Netlas.io

CVE-2026-102255: Pre-authentication SSRF via unintended forward-proxy in SonicWall SMA1000, 10.0 rating ‍🔥 SonicWall recently disclosed a critical pre-authentication SSRF vulnerability in its SMA1000 appliances. An unauthenticated attacker can exploit this flaw to make the appliance send requests on their behalf, reach internal functionality, and perform unauthorized actions. This vulnerability has also been observed being exploited in the wild! Search at Netlas.io: 👉 Link: https://nt.ls/fbAnv 👉 Dork: http.headers.server:"SMA" OR http.title:"SonicWall Workplace" OR (http.title:"Workplace" AND http.body:"SonicWall") Vendor's advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CVE-2026-76268 and others: Multiple vulnerabilities in Splunk Enterprise, up to 9.8 rating ‍🔥 Splunk has disclosed multiple vulnerabilities in Splunk Enterprise. The most serious is CVE-2026-76268, which allows an unauthenticated attacker to execute operating system commands through the Patroni REST API. Search at Netlas.io: 👉 Link: https://nt.ls/GWmyZ 👉 Dork: http.title:"login - splunk" OR http.headers.server:"splunkd" OR http.unknown_headers.key:"x_splunk_version" Vendor's advisory: https://advisory.splunk.com/advisories/SVD-2026-1001

CVE-2026-106445 & CVE-2026-106446: Two RCE flaws in Handlebars.js, up to 9.8 rating ‍🔥 Two recently disclosed vulnerabilities in Handlebars.js allow an attacker to run arbitrary JavaScript on the server. Both the technical details and PoC exploit code are now public! Search at Netlas.io: 👉 Link: https://nt.ls/KMYBH 👉 Dork: tag.name:"handlebars" Vendor's advisory: https://github.com/handlebars-lang/handlebars.js/security/advisories

🎯 Netlas v1.10 Track changes in your attack surface with the new private scan comparison. See which targets, services, and CVE matches appeared, disappeared, or changed. ✔ Compare scans in the UI and via API ✔ Rebuild attack surfaces with clearer guidance and fewer questions ✔ Discover building automation devices with KNXnet/IP support ✔ Explore host references with linked_hosts ✔ Try experimental misconfiguration detection, initially focused on SQL services 👉 Full changelog: https://docs.netlas.io/changelog/

CVE-2026-88779: DoS vulnerability in Citrix NetScaler ADC & Gateway, 8.7 rating ‍🔥 A recently disclosed memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to Denial of Service when configured as a SAML SP or IdP. This vulnerability is being actively exploited in the wild! Search at Netlas.io: 👉 Link: https://nt.ls/1PpoX 👉 Dork (NetScaler ADC): http.headers.set_cookie:"citrix_ns_id" OR http.headers.set_cookie:"ns_af" OR http.headers.set_cookie:"NSC_" OR http.headers.set_cookie:"NSC_ESNS" 👉 Dork (NetScaler Gateway): http.title:"citrix gateway" OR http.headers.set_cookie:"pwcount" OR http.favicon.hash_sha256:7b2fe2b7235b6645998edcae988ce1edaac40764c202abc3a4766db1b8ae6360 OR http.favicon.hash_sha256:3e8f8b98d8fe34a5e627c3033f0940777144effe4b5f588c67bfc6ba3bf106fa Vendor's advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

CVE-2026-96940: EoP vulnerability in MS Exchange Server, 8.8 rating ‍🔥 Microsoft has updated its September 2026 Exchange Server security updates, addressing only one new vulnerability. It allows an authenticated attacker to elevate privileges over a network and gain unauthorized access to other users' mailboxes within the same organization. Search at Netlas.io: 👉 Link: https://nt.ls/L5NIL 👉 Dork: tag.name:"microsoft_exchange" Vendor's advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

