Tessera
Folgen

Suriq - Always on Watch

@suriq.io

Managed security for the servers you run, built on Wazuh. We catch what is being exploited and tell you exactly what to do. suriq.io

415 Posts35 Follower10 Folgt
Suriq - Always on Watch@suriq.io · 4h ago

CVE-2026-100874 is a remotely exploitable SQL injection flaw in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A public exploit has been published per VulDB. The project ships as a rolling release and no fixed version is available.

CVE-2026-100874 is a remotely exploitable SQL injection flaw in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A public exploit has been published per VulDB. The project ships as a

CVE-2026-100874 is a remotely exploitable SQL injection flaw in mathurvishal's CloudClassroom-PHP-Project, a PHP web application. A public exploit has been published per VulDB. The project ships as a rolling release and no fixed version is available.

cve.org

Suriq - Always on Watch@suriq.io · 6h ago

CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway: two memory overflow flaws that can cause denial of service and a TCP sequence-number prediction issue. Citrix has released fixes in 14.1-73.37 and 13.1-64.23.

CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway: two memory overflow flaws that can cause denial of service and a TCP sequence-number prediction issue. Citrix

CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway: two memory overflow flaws that can cause denial of service and a TCP sequence-number prediction issue. Citrix has released fixes in 14.1-73.37 and 13.1-64.23.

cve.org

Suriq - Always on Watch@suriq.io · yesterday

CVE-2026-82294, CVE-2026-82300 and CVE-2026-94396: Elastic patched three uncontrolled resource consumption flaws in Elasticsearch that can cause denial of service. No exploitation is confirmed. Update to 8.19.22, 9.4.8 or 9.5.4.

CVE-2026-82294, CVE-2026-82300 and CVE-2026-94396: Elastic patched three uncontrolled resource consumption flaws in Elasticsearch that can cause denial of service. No exploitation is confirmed. Update

CVE-2026-82294, CVE-2026-82300 and CVE-2026-94396: Elastic patched three uncontrolled resource consumption flaws in Elasticsearch that can cause denial of service. No exploitation is confirmed. Update to 8.19.22, 9.4.8 or 9.5.4.

cve.org

Suriq - Always on Watch@suriq.io · 2d ago

CVE-2026-100311: A cross-site scripting flaw in mathurvishal's CloudClassroom-PHP-Project affects the Faculty Video Management component, allowing remote script injection. A public exploit is available per the CVE record. No fixed version is disclosed.

CVE-2026-100311: A cross-site scripting flaw in mathurvishal's CloudClassroom-PHP-Project affects the Faculty Video Management component, allowing remote script injection. A public exploit is availabl

CVE-2026-100311: A cross-site scripting flaw in mathurvishal's CloudClassroom-PHP-Project affects the Faculty Video Management component, allowing remote script injection. A public exploit is available per the CVE record. No fixed version is disclosed.

cve.org

Suriq - Always on Watch@suriq.io · 2d ago

🚨 BREAKING A stranger with no login can upload a PHP file and run it on your WooCommerce store. Request a Quote for WooCommerce (through 2.9.2) has a critical file-upload flaw, and there is no patch yet. Disable the popup quote form now. (CVE-2026-18143)

Request a Quote WooCommerce CVE-2026-18143: Unauth RCE, No Patch

CVE-2026-18143 is a critical unauthenticated file-upload flaw in Request a Quote for WooCommerce (through 2.9.2), with no patch yet. Act now.

suriq.io

Suriq - Always on Watch@suriq.io · 3d ago

CVE-2026-0014 is a local persistent denial-of-service flaw in Google Android, from improper input validation in AppOpsService. It affects Android 14 through 16. Google shipped a fix in the March 2026 Android Security Bulletin. No exploitation is confirmed.

CVE-2026-0014 is a local persistent denial-of-service flaw in Google Android, from improper input validation in AppOpsService. It affects Android 14 through 16. Google shipped a fix in the March 2026

CVE-2026-0014 is a local persistent denial-of-service flaw in Google Android, from improper input validation in AppOpsService. It affects Android 14 through 16. Google shipped a fix in the March 2026 Android Security Bulletin. No exploitation is confirmed.

source.android.com

Suriq - Always on Watch@suriq.io · 3d ago

CVE-2026-97846: Red Hat Keycloak's Standard Token Exchange V2 does not verify mTLS holder-of-key binding, letting an attacker with stolen client credentials obtain an unrestricted token. No fix is available yet.

