixed in FastGPT version 4.15.0-beta5.
See how easy it is to implement a CTEM program with IONIX. Find and fix exploits fast.
Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.