CVE-2026-63292 and others: Multiple vulnerabilities in Apache HTTP Server, up to 9.8 rating ‍🔥 Apache Software Foundation disclosed 20 new vulnerabilities. The most severe can lead to RCE, arbitrary code execution via stack-based buffer overflow, and DoS/potential RCE via use-after-free. Memory corruption, privilege escalation, and info disclosure bugs were also patched. Search at Netlas.io: 👉 Link: https://nt.ls/fFMkT 👉 Dork: tag.name:"apache" Vendor's advisory: https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2026-88771 & CVE-2026-887722: RCE and/or DoS in Citrix NetScaler ADC and NetScaler Gateway, both rated 9.5 ‍🔥 Citrix disclosed two exploited vulnerabilities. The first (CVE-2026-88771) allows an unauthenticated attacker to run arbitrary commands. It affects all NetScaler ADC and NetScaler Gateway deployments. The second (CVE-2026-88772) leads to RCE or DoS. It affects appliances with DTLS enabled. These vulnerabilities are already being actively exploited in the wild, and PoCs exist! Search at Netlas.io: 👉 Link: https://nt.ls/m5KaR 👉 Dork (NetScaler Gateway): http.title:"citrix gateway" OR http.headers.set_cookie:"pwcount" OR http.favicon.hash_sha256:7b2fe2b7235b6645998edcae988ce1edaac40764c202abc3a4766db1b8ae6360 OR http.favicon.hash_sha256:3e8f8b98d8fe34a5e627c3033f0940777144effe4b5f588c67bfc6ba3bf106fa Vendor's advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVE-2026-13016 and others: Multiple vulnerabilities in ServiceNow, up to 9.3 Rating 🔥 Recently disclosed vulnerabilities in ServiceNow include an unauthenticated SQL injection flaw and multiple authorization bypasses. Search at Netlas.io: 👉 Link: https://nt.ls/BxHZZ 👉 Dork: http.body:"<title>ServiceNow</title>" OR http.favicon.hash_sha256:41b71be5f4ce761e9772c2a5ab8afe5b3e7cfb56226597fc406155b868531a0e OR http.headers.set_cookie:"glide_user" Vendor's advisory: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623

CVE-2026-88804: Unauthenticated update of public UI settings leading to stored XSS in Rancher, 9.4 Rating 🔥 An unauthenticated attacker can plant malicious content that runs in the browser of anyone visiting the Rancher login page. This can leak the local administrator bootstrap password or hijack an active admin session, leading to complete control of the Rancher installation and its managed downstream clusters. Search at Netlas.io: 👉 Link: https://nt.ls/dtxM5 👉 Dork: http.favicon.hash_sha256:2d7adbc74e7c8941927d04e702acbff577d219fef8617c8c3014d34ae395525b OR http.body:"<title>Rancher</title>" OR http.unknown_headers.key:"x_api_cattle_auth" Vendor's advisory: https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f

CVE-2026-87902: Path Traversal in WordPress leading to RCE, 9.2 Rating 🔥 Another newly disclosed WordPress RCE vulnerability allows an unauthenticated attacker to execute arbitrary code under specific server conditions. Search at Netlas.io: 👉 Link: https://nt.ls/B4TJE 👉 Dork: tag.name:"wordpress" Vendor's advisory: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp

CVE-2026-93952: Improper Input Validation in VeloCloud Orchestrator, 10.0 Rating 🔥 A recently disclosed improper input validation vulnerability in on-premises VeloCloud Orchestrator (VCO) allows a remote attacker to access privileged internal functionality and impact the VCO host. This vulnerability is known to be actively exploited in the wild! Search at Netlas.io: 👉 Link: https://nt.ls/Z9gGT 👉 Dork: http.body:"single-spa-application:@velocloud/vco-header" OR http.body:"vco/branding.css" OR http.body:"vco/favicon" Vendor's advisory: https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183

CVE-2026-13684 and others: Multiple vulnerabilities in Synology DSM, up to 9.8 Rating 🔥 Synology has disclosed 8 vulnerabilities in DiskStation Manager (DSM); 2 of them allow a remote unauthenticated attacker to read or write files and cause a denial of service on affected devices. Search at Netlas.io: 👉 Link: https://nt.ls/dgzix 👉 Dork: tag.name:"synology_diskstation" Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

11 new vulnerabilities in WordPress, no CVE assigned yet ❗️ WordPress 7.1.1 security release patches 11 vulnerabilities including stored XSS, path traversal, and other security flaws. Search at Netlas.io: 👉 Link: https://nt.ls/s3kOE 👉 Dork: tag.name:"wordpress" Vendor's advisory: https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

