Olivia
Online
YourDailyCVE
@YourDailyCVE
One exploited or high-impact CVE (Common Vulnerabilities and Exposures) a day. What broke, who should care, how to fix it.
Independent — no vendor, no agenda.
Joined July 2026
102 Following
14 Followers
143 Posts
Pinned Tweet
👋 Welcome to @YourDailyCVE
One CVE. Every day. What it is, why it matters, how to fix it — in plain English, no vendor spin.
Sourced from CISA KEV, NVD & vendor advisories. Independent — no agenda.
New post daily. Turn on notifications if you don't want to miss one. 🔔
🚨 CVE-2026-85046 — Google Chrome, V8 engine zero-day
What broke: V8 is the engine inside Chrome that runs all the JavaScript on every webpage you visit. A bug in how V8's compiler handles arrays caused it to get "confused" about what type of data an array actually held — internally mixing up two different memory layouts. That confusion let a specially crafted webpage manipulate memory in ways it was never supposed to be able to.
Who should care: literally anyone using Chrome (or any Chromium-based browser — Edge, Brave, Opera, Vivaldi) on Windows, macOS, or Linux, on a version older than 152.0.7977.82. This isn't a niche enterprise tool — it's the browser sitting on most people's desktop.
Risk: no login, no download, no obvious warning sign needed. A victim just has to visit a malicious or compromised webpage — a phishing link, a bad ad, a hacked legitimate site — and the crafted page can run attacker-controlled code inside Chrome's sandbox. Google hasn't disclosed who's behind the real-world attacks or who's been targeted, which is standard practice while the patch rolls out.
Status: actively exploited. Reported responsibly on Aug 4 by researcher Salvatore Gulizia ($1,000 bug bounty), patched by Google on Sept 4, and added to CISA KEV the same day. This is the sixth actively exploited Chrome zero-day of 2026 — and the third one this year specifically in the V8 engine, suggesting attackers have found a reliable seam in its compiler internals they keep coming back to.
How to fix it: update now — go to Chrome's menu > Help > About Google Chrome, which triggers the update and prompts a relaunch. If you use Edge, Brave, Opera, or Vivaldi, watch for and apply their own updates as they roll out, since they all share the same V8 engine.
Source: Google Chrome Security Advisory / CISA KEV / The Hacker News
#Chrome #ZeroDay
🚨 CVE-2026-49869 — Kestra. One sloppy URL check, full server takeover. Disclosed Jun 26.
What broke: Kestra's login check had one exception — any web address ending in "/configs" was allowed through with no password, because that page is meant to be public. But the check only looked at how the address ends. So an attacker takes a locked admin address, adds "/configs" to the end — and the door swings open. From there they can create a workflow that runs any command on the server. No account, no password.
Who should care: anyone self-hosting Kestra OSS — the open-source workflow orchestrator — on any version before 1.0.45 or 1.3.21. If your Kestra API is reachable from the internet, assume it's being scanned. Kestra Cloud customers are not affected.
Why that matters: Kestra runs your scheduled jobs and data pipelines, so it usually holds passwords and keys for your databases, cloud accounts, and internal APIs. Take over Kestra and you inherit every secret it touches.
Status: exploited in real attacks. CISA added it to the KEV catalog on Sep 2 — the same seven-CVE batch as the Sangoma Switchvox bug. CVSS 10.0, the maximum. EPSS still low (<1%), but KEV means that number no longer matters.
Fix today: upgrade to 1.0.45 or 1.3.21 (or later). Advisory GHSA-5vc5-wxxq-3fjx.
Can't patch: take the Kestra API off the internet or put it behind a VPN/allowlist. Check workflows and execution history for anything you didn't create. If you find something, rotate every secret Kestra stores — patching doesn't undo stolen keys.
Source: GitHub Security Advisory GHSA-5vc5-wxxq-3fjx / CISA KEV (Sep 2) / NVD
#Kestra #CyberSecurity
🚨 CVE-2026-59822 — LiteLLM. A fake Authorization header walks straight past the login. Disclosed Jul 8.
What broke: LiteLLM is the bouncer that checks API keys before requests reach your AI tools. When key validation fails, it is supposed to say no. Instead, a fallback path meant for OAuth2 passthrough quietly swaps the failed key for an empty identity and waves the request through. An attacker just makes up an Authorization header — any string — and reaches MCP tooling with no valid key at all.
Who should care: anyone running LiteLLM (the open-source LLM proxy / AI gateway) below version 1.84.0 with the MCP Streamable HTTP endpoint enabled. If your company routes AI traffic through LiteLLM, that is you.
