现已上线！2025 年 Telegram 研究 — 年度关键洞察 
Netlas.io
前往频道在 Telegram
Explore the latest in cybersecurity with Netlas.io. Stay ahead with updates on high-profile vulnerabilities, expert tutorials, essential safety tips, and the latest Netlas developments.
显示更多2 190
订阅者
+224 小时
+167 天
+5030 天
数据加载中...
标签云
进出提及
---
---
---
---
---
---
吸引订阅者
六月 '26
六月 '26
+88
在2个频道中
五月 '26
+90
在0个频道中
Get PRO
四月 '26
+64
在0个频道中
Get PRO
三月 '26
+53
在0个频道中
Get PRO
二月 '26
+63
在1个频道中
Get PRO
一月 '26
+55
在0个频道中
Get PRO
十二月 '25
+88
在0个频道中
Get PRO
十一月 '25
+96
在2个频道中
Get PRO
十月 '25
+62
在1个频道中
Get PRO
九月 '25
+74
在1个频道中
Get PRO
八月 '25
+73
在3个频道中
Get PRO
七月 '25
+90
在2个频道中
Get PRO
六月 '25
+106
在2个频道中
Get PRO
五月 '25
+59
在1个频道中
Get PRO
四月 '25
+59
在0个频道中
Get PRO
三月 '25
+60
在0个频道中
Get PRO
二月 '25
+43
在2个频道中
Get PRO
一月 '25
+54
在0个频道中
Get PRO
十二月 '24
+62
在1个频道中
Get PRO
十一月 '24
+155
在4个频道中
Get PRO
十月 '24
+73
在1个频道中
Get PRO
九月 '24
+76
在1个频道中
Get PRO
八月 '24
+62
在1个频道中
Get PRO
七月 '24
+77
在3个频道中
Get PRO
六月 '24
+53
在1个频道中
Get PRO
五月 '24
+77
在2个频道中
Get PRO
四月 '24
+133
在3个频道中
Get PRO
三月 '24
+92
在2个频道中
Get PRO
二月 '24
+78
在0个频道中
Get PRO
一月 '24
+110
在2个频道中
Get PRO
十二月 '23
+165
在3个频道中
Get PRO
十一月 '23
+84
在3个频道中
Get PRO
十月 '23
+451
在5个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 30 六月 | +2 | |||
| 29 六月 | +3 | |||
| 28 六月 | +6 | |||
| 27 六月 | +6 | |||
| 26 六月 | +1 | |||
| 25 六月 | +3 | |||
| 24 六月 | +1 | |||
| 23 六月 | +5 | |||
| 22 六月 | +2 | |||
| 21 六月 | +3 | |||
| 20 六月 | +3 | |||
| 19 六月 | +3 | |||
| 18 六月 | 0 | |||
| 17 六月 | +1 | |||
| 16 六月 | +2 | |||
| 15 六月 | +1 | |||
| 14 六月 | +3 | |||
| 13 六月 | +4 | |||
| 12 六月 | +4 | |||
| 11 六月 | +4 | |||
| 10 六月 | 0 | |||
| 09 六月 | +5 | |||
| 08 六月 | +6 | |||
| 07 六月 | +3 | |||
| 06 六月 | 0 | |||
| 05 六月 | +4 | |||
| 04 六月 | +4 | |||
| 03 六月 | 0 | |||
| 02 六月 | +4 | |||
| 01 六月 | +5 |
频道帖子
CVE-2026-49869 & CVE-2026-53576: Two RCE vulnerabilities in kestra, 10.0 rating 😱
Recently disclosed vulnerabilities in Kestra allow an unauthenticated remote attacker to execute arbitrary code as root.
Search at Netlas.io:
👉 Link: https://nt.ls/58ToN
👉 Dork: http.title:kestra OR http.favicon.hash_sha256:26119c9b0a6c4e82ae8c2d367e4a7cb56a30c4da664b7185d14f6fbdf50f8ec8
Read more:
https://github.com/kestra-io/kestra/security
| 2 |  CVE-2026-52813 & CVE-2026-52806 & CVE-2026-52811: Three RCE vulnerabilities in gogs, up to 10.0 rating 🔥
Recently disclosed vulnerabilities in gogs allow an attacker to execute arbitrary code. PoC exist for all three!