CVE-2026-97846: Red Hat Keycloak's Standard Token Exchange V2 does not verify mTLS holder-of-key binding, letting an attacker with stolen client credentials obtain an unrestricted token. No fix is ava

CVE-2026-97846: Red Hat Keycloak's Standard Token Exchange V2 does not verify mTLS holder-of-key binding, letting an attacker with stolen client credentials obtain an unrestricted token. No fix is available yet.

access.redhat.com

Suriq - Always on Watch@suriq.io · 3d ago

CVE-2026-65660 is a code injection flaw in Microsoft SharePoint Server allowing authenticated remote code execution. The Canadian Centre for Cyber Security reports active exploitation. Apply Microsoft's security updates for the affected editions.

CVE-2026-65660 is a code injection flaw in Microsoft SharePoint Server allowing authenticated remote code execution. The Canadian Centre for Cyber Security reports active exploitation. Apply Microsoft

CVE-2026-65660 is a code injection flaw in Microsoft SharePoint Server allowing authenticated remote code execution. The Canadian Centre for Cyber Security reports active exploitation. Apply Microsoft's security updates for the affected editions.

cve.org

Suriq - Always on Watch@suriq.io · 3d ago

CVE-2026-56737: phpMyFAQ's two-factor login endpoint grants access on a valid TOTP code and chosen user ID alone, without verifying the password, allowing an authentication bypass on 2FA-enabled accounts. Fixed in phpMyFAQ 4.1.6. No exploitation confirmed.

CVE-2026-56737: phpMyFAQ's two-factor login endpoint grants access on a valid TOTP code and chosen user ID alone, without verifying the password, allowing an authentication bypass on 2FA-enabled accou

CVE-2026-56737: phpMyFAQ's two-factor login endpoint grants access on a valid TOTP code and chosen user ID alone, without verifying the password, allowing an authentication bypass on 2FA-enabled accounts. Fixed in phpMyFAQ 4.1.6. No exploitation confirmed.

github.com

Suriq - Always on Watch@suriq.io · 3d ago

CVE-2026-93405 affects Mailspring, the open-source email client from Foundry376. A stored cross-site scripting flaw in attachment quick preview lets a crafted attachment run script when opened. Fixed in version 1.17.0. No exploitation confirmed.

CVE-2026-93405 affects Mailspring, the open-source email client from Foundry376. A stored cross-site scripting flaw in attachment quick preview lets a crafted attachment run script when opened. Fixed

CVE-2026-93405 affects Mailspring, the open-source email client from Foundry376. A stored cross-site scripting flaw in attachment quick preview lets a crafted attachment run script when opened. Fixed in version 1.17.0. No exploitation confirmed.

cve.org

Suriq - Always on Watch@suriq.io · 3d ago

🔴 EXPLOITED Check Point is patching two flaws in its firewalls and management servers, both 9.8 and both exploited now. One ran silent as a zero-day for two months. Patch, then hunt: the fix won't tell you if you were already hit. (CVE-2026-93616 / CVE-2026-85102)

Check Point CVE-2026-93616 & 85102: 9.8 Pre-Auth RCEs Exploited

Check Point CVE-2026-93616 and CVE-2026-85102 are two 9.8 pre-auth flaws exploited in the wild and on CISA's KEV list. Patch, then hunt for compromise.

suriq.io

Suriq - Always on Watch@suriq.io · 3d ago

CVE-2026-12559: OpenText reports a stored cross-site scripting flaw in its Vendor Invoice Management for SAP Solutions Capture Validation application that could run unauthorized script in a user's browser. No exploitation confirmed. Apply OpenText's update.

CVE-2026-12559: OpenText reports a stored cross-site scripting flaw in its Vendor Invoice Management for SAP Solutions Capture Validation application that could run unauthorized script in a user's bro

CVE-2026-12559: OpenText reports a stored cross-site scripting flaw in its Vendor Invoice Management for SAP Solutions Capture Validation application that could run unauthorized script in a user's browser. No exploitation confirmed. Apply OpenText's update.

cve.org

Suriq - Always on Watch@suriq.io · 4d ago

CVE-2026-89078 and CVE-2026-93577: GitLab CE/EE let an authenticated user run arbitrary code via a crafted regular expression in CI/CD configuration. GitLab fixed both in 19.2.7, 19.3.3 and 19.4.1. No exploitation confirmed.

CVE-2026-89078 and CVE-2026-93577: GitLab CE/EE let an authenticated user run arbitrary code via a crafted regular expression in CI/CD configuration. GitLab fixed both in 19.2.7, 19.3.3 and 19.4.1. No

CVE-2026-89078 and CVE-2026-93577: GitLab CE/EE let an authenticated user run arbitrary code via a crafted regular expression in CI/CD configuration. GitLab fixed both in 19.2.7, 19.3.3 and 19.4.1. No exploitation confirmed.

cve.org

Suriq - Always on Watch@suriq.io · 4d ago

CVE-2026-67221: RabbitMQ's AMQP 1.0 shovel stores connection URI passwords in cleartext, readable by monitoring-tagged users via the shovel status API and CLI. Fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0. No exploitation has been reported.

CVE-2026-67221: RabbitMQ's AMQP 1.0 shovel stores connection URI passwords in cleartext, readable by monitoring-tagged users via the shovel status API and CLI. Fixed in versions 3.13.15, 4.0.20, 4.1.1

CVE-2026-67221: RabbitMQ's AMQP 1.0 shovel stores connection URI passwords in cleartext, readable by monitoring-tagged users via the shovel status API and CLI. Fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0. No exploitation has been reported.

github.com

Suriq - Always on Watch@suriq.io · 4d ago

CVE-2026-95602 is an authorization bypass in the YITH WooCommerce Request A Quote plugin for WordPress, affecting versions before 4.46.1. An unauthenticated user can access data through a user-controlled key. YITH fixed it in 4.46.1; update to that release.

CVE-2026-95602 is an authorization bypass in the YITH WooCommerce Request A Quote plugin for WordPress, affecting versions before 4.46.1. An unauthenticated user can access data through a user-control

CVE-2026-95602 is an authorization bypass in the YITH WooCommerce Request A Quote plugin for WordPress, affecting versions before 4.46.1. An unauthenticated user can access data through a user-controlled key. YITH fixed it in 4.46.1; update to that release.

cve.org

Suriq - Always on Watch@suriq.io · 5d ago

CVE-2026-63278 affects LibreOffice from The Document Foundation: crafted document links could expand environment variable or INI file values and exfiltrate that data to a remote server on open. Fixed in LibreOffice 26.2.5. No exploitation confirmed.

CVE-2026-63278 affects LibreOffice from The Document Foundation: crafted document links could expand environment variable or INI file values and exfiltrate that data to a remote server on open. Fixed

CVE-2026-63278 affects LibreOffice from The Document Foundation: crafted document links could expand environment variable or INI file values and exfiltrate that data to a remote server on open. Fixed in LibreOffice 26.2.5. No exploitation confirmed.

libreoffice.org

Suriq - Always on Watch@suriq.io · 6d ago

CVE-2026-61630: nginx-ignition, an open-source web UI for nginx by lucasdillmann, allows a TOTP two-factor code to be reused within its 30-second validity window on accounts with OTP 2FA enabled. Fixed in version 2.35.1. No exploitation confirmed.

CVE-2026-61630: nginx-ignition, an open-source web UI for nginx by lucasdillmann, allows a TOTP two-factor code to be reused within its 30-second validity window on accounts with OTP 2FA enabled. Fixe

CVE-2026-61630: nginx-ignition, an open-source web UI for nginx by lucasdillmann, allows a TOTP two-factor code to be reused within its 30-second validity window on accounts with OTP 2FA enabled. Fixed in version 2.35.1. No exploitation confirmed.

github.com

Suriq - Always on Watch@suriq.io · 6d ago

Cisco ISE and Kong Gateway had the week's marquee flaws, and both were auth bypasses in the identity appliances themselves (two Cisco bugs CVSS 10.0, one in CISA KEV). A bypass yields a valid session, so the auth log looks normal. Where to hunt:

The gatekeeper was the target: identity appliances got bypassed

This week's exploited flaws were in the access-control layer itself: Cisco ISE (two CVSS 10.0, in CISA KEV) and Kong Gateway's SAML bypass.

suriq.io

Suriq - Always on Watch@suriq.io · 6d ago

CVE-2026-95503: a flaw in the Kerberos federation provider of Red Hat build of Keycloak lets an adjacent-network attacker spoof the KDC and bypass authentication when Kerberos password login is used without SPNEGO. No exploitation is confirmed.

CVE-2026-95503: a flaw in the Kerberos federation provider of Red Hat build of Keycloak lets an adjacent-network attacker spoof the KDC and bypass authentication when Kerberos password login is used w

CVE-2026-95503: a flaw in the Kerberos federation provider of Red Hat build of Keycloak lets an adjacent-network attacker spoof the KDC and bypass authentication when Kerberos password login is used without SPNEGO. No exploitation is confirmed.

access.redhat.com

Suriq - Always on Watch@suriq.io · last wk.

Brevo, the email platform once called Sendinblue, was abused to inject malware into up to 100,000 sites. The script swap happened at Brevo's CDN, so site files never changed and integrity checks stayed quiet. Embed its code? Audit your third-party scripts.