Why that matters: MCP tools are where the AI touches real things — databases, files, internal APIs, code execution. Walking past the bouncer means a stranger on the internet can call those tools through your gateway, read what they return, and burn your model credits doing it. Confirmed impact: high confidentiality hit, some integrity hit.
Status: public since July 8, fix shipped same day in 1.84.0. CVSS 4.0 score 8.8 (High). Exploit likelihood scored low (EPSS <1%), though at least one tracker flags it as exploited. Not on CISA KEV as of Sep 3. Intelligence still being updated as of yesterday.
Fix today: upgrade LiteLLM to 1.84.0 or later. Advisory GHSA via BerriAI/litellm.
Can't patch: block or disable the MCP Streamable HTTP endpoint at the proxy/WAF until you can upgrade. If the box was internet-facing, rotate every API key and secret the gateway holds — a bypass means they may already be gone.
Source: GitHub Security Advisory (BerriAI/litellm) / NVD CVE-2026-59822
#LiteLLM #AISecurity #MCP
https://t.co/1jeDDHy3zJ
🚨 CVE-2026-83548 — SonicWall SMA 1000. Two bugs, one break-in. Disclosed Sep 1.
Who should care: anyone running a SonicWall SMA 1000 — models 6210, 7210, or 8200v, physical or virtual — on firmware 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. That includes boxes that got the July hotfix. SMA 100 and SonicWall firewalls are not this bug.
What broke, in plain English: this box is the front door for remote workers. Bug 1 (CVE-2026-83548) tricks the door into making calls it should not make — it will reach internal admin pages for an attacker who has no password. Bug 2 (CVE-2026-83549) lets someone on those admin pages run commands on the machine. Chain them and a stranger on the internet can take over the VPN box.
Why that matters: own the VPN appliance and you sit on every remote login. Attackers can steal passwords and phone-app login codes stored on the device, then walk further into the network. Shadowserver still sees 400+ of these on the public internet.
Status: already used in real attacks. SonicWall confirmed a live case. Public as of yesterday. Not on CISA KEV yet. Second time this product line has had a zero-day wave in 2026.
Fix today: install the new hotfix — 12.4.3-03526 or later, or 12.5.0-02952 or later. Advisory SNWLID-2026-0016.
Can't patch: there is no workaround. Pull it off the internet. If you think it was hit, rebuild the box (re-image hardware, re-deploy virtual), then reset every password and every login-app code. A patch does not undo stolen keys.
Source: SonicWall PSIRT SNWLID-2026-0016 / The Hacker News
#SonicWall #VPN
Think of the SMA 1000 as the lock on the office. These bugs let someone ask the lock to open the back room, then run their own tools from there.
The July update that fixed the last break-in is now on the “still vulnerable” list. If you patched in summer and stopped, you are back in scope.
SMA 1000 is the SSL VPN concentrator. Own it and you do not just get a box — you sit on the path every remote user takes into the network.
The July hotfixes (12.4.3-03453 / 12.5.0-02835) fixed the last chain. They are the versions SonicWall now lists as vulnerable. If you patched in July and stopped there, you are back in scope.
No public IoCs from SonicWall yet. Hunt unexpected Work Place proxy behavior, AMC command activity, new admin sessions, and treat any exposed appliance as assume-breach until the hotfix is on and credentials/TOTP have been rotated.
https://t.co/2RKfi1fjNz
🛡️ We added 2 PaperCut NG/MF vulnerabilities to our KEV Catalog: CVE-2026-81578, a missing authentication for critical function vulnerability, and CVE-2026-82078, an unsafe reflection vulnerability. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org.
🚨 CVE-2026-82078 — PaperCut NG/MF, chained auth bypass to RCE. KEV Aug 31.
Who should care: anyone running PaperCut NG or PaperCut MF — all versions, especially 24/25/26 with an Application Server reachable from the internet. Schools, remote offices, and print vendors often expose it by design because it sits in front of the copier/MFP fleet.
Impact: CVE-2026-81578 lets an unauthenticated attacker hit admin functions in the web UI before access checks finish and rewrite config. That access is then used to point the database connector at a malicious driver name. CVE-2026-82078 loads that “driver” with no allowlist, so it is just arbitrary Java bytecode running as the PaperCut server process. Chain them and zero credentials become full RCE.
Risk: PaperCut confirmed real customer incidents. Huntress and Rapid7 have seen post-exploitation move from recon to hands-on-keyboard and remote-access tools. Shadowserver still sees 1,000+ internet-facing instances. A Metasploit module is public.