Search at Netlas.io:
👉 Link: https://nt.ls/A9o6h
👉 Dork: tag.name:gogs
Read more:
https://github.com/gogs/gogs/security | 246 |
| 3 |  CVE-2026-12046: RCE vulnerability in pgAdmin 4, 9.5 rating 🔥
Two SQL Editor endpoints were missing the login-required decorator and were reachable without authentication in server mode. This exposes an unauthenticated remote code execution path in the pgAdmin process.
Search at Netlas.io:
👉 Link: https://nt.ls/jbYEF
👉 Dork: http.title:"pgAdmin" OR http.headers.set_cookie:"pga4_session=" OR http.favicon.hash_sha256:c3251099ffc5ed057dcbb624adbe79fa5794a0c64684442c1eaf1abc3edf7bde OR http.favicon.hash_sha256:6afa287fc6721817d9931bd8d7a796646ea535596f8bb038ff048666e19cfd17
Read more:
https://github.com/pgadmin-org/pgadmin4/issues/10072 | 438 |
| 4 | CVE-2026-8713: Arbitrary file deletion in Avada Builder WordPress plugin, 9.1 rating 🔥
New vulnerability in Avada Builder WordPress plugin (formerly Fusion Builder) allows an unauthenticated attacker to delete any file on the server. It can easily lead to remote code execution when the right file is deleted.
Search at Netlas.io:
👉 Link: https://nt.ls/ohFG5
👉 Dork: http.body:"wp-content/plugins/fusion-builder"
Read more:
https://www.wordfence.com/blog/2026/06/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/ | 379 |
| 5 | CVE-2026-10829: Remote code execution in Moxa NPort, 8.6 rating 🔥
A stack-based buffer overflow in Moxa NPort allows an attacker to corrupt memory by sending crafted input. It could achieve remote code execution with root privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/12mUL
👉 Dork: http.title:"NPort Web Console" OR http.headers.server:"MoxaHttp" OR http.body:"NPort Web Console" OR http.body:"<TITLE>OnCell" OR http.body:"<TITLE>Moxa OnCell"
Vendor's advisory:
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v | 477 |
| 6 | CVE-2026-48062: Arbitrary code execution in CodeIgniter, 9.8 rating 🔥
Uploaded file extension validation bypass in PHP framework CodeIgniter may in some cases lead to arbitrary code execution.
Search at Netlas.io:
👉 Link: https://nt.ls/HPzgw
👉 Dork: tag.name:codeigniter
Vendor's advisory:
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx | 436 |
| 7 | CVE-2026-47367 and other: Improper Input Validation vulnerabilities in Ubiquiti UniFi OS, 9.9 rating 🔥
Several improper input validation and other weaknesses allow low-privileged attacker to execute command injection and possible to compromise network.
Search at Netlas.io:
👉 Link: https://nt.ls/TczjZ
👉 Dork: tag.name:"ubiquiti_unifi"
Vendor's advisory:
https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a | 535 |
| 8 |  CVE-2026-47759 - CVE-2026-47762: Four XSS vulnerabilities in TinyMCE, 8.7 rating 🔥
Four recently disclosed Cross-Site Scripting (XSS) vulnerabilities allow remote attacker to inject malicious scripts into web pages.
Search at Netlas.io:
👉 Link: https://nt.ls/DRDw1
👉 Dork: tag.name:"tinymce"
Read more:
https://github.com/tinymce/tinymce/security | 505 |
| 9 | CVE-2026-44494: Full Man-in-the-Middle via Prototype Pollution Gadget in Axios, 8.7 rating 🔥
The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows an attacker intercept, read, and modify all outgoing HTTP requests including authentication credentials.
Search at Netlas.io:
👉 Link: https://nt.ls/emv2w
👉 Dork: tag.name:"axios"
Read more:
https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh | 947 |
| 10 | 📘 Attackers no longer need custom malware.
Legitimate Remote Monitoring & Management (RMM) tools like AnyDesk, ScreenConnect, TeamViewer, Atera, and others are increasingly being weaponized for initial access, persistence, and ransomware operations.
Our latest research breaks down how threat actors abuse RMM platforms, common attack chains, detection opportunities, and defensive measures.
👉 Read the blog: https://netlas.io/blog/weaponized_rmm/ | 554 |
| 11 |  CVE-2026-47783 & CVE-2026-47784: Two SASL vulnerabilities in Memcached, 8.1 rating 🔥
Two new vulnerabilities Memcached allow an attacker to enumerate valid usernames on the system and guess their passwords because password and username data for SASL password database authentication has a timing side channel.
