Attackers got into the Northflank hosting platform and used customers' AI service keys without permission. Those keys can be used to run up bills or access AI services as if they were the customer.

1. How it works:
2. Attacker breaches Northflank
3. Platform secrets exposed
4. AI API keys obtained
5. Keys used by attacker
6. Attacker uses customers' AI API keys

A blockchain analysis firm had an intruder get into some internal tools. The intruder could see basic customer contact details, such as names and email addresses.

1. How it works:
2. External actor
3. Internal tools accessed
4. Customer identity data
5. Customers at risk
6. Customer contact details exposed to attacker

Attackers who already have a login to Ivanti Connect Secure, a remote-access VPN gateway, can upload files of their choosing to a predictable place on the server. Attackers are actively using this flaw.

1. How it works:
2. Attacker logs in
3. Uploads crafted file
4. Chains with other flaws
5. Gateway compromised
6. Attacker gains control of VPN gateway

A person who already has a login on the Ivanti VPN server can use a flaw to take over the whole server. Attackers are already using it.

1. How it works:
2. Local account holder
3. Broker trusts DSCache
4. Privilege escalation
5. Attacker gains control
6. Attacker controls the Ivanti appliance as root

A fake copy of a popular AI coding helper was available for about 11 hours and could quietly give attackers secret remote access to developers' computers. Anyone who installed it may need to clean up their machine and check their SSH keys.

1. How it works:
2. Attacker publishes fake
3. Cursor marketplace listing
4. Developer installs it
5. Backdoor installed
6. Attacker has persistent SSH access to developers' machines

A bug in WordPress itself could let an outsider take control of a website without logging in. Attackers have started trying to use it within hours of the fix being released.

1. How it works:
2. Attacker scans sites
3. Sends crafted requests
4. Server runs attacker code
5. Data and site at risk
6. Attacker gains control of the site

Attackers can reach store pages and data they should not be able to see or change, such as orders. Attacks are already happening against online shops.

1. How it works:
2. Attacker
3. Direct request
4. Missing check
5. Store data
6. Attacker reads or alters store data

Hackers stole a huge amount of cryptocurrency from Binance, one of the world's largest crypto exchanges, after breaking into an employee's work laptop. Some of the stolen funds have been frozen, but most of the damage is still being assesse

1. How it works:
2. Attacker targets engineer
3. Laptop compromised
4. Internal access gained
5. Assets moved out
6. About $6.3 billion in assets stolen

Scam emails pretending to come from Anthropic, the AI company, are getting into inboxes even though they have obvious warning signs. Those emails can trick people into clicking links or handing over information.

Attackers slipped malicious code into the Polymarket website through a outside service. While signed-in users used the site, their funds were moved to attacker wallets.

1. How it works:
2. Attacker compromises vendor
3. Malicious script swapped in
4. Signed-in user loads site
5. Funds moved out
6. Attacker drains trader funds

A bug in how Linux handles network connections can let an outsider with no password take full control of a server. Attackers can reach it over the internet if the server accepts connections.

1. How it works:
2. Remote attacker
3. Crafted SYN packets
4. Freed memory reused
5. Code runs in kernel
6. Attacker runs commands as root

Hackers got into a contractor's computer systems that send notices for federal bankruptcy courts, and those notices were delayed for weeks. The contractor says no data was taken.

Attackers are abusing recently patched PHP bugs to take control of servers and firewalls that are reachable from the internet. Some of these attacks have reached government-affiliated systems.

1. How it works:
2. Attacker scans
3. Exploits PHP2Shell
4. Gains shell access
5. Chains Fragnesia
6. Attacker controls the server as root

Someone with no login could send a specially crafted pattern in a GitLab pipeline setting and run their own commands on the GitLab server. Attackers are already trying this, so unpatched servers need updating now.

1. How it works:
2. Attacker crafts pattern
3. Request reaches GitLab
4. Regex not validated
5. Code runs on server
6. Attacker runs code on GitLab server

Attackers used a trick to get into software projects hosted on GitHub, and some of them are still inside. If your team builds or ships code there, someone unwanted may still have access.

1. How it works:
2. Campaign launched
3. Projects compromised
4. Developer endpoints
5. Cloud access
6. Attackers keep access inside developer environments

Attackers can sneak into the systems that manage a company's SD-WAN network without a password and gain admin rights. From there they can change how the network is set up and steal the keys that encrypt traffic.