Status: exploited as a zero-day before any patch existed. Disclosed Aug 27. CISA KEV Aug 31. Federal deadline Sep 14.
Fix today: Emergency Patch Release 3 — not Release 1, not Release 2. watchTowr and Huntress bypassed the first patch in about 48 hours; Release 3 supersedes both earlier emergency builds. If you only applied Release 1 or 2, you are not protected.
Can't patch: take the Application Server off the internet or restrict it to trusted IPs only. PaperCut says act even with no evidence of compromise. Hunt new processes around pc-app.exe, unexpected Java class loads, rewritten database-driver settings, and new remote-access tools.
Source: PaperCut Security Bulletin / watchTowr / Huntress / Rapid7 / CISA KEV #PaperCut #RCE
PaperCut is the print-management plane for the copier fleet. Own the Application Server and you are not just on a print box — you have a privileged Windows/Linux foothold that already talks to directory services, file shares, and every MFP on the network.
The first emergency patch shipped Aug 27–28. It did not hold. Release 2 followed the same day after watchTowr and Huntress showed bypasses. Release 3 landed Sep 1 and is the one that actually closes the chain. Check the build, not the fact that “a patch was applied last week.”
https://t.co/mNAZbGxLzN
You can also track CVE-2026-59310 & CVE-2026-59309 vulnerable VMware vCenter instances in our daily Vulnerable HTTP reporting since July 30th: https://t.co/qxv0Gv5ELc
Tracker: https://t.co/BwjPFAjSZM
World Map: https://t.co/aGkqd24dMD
🚨 CVE-2026-59310 — vCenter Syslog path traversal RCE. KEV Aug 18.
Who should care: vCenter 8.0 before U3k (U2 stream: before U2f), 9.0.x before 9.0.2.0100, 9.1.x before 9.1.0.0300, plus Cloud Foundation / vSphere Foundation / Telco Cloud that ship those builds.
Impact: an unauthenticated attacker with network access to vCenter's Syslog server can send a crafted file path that traverses outside the intended directory, landing a file where it shouldn't be and leading to arbitrary code execution.
Risk: own vCenter and you reach the VMs behind it. QUIRSO tracked exploitation from Aug 3 across 361 IPs in 47 countries, attributed to a suspected China-nexus APT. They deployed reverse_ssh for persistence. In at least one intrusion the chain reached Babuk-derived ransomware on ESXi.
Status: disclosed Jul 29. Exploited by Aug 3. CISA KEV Aug 18. Federal deadline was Aug 21. Broadcom workaround: none.
Fix today: 8.0 U3k or 8.0 U2f, 9.0.2.0100, or 9.1.0.0300.
Can't patch: take vCenter and its Syslog port off untrusted networks. That is containment only. Hunt new SSO accounts, reverse_ssh, unexpected cron, and ESXi encryption events.
Source: Broadcom VMSA-2026-0006 / QUIRSO / CISA KEV
#vCenter
vCenter is the central management console for an organization's entire virtualized infrastructure — compromise it, and an attacker doesn't just get one box, they get a foothold to reach every VM, host, and workload it manages.
The result is worse than a typical RCE: because the vulnerable component runs with high system privileges to negotiate that handshake, successful exploitation hands the attacker SYSTEM-level code execution — the highest privilege tier on Windows — on a machine that's often an internet-facing VPN gateway sitting right at the network edge. That's a direct foothold into whatever sits behind it. Unit 42 observed a threat actor using this for hands-on-keyboard access — manually driving reverse shell callbacks from IKE VPN endpoints — not just noisy, automated scanning.
🚨 CVE-2026-33824 — Windows IKE Service Extensions, pre-auth double-free RCE
Who should care: Windows 10/11/Server with IKEv2 enabled and UDP 500 or 4500 reachable from untrusted networks — VPN gateways first, also RRAS / Always On VPN hosts.
Impact: IKE is the handshake that sets up IPsec VPN tunnels. This bug sits in that pre-auth path, so no VPN account and no user click. A crafted packet can run code as SYSTEM on an internet-facing gateway.
Status: exploited. Microsoft patched it in April 2026. CISA KEV Aug 18 (federal deadline was Aug 21). Unit 42 reported reverse-shell attempts against three IKE VPN endpoints. Microsoft’s advisory still treats exploitation as less likely than CISA does.
Fix today: April 2026 Windows updates or later.
Can't patch: disable IKEv2 if unused; otherwise restrict UDP 500/4500 to known peers. Hunt odd IKE negotiation and unexpected processes on the gateway.