Search at Netlas.io:
👉 Link: https://nt.ls/zZBd0
👉 Dork: memcached.version:<1.6.42
Read more:
https://github.com/memcached/memcached/wiki/ReleaseNotes1642 | 664 |
| 12 | CVE-2026-34908, CVE-2026-34909 & CVE-2026-34910: Vulnerabilities in Ubiquiti UniFi OS, 10.0 rating 🔥🔥🔥
Three new vulnerabilities in Ubiquiti UniFi OS allow an network attacker to make unauthorized changes, access files and execute arbitrary command. It may cause to full device compromise.
Search at Netlas.io:
👉 Link: https://nt.ls/oMQHo
👉 Dork: tag.name:"ubiquiti_unifi"
Vendor's advisory:
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b | 650 |
| 13 | CVE-2026-46354: Token theft in Coder, 9.1 rating 🔥
New vulnerability in Coder allows an attacker on any Azure VM to steal an agent session token, and with the stolen token get access to Git SSH private key, OAuth access tokens or workspace secrets.
Search at Netlas.io:
👉 Link: https://nt.ls/JwI80
👉 Dork: http.favicon.hash_sha256:05d85ef30160f0c790ba0acf9470dae35a85a90a2b79387fe4b6994852c1dbf4 OR http.meta:"https://coder.com/docs" OR http.unknon_headers.key:"x_coder_request_id" OR http.unknown_headers.key:"x_coder_build_version"
Vendor's advisory:
https://github.com/advisories/GHSA-6x44-w3xg-hqqf | 556 |
| 14 | Totally new 0-day RCE vulnerability in NGINX. Again 😱
New zero-day RCE vulnerability named nginx-poolslip targets the latest mainline release 1.31.0.
Search at Netlas.io:
👉 Link: https://nt.ls/k1sOO
👉 Dork: tag.name:nginx
Read more:
https://x.com/nebusecurity/status/2057071579876753643 | 550 |
| 15 | 📓 Discovering Data Exposure with Netlas
A practical walkthrough of how security researchers can use Netlas to identify exposed / leaked sensitive data across internet-facing systems.
✔ Methods for finding leaked data
✔ Common exposure patterns
✔ Real-world search techniques
👉 Read the article: https://netlas.io/blog/discovering_data_exposure_with_netlas/ | 420 |
| 16 |  🌍 Netlas v1.8 is live
Private Scanner now supports Scanner Locations!
Run scans from different countries to see infrastructure from multiple geographic perspectives.
New in this release:
✓ Distributed Scanner Locations
✓ Location details in reports & API
✓ UI polish and ASD bug fixes.
👉 Details: https://docs.netlas.io/changelog/ | 380 |
| 17 | CVE-2026-44789, CVE-2026-44790 & CVE-2026-44791: 3 new vulnerabilities in n8n, 9.4 rating 🔥
Recently disclosed vulnerabilities in n8n allow an attacker to read arbitrary files from the server, achieve global prototype pollution and bypass the patch for previous vulnerability (CVE-2026-42232).
Search at Netlas.io:
👉 Link: https://nt.ls/dRB5p
👉 Dork: http.title:"n8n.io - Workflow Automation"
Read more:
https://github.com/n8n-io/n8n/security | 409 |
| 18 | CVE-2026-42945: 18-Year-Old vulnerability in NGINX, 9.2 rating 🔥
Heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source allows an unauthenticated attacker to lead NGINX worker process to restart by sending crafted HTTP requests. Additionally, in some cases code execution is possible. This vulnerability is already being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/9xSvG
👉 Dork: tag.name:nginx
Vendor's advisory:
https://my.f5.com/manage/s/article/K000161019 | 476 |
| 19 | CVE-2026-42897: Microsoft Exchange Server spoofing vulnerability, 8.1 rating 🔥
New spoofing vulnerability in on-premise Microsoft Exchange Server hits OWA and allows an unauthorized attacker to execute malicious code by sending a specially crafted email to a user. This vulnerability is already being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/64QAo
👉 Dork: tag.name:"microsoft_exchange"
Vendor's advisory:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897 | 540 |
| 20 |  CVE-2026-44194 & CVE-2026-45158: Two RCE vulnerabilities in OPNsense, 9.1 rating 🔥
Two vulnerabilities in OPNsense allows an authenticated attacker to execute arbitrary code as root on the firewall host via User management system (CVE-2026-44194) and DHCP Config (CVE-2026-45158). PoC already available!
Search at Netlas.io:
👉 Link: https://nt.ls/S0qIg
👉 Dork: tag.name:opnsense
Vendor's advisory:
https://github.com/opnsense/core/security | 519 |