Brevo Hack Injected Malware at the CDN Edge, Evading Site Checks

Attackers abused Brevo (formerly Sendinblue) to inject malware into up to 100,000 sites at the CDN edge, so origin files never changed and checks missed it.

suriq.io

Suriq - Always on Watch@suriq.io · last wk.

CVE-2026-93991: An authorization bypass in Argo Workflows lets a namespace-scoped user list archived workflows from other namespaces. Versions 4.1.0 through 4.1.3 are affected. Upgrade to 4.1.4. No exploitation confirmed.

CVE-2026-93991: An authorization bypass in Argo Workflows lets a namespace-scoped user list archived workflows from other namespaces. Versions 4.1.0 through 4.1.3 are affected. Upgrade to 4.1.4. No ex

CVE-2026-93991: An authorization bypass in Argo Workflows lets a namespace-scoped user list archived workflows from other namespaces. Versions 4.1.0 through 4.1.3 are affected. Upgrade to 4.1.4. No exploitation confirmed.

cve.org

Suriq - Always on Watch@suriq.io · last wk.

🔴 EXPLOITED Cisco Identity Services Engine has a second CVSS 10 zero-day under active attack: CVE-2026-76460, an unauthenticated API auth bypass. Same admin interface as last week's exploited flaw. Affects ISE 3.1-3.5. Patch now.

Cisco ISE CVE-2026-76460: Exploited Auth-Bypass Zero-Day, Patch

CVE-2026-76460 is an unauthenticated API auth bypass in Cisco ISE, CVSS 10.0, actively exploited and in CISA KEV. Patch ISE 3.1-3.5 to the fixed build now.

suriq.io

Suriq - Always on Watch@suriq.io · last wk.

CVE-2026-4327: the WordPress plugin The Welcomizer (sebwordpress), versions up to and including 2.8.1, lets subscriber-level users run arbitrary code via a missing authorization check. No fixed version is listed in the CVE record; treat as unpatched.

CVE-2026-4327: the WordPress plugin The Welcomizer (sebwordpress), versions up to and including 2.8.1, lets subscriber-level users run arbitrary code via a missing authorization check. No fixed versio

CVE-2026-4327: the WordPress plugin The Welcomizer (sebwordpress), versions up to and including 2.8.1, lets subscriber-level users run arbitrary code via a missing authorization check. No fixed version is listed in the CVE record; treat as unpatched.

cve.org

Suriq - Always on Watch@suriq.io · last wk.

CVE-2026-18442: the WCFM Marketplace plugin for WooCommerce (wclovers), versions up to and including 3.8.2, has an unauthenticated SQL injection flaw that can expose database contents. No exploitation confirmed. Update to the latest patched version.

CVE-2026-18442: the WCFM Marketplace plugin for WooCommerce (wclovers), versions up to and including 3.8.2, has an unauthenticated SQL injection flaw that can expose database contents. No exploitation

CVE-2026-18442: the WCFM Marketplace plugin for WooCommerce (wclovers), versions up to and including 3.8.2, has an unauthenticated SQL injection flaw that can expose database contents. No exploitation confirmed. Update to the latest patched version.

cve.org

Suriq - Always on Watch@suriq.io · last wk.

CVE-2026-14323: The Printcart Store Web to Print Product Designer for WooCommerce plugin for WordPress, by Printcart, has an unauthenticated arbitrary file read flaw in all versions up to and including 2.8.5. No fixed version is stated and no exploitation is confirmed.

CVE-2026-14323: The Printcart Store Web to Print Product Designer for WooCommerce plugin for WordPress, by Printcart, has an unauthenticated arbitrary file read flaw in all versions up to and includin

CVE-2026-14323: The Printcart Store Web to Print Product Designer for WooCommerce plugin for WordPress, by Printcart, has an unauthenticated arbitrary file read flaw in all versions up to and including 2.8.5. No fixed version is stated and no exploitation is confirmed.

cve.org

Suriq - Always on Watch@suriq.io · last wk.

CVE-2026-89278: The GPTranslate plugin for WordPress by john-dagelmore exposes plaintext third-party AI provider API keys to unauthenticated visitors in versions up to and including 2.34.6. No fixed version is listed; affected sites should rotate exposed keys.

CVE-2026-89278: The GPTranslate plugin for WordPress by john-dagelmore exposes plaintext third-party AI provider API keys to unauthenticated visitors in versions up to and including 2.34.6. No fixed v

CVE-2026-89278: The GPTranslate plugin for WordPress by john-dagelmore exposes plaintext third-party AI provider API keys to unauthenticated visitors in versions up to and including 2.34.6. No fixed version is listed; affected sites should rotate exposed keys.

cve.org