Source: MSRC CVE-2026-33824 / CISA KEV / Unit 42
#Windows
IKE is the "handshake" protocol Windows uses to set up encrypted VPN tunnels — two devices use it to agree on a shared secret key before any VPN traffic flows, and by design that handshake happens before either side is authenticated. This bug lives in that pre-authentication handshake code, so an attacker doesn't need a VPN account, a password, or any user interaction — just the ability to send crafted packets to UDP port 500 or 4500.
https://t.co/rHxh57vBuV
🚨 CVE-2026-19478 — GitLab CE/EE, unauthenticated GraphQL code injection
Who should care: anyone running self-hosted GitLab CE/EE (Community Edition/ Enterprise Edition) below 19.2.4, 19.1.6, 19.0.8, or 18.11.11.
Impact: an unauthenticated attacker can send a crafted request to the GraphQL Composite Data API and modify or delete data in any publicly accessible project — no login, no prior access needed.
The real risk: an attacker can wipe out repository history and files on public-facing projects, rewrite content (including injecting malicious code into a project others pull from), or silently delete work outright. For any org with public repos — open-source maintainers, teams with public mirrors, CI/CD pipelines that pull from public projects — that's data loss and a potential supply-chain foothold, not just a defacement.
Status: actively exploited. watchTowr Labs reproduced the exploit within minutes of GitLab's disclosure and observed real attacks hitting its honeypot network within days — a sharp example of how fast AI-assisted attackers now move from patch notes to live exploitation. Not yet listed on CISA KEV as of this writing.
Fix today: upgrade to GitLab CE/EE 19.2.4, 19.1.6, 19.0.8, or 18.11.11.
If you can't patch: restrict unauthenticated access to /api/graphql, or remove public project access entirely as an interim mitigation.
Source: GitLab Security Release / watchTowr Labs / The Hacker News
#GitLab #GraphQL
🚨 CVE-2026-66384 — JFrog Artifactory, Docker cache path traversal
Who should care: anyone running self-hosted JFrog Artifactory before 7.146.35, or 7.161.0 through 7.161.16, with Docker remote repositories configured. JFrog cloud services are already patched.
Impact: an authenticated user can manipulate a file path during Docker cache operations, writing files outside the intended cache directory and onto other locations the Artifactory process can reach — undermining file integrity on the host.
Status: exploited in the wild. Added to CISA KEV on Aug 27 (today), with a federal deadline of Sep 10 — a longer runway than most, reflecting the Medium (not Critical) severity.
Fix today: upgrade to Artifactory 7.146.35 or 7.161.16, whichever branch you're on.
If you can't patch: restrict who has write access to Docker remote repositories, and review cache-write activity for paths that resolve outside the expected cache root.
Source: JFrog Security Advisories / CISA KEV
#JFrog #Artifactory
🚨 CVE-2026-8452 — NetScaler RCE. Patch before Saturday. KEV Aug 26.
Who should care: anyone running NetScaler ADC/Gateway configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server with SAML SSO enabled, on 14.1 before build 72.61 or 13.1 before build 63.18.
Impact: Can unauthenticated attacker sends one crafted SAML message. NetScaler copies an attacker-controlled field into a fixed-size buffer during signature canonicalization without checking its size, corrupting memory in the process that carries all traffic through the appliance. Citrix's own advisory calls this denial-of-service — watchTowr Labs mapped a path from that same heap overflow to remote code execution.
Status: actively exploited. New Zealand's NCSC reported exploitation of this NetScaler batch back in July. CISA added it to KEV today (Aug 26), federal deadline Aug 29.
Fix today: upgrade to NetScaler ADC/Gateway 14.1-72.61 or 13.1-63.18 or later, then verify every virtual server actually picked up the build — patch state is externally checkable with a couple of ordinary SAML requests.
If you can't patch: disable SAML SSO on Gateway/AAA virtual servers, or restrict access to trusted networks only. That removes the trigger path — it's not a substitute for patching.
Source: https://t.co/bYmmVmCbiX CVE-2026-8452 / Citrix CTX696604 / CISA KEV
#NetScaler
Last Seen Users on Sotwe
nOt VirGin
Seen from Pakistan
Mert
Seen from Turkey
Türk İfşa Sever Yeni
Seen from Switzerland
MOMMY'S MYLF🔥
Seen from Saudi Arabia
Marlon Salles Dancer
Seen from Brazil
wasd
Seen from Indonesia
ra_ni
Seen from Korea
Pitchayaploy sex
Seen from Thailand
Zayn Styles
Seen from Egypt
olgun_hastası
Seen from Turkey
Trends for you
Most Popular Users
Elon Musk
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.1M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.8M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73.1M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers