Tagged “cve”
9 posts
CVE-2026-21580: Confluence XSS That Skips Straight to Admin
An unauthenticated stored XSS in Confluence Data Center and Server chains into privilege escalation, turning your internal wiki into a path to full instance takeover.
CVE-2026-72898: Metabase Bug Nobody Escalated Hit 1M Users
An unauthenticated SQL injection in Metabase's password-reset endpoint gave attackers admin access — and an unread advisory turned it into a million-record breach.
CVE-2026-59310: a syslog bug that became vCenter RCE
A directory-traversal flaw in vCenter's Syslog server let unauthenticated attackers drop a reverse-SSH backdoor, compromising 361 hosts in 47 countries within days of disclosure.
CVE-2024-21762: FortiOS RCE that needed no login at all
A heap out-of-bounds write in FortiOS SSL-VPN let unauthenticated attackers run code as root — and 150,000 devices were still exposed when it went public.
ESXiArgs: a 2-year-old ESXi bug, then a global ransomware wave
CVE-2021-21974 sat patched and ignored for two years until ESXiArgs used it to ransom thousands of internet-exposed VMware ESXi hosts at once.
Citrix Bleed: how a memory leak beat MFA outright
CVE-2023-4966 let attackers steal live NetScaler session tokens and walk straight past authentication and MFA — no credentials needed at all.
CVE-2025-0282: the Ivanti VPN zero-day, and its sequel
A stack-based buffer overflow in Ivanti Connect Secure let Chinese state hackers run a malware ecosystem on VPN gateways for weeks before anyone noticed.
Java deserialization after Log4Shell: CVE-2023-46604
Apache ActiveMQ's unauthenticated RCE shows Java deserialization bugs never went away after Log4Shell — only the exploitation playbook got faster.
MOVEit and the MFT zero-day exploitation playbook
CVE-2023-34362 turned one SQL injection in MOVEit Transfer into 2,700+ breached organizations — and the same pattern keeps repeating against MFT software.