1. How it works:
2. Unauthenticated attacker
3. Peering auth bypassed
4. Admin account obtained
5. NETCONF access
6. Attacker controls SD-WAN network and steals keys

Records on tens of thousands of Homeland Security employees and contractors were posted publicly online, including contact details and information about sensitive assignments. Anyone who had their details exposed could be targeted by scams

1. How it works:
2. Attacker gets access
3. Okta SSO system
4. Staff records stolen
5. Published online
6. 41,000 staff records exposed publicly

A travel-industry software provider used by Japan Airlines was hacked, and some customers' personal details may have been stolen. Passport numbers and contact details are among the data reported as taken.

1. How it works:
2. Attacker breaches system
3. Amadeus PSS compromised
4. Passenger data stolen
5. Customers at risk
6. Passenger personal data exposed to criminals

A person who already has administrator access to VMware ESX servers can do things that leave no record in the logs. That makes it harder to notice or investigate an intrusion.

1. How it works:
2. Admin access gained
3. Hidden operations
4. Audit trail gaps
5. Intrusion goes undetected in logs

A bug in the Linux operating system's core can let an attacker quietly change data that the system treats as trusted, and chained with other flaws it can give them full control of the server. Attackers are already using it.

1. How it works:
2. Attacker sends traffic
3. Kernel coalesces buffers
4. ESP decrypts in place
5. Webshell implanted
6. Attacker runs commands as root

Attackers can send a specially crafted request to a Cisco firewall's VPN login page and make it restart, cutting off network access. Attacks are already happening in the wild.

1. How it works:
2. Attacker sends request
3. Request reaches firewall
4. Logic error triggers
5. Firewall reloads
6. Firewall goes down, network access lost

A state-sponsored hacking group is routing its attacks through chains of hijacked routers, cameras and other small devices, which makes the attacks hard to trace. The group has used this method to exploit previously unknown security flaws.

1. How it works:
2. Volt Typhoon operator
3. Rotating device chain
4. Zero-day exploit
5. Strategic access
6. Attacker gains hidden access to high-value systems

A car rental company in Japan had personal information leaked, including driver's license details for about 1.46 million people. Those people could face fraud or identity theft.

Attackers are disguising their scanning programs as legitimate AI company bots. If your systems leak passwords or access keys, these bots can find them and let attackers in.

1. How it works:
2. Threat actor
3. Impersonated AI bots
4. Exposed systems
5. Credentials found
6. Attacker gains usable credentials

Attackers send fake messages that get people to approve a login code on a real Microsoft-style sign-in page, handing over access to work accounts without the attacker ever needing the password. Most of the targets are US organizations.

1. How it works:
2. Phishing message sent
3. User starts device login
4. User enters attacker's code
5. Tokens issued to attacker
6. Attacker gains access to corporate accounts

Attackers can trick Oracle PeopleSoft into reaching its own hidden admin area, which can let them take control of the system. A criminal group called ShinyHunters has been using it since May.

1. How it works:
2. Attacker sends request
3. SSRF triggered
4. Loopback trusted
5. Internal interface reached
6. Attacker reaches internal management functions

Hackers broke into a Japanese cloud service that gives customers remote Windows computers. They threatened to lock up data with ransomware, so customers were told to unplug their PCs from the internet and shut them down.

1. How it works:
2. Attacker breaches service
3. Extortion demand
4. Ransomware threatened
5. Customers disconnect
6. Customer systems at risk of ransomware

Attackers reportedly altered a shared tracking script used by Convertr so it could copy shoppers' credit card details while they pay. Anyone entering card information on affected stores may be at risk.

1. How it works:
2. Skimming group
3. Analytics script
4. Shopper browser
5. Card data copied
6. Shoppers' card data is stolen

Hackers targeted the US Federal Election Commission's website, and its electronic filing system was shut down. People who need to file campaign reports electronically may be unable to do so until it is back.

A weakness lets someone upload a file of a dangerous type to the shop software, which can let them run their own code on the site and take over a logged-in user's account. The attacker typically needs a victim to visit a malicious link or a

1. How it works:
2. Attacker crafts link
3. Victim visits page
4. Malicious file processed
5. Code runs in user context
6. Attacker controls victim's account and session

Hackers may have broken into Moldova's government online services and taken people's personal information. Officials warn more attacks like this could follow.

Hackers, possibly including foreign government groups, attacked the Ohio state