Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
A Chinese-speaking threat actor, tracked as Red Heron, exploited the CVE-2026-60004 remote code execution vulnerability in Gitea, compromising 1,386 instances across seven countries. The campaign involved source-code theft, credential collection, and lateral movement, affecting organizations in Cana...
A Chinese-speaking threat actor has exploited a stack-based buffer overflow vulnerability (CVE-2026-7273) in Zyxel GS1900 switches, compromising 996 devices across 48 countries since August 17, 2026. The vulnerability allows unauthenticated attackers to execute OS commands via crafted HTTP requests....
A critical vulnerability in Gitea, tracked as CVE-2026-60004, is being actively exploited by attackers, allowing unauthorized users to execute arbitrary shell commands on vulnerable servers. This flaw affects self-hosted Gitea instances, particularly those with default configurations that permit sel...
Threat actors are actively exploiting CVE-2026-66066, a critical Ruby on Rails vulnerability known as KindaRails2Shell, which allows unauthenticated attackers to read arbitrary files from servers, potentially leading to remote code execution (RCE). Disclosed on July 30, 2026, this flaw affects numer...
