VulnTracking

Here’s your Monday report on immediate and emerging threats. Powered by the CrowdSec Network. Adobe Commerce and Magento “StyleSmuggler” RCE (CVE-2026-75650): Exploited Before the Patch, Now Sprayed From Home Internet Connections. CVE-2026-75650 (“StyleSmuggler”) is a CVSS 10.0 unauthenticated remote code execution flaw in Adobe Commerce 2.4.4 to 2.4.9 and Magento Open Source 2.4.6 to 2.4.9. […]

CVE-2023-54391 is a critical Proxmox VE authentication bypass. CrowdSec observed 133 IPs sending matching exploitation attempts after disclosure.

CVE-2026-33497 is a high-severity Langflow path traversal flaw that can expose its JWT signing key. CrowdSec observed 275 IPs targeting the vulnerability.

CVE-2026-63030 (WP2Shell) is under active exploitation, with CrowdSec observing 62,802 attacking IPs targeting vulnerable WordPress sites.

CVE-2024-12847 is a critical RCE affecting NETGEAR DGN1000 routers. CrowdSec has tracked over 50,000 attacking IPs exploiting this decade-old flaw.

CVE-2026-2652 is an MLflow authentication bypass exposing protected API endpoints without credentials. CrowdSec tracks active exploitation targeting MLflow servers.

CVE-2026-48282 is a critical path traversal-to-RCE vulnerability affecting Adobe ColdFusion. CrowdSec observes active exploitation targeting exposed RDS-enabled ColdFusion servers.

CVE-2026-63030 (WP2Shell) is a critical SQL injection-to-RCE vulnerability affecting WordPress core. CrowdSec observes rapid exploitation targeting internet-facing WordPress sites.

CVE-2026-8451 is a high-severity SAML memory overread vulnerability affecting Citrix NetScaler ADC and Gateway. CrowdSec observes active exploitation targeting internet-facing appliances.

CVE-2026-39808 is a critical OS command injection vulnerability in Fortinet FortiSandbox. CrowdSec observes early exploitation targeting internet-facing security appliances.

CVE-2026-20253 is a critical authentication bypass vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. CrowdSec observes early exploitation targeting exposed instances.

CVE-2026-10520 is a critical pre-authentication OS command injection vulnerability in Ivanti Sentry. CrowdSec observes active exploitation targeting internet-facing edge gateways.

CVE-2026-8181 is a critical authentication bypass vulnerability in the WordPress Burst Statistics plugin. CrowdSec observes active exploitation targeting internet-facing sites

CVE-2026-4020 exposes sensitive system and plugin data through the Gravity SMTP WordPress plugin. CrowdSec observes active exploitation against internet-facing sites

CVE-2026-9082 is a critical SQL injection vulnerability in Drupal JSON: API endpoints. CrowdSec observes active exploitation targeting internet-facing Drupal sites.

CVE-2024-9643 is a critical authentication bypass in Four-Faith F3x36 routers. Attackers are actively exploiting exposed devices for botnet and infrastructure takeover campaigns.

CVE-2025-20362 is an authentication bypass in Cisco ASA and FTD VPN services. Attackers continue targeting exposed internet-facing firewall infrastructure.

CVE-2026-41940 is a critical cPanel & WHM authentication bypass. Attackers can gain admin access to hosting servers, with reconnaissance already underway

CVE-2026-21643 is a critical SQL injection in FortiClient EMS now actively exploited. Attackers target exposed management servers to access and manipulate sensitive data.

CVE-2026-21445 is a critical Langflow authentication bypass now actively exploited. Attackers can access AI workflows, user data, and transaction history without login.

CVE-2025-4396 is a critical SQL injection vulnerability in the WordPress Relevanssi plugin. Over 16,500 IPs are actively exploiting it in widespread automated attacks.

CVE-2026-3055 affects Citrix NetScaler with active exploitation observed. Learn how this critical memory leak works and how to protect your systems.

CVE-2026-1207, a Django SQL injection flaw, is now actively exploited in the wild. Discover how attackers operate and how to protect your systems.

CrowdSec detects a surge of exploitation attempts targeting CVE-2026-23744, a critical RCE vulnerability in MCPJam Inspector exposing AI development environments.

CVE-2025-20281 is a critical CVSS 10.0 RCE vulnerability in Cisco Identity Services Engine (ISE). CrowdSec observes a new surge of exploitation attempts targeting exposed REST APIs

CVE-2026-21859 is a critical SSRF vulnerability in Mailpit actively exploited in targeted attacks. Learn how it exposes internal networks.

CVE-2025-14528 is a vulnerability in EoL D-Link routers. Learn why and how it is used to build botnets.

CVE-2025-56520 is actively exploited in Dify, exposing AI platforms to SSRF-driven reconnaissance, internal scanning, and potential credential theft.

CVE-2026-1281 is an actively exploited RCE vulnerability in Ivanti EPMM. Learn how to detect, mitigate, and protect your infrastructure.

Mass exploitation targets Zimbra via new LFI (CVE-2025-68645) and persistent XSS flaws. Learn attack trends, risks, and how to protect.

CVE-2025-34291 is an actively exploited RCE vulnerability in LangFlow. Learn how to detect, mitigate, and protect your AI infrastructure.

Critical WSUS RCE CVE-2025-59287 is under active exploitation. Learn how attackers target Windows update infrastructure and how to defend your systems.

CVE-2024-20767 is actively exploited in Adobe ColdFusion. CrowdSec observed a surge in attacks & explains impact, trends, & how to protect your systems.

Active exploitation targets CVE-2025-59718, a critical Fortinet auth bypass. See detection insights and mitigation steps.

React2Shell (CVE-2025-55182) attacks surged from 500 to 10K+ daily. Learn what changed, attacker trends, and how to protect with CrowdSec.

Learn about CVE-2025-55182, the React2Shell vulnerability that turns a frontend flaw into backend access. Discover its impact & how to protect your apps.

CVE-2025-64095 is being actively probed, allowing attackers to upload and overwrite files on DNN sites. CrowdSec intelligence reveals early exploitation trends.

CVE-2025-54236 enables attackers to seize Magento sessions & escalate to RCE. See CrowdSec’s exploitation data, timeline, & protection guidance.

CVE-2025-64446 allows attackers to bypass authentication in FortiWeb. Deploy CrowdSec WAF to secure your systems.

CrowdSec detects rising exploitation of XWiki CVE-2025-55748, a path traversal flaw exposing sensitive configs, not yet in CISA KEV.

CrowdSec detects active exploitation of CVE-2025-54249 in Adobe Experience Manager (AEM), an SSRF flaw exposing internal services.

Discover key insights on emerging CVEs and exploitation attempts in the September edition of the CrowdSec VulnTracking Report.

Discover key insights on emerging CVEs and exploitation attempts in the July edition of the CrowdSec VulnTracking Report.

Discover key insights on emerging CVEs and exploitation attempts in the June edition of the CrowdSec VulnTracking Report.

Discover key insights on emerging CVEs and exploitation attempts in the May edition of the CrowdSec VulnTracking Report.

Discover key insights on emerging CVEs and exploitation attempts in the April edition of the CrowdSec VulnTracking Report.

We are excited to launch our latest series, the CrowdSec VulnTracking Reports. In these monthly reports, we will be exploring key insights on emerging vulnerabilities and CVE exploitation trends, as spotted by the CrowdSec Network. In March 2025, we added detection for 34 vulnerabilities and/or exploits to our database — translating into scenarios for the […]