CVE-2026-20329 and others: Multiple vulnerabilities in Cisco ASA, up to 9.9 Rating 🔥 Cisco has disclosed multiple vulnerabilities in Cisco ASA, which allow a remote authenticated attacker to cause system instability or run arbitrary actions via improper exception handling. Other disclosed flaws can lead to improper access control, validation errors, and other security-relevant issues. Search at Netlas.io: 👉 Link: https://nt.ls/ci994 👉 Dork: snmp.banner:"Cisco Adaptive Security Appliance" OR snmp.banner:"Cisco ASA" OR http.headers.set_cookie:"webvpn" OR http.body:"+CSCOE+" Vendor's advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-asaftdfmc-uvpPROhN

CVE-2026-61642: Request smuggling is possible in Squid proxy, 7.7 Rating 🔥 A recently disclosed vulnerability in Squid proxy allows a trusted client to poison the web cache and store arbitrary malicious content at any URL, which can then be delivered to other clients in response to their future requests. Search at Netlas.io: 👉 Link: https://nt.ls/B7WF8 👉 Dork: http.headers.server:"squid" Read more: https://github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6

CVE-2026-78006 & CVE-2026-78159: Two unauthenticated vulnerability chains leading to RCE in The Events Calendar Plugin for WordPress, 9.8 Rating 🔥 Two critical vulnerabilities were recently disclosed in The Events Calendar Plugin for WordPress. The first uses PHP Object Injection to execute arbitrary OS commands on the underlying server. The second allows an unauthenticated attacker to reset an administrator’s password, after which the attacker can upload a malicious plugin and take complete control of the site. The first vulnerability (CVE-2026-78006) is already being exploited in the wild! Search at Netlas.io: 👉 Link: https://nt.ls/mEm8O 👉 Dork: http.body:"plugins/the-events-calendar" Read more: https://www.wordfence.com/blog/2026/09/wordfence-argus-identifies-two-critical-unauthenticated-vulnerability-chains-leading-to-remote-code-execution-in-the-events-calendar-plugin/

🔌 Plug & Pwn: Mapping the Windows PnP Auto-Install Attack Surface Windows Plug & Play can automatically install signed vendor software with SYSTEM privileges. With RDP USB redirection, this attack surface may also be reachable remotely — no physical USB device required. Look at how this attack works and how Netlas can help map exposed RDP infrastructure. 👉 https://netlas.io/blog/windows_pnp_auto_install_attack_surface/

CVE-2026-85102 and CVE-2026-85103: Two RCE Vulnerabilities in Check Point Products, 9.8 Rating 🔥 Two critical VPN-related vulnerabilities recently disclosed in Check Point Security Gateways, firewall appliances, and the Security Management Server could allow unauthenticated remote code execution under specific conditions. Both vulnerabilities exist in the way the products handle VPN certificates. Search at Netlas.io: 👉 Link: https://nt.ls/hJmZ6 👉 Dork: http.headers.server:"CPWS" OR http.favicon.hash_sha256:78bd48391c96c6ac257e74e109783cc2750b39ea144a849f8d830f4f8f279267 OR http.favicon.hash_sha256:475a554d9a6c971ebf248fe45bcecafbab2b663edd7f080486a995c877dd1216 OR http.body:"TITLE>GAiA</TITLE>" OR path:"/sslvpn/Login/Login" OR http.headers.set_cookie:"CheckCookieSupport" Vendor's advisory: https://community.checkpoint.com/t5/General-Topics/Action-Required-Critical-Security-Advisory-VPN-Vulnerabilities/td-p/281995

CVE-2026-67401: SQL Injection Vulnerability in cPanel, 9.9 Rating 🔥 A vulnerability in cPanel's EmailTrack component allows an authenticated attacker with mail-related privileges to create arbitrary files on the server via SQL injection. This may lead to code execution as the root user, giving the attacker full control of the server. Search at Netlas.io: 👉 Link: https://nt.ls/dIEpd 👉 Dork: http.title:cpanel OR http.headers.set_cookie:"cprelogin" OR http.headers.set_cookie:"cpsession" Vendor's advisory: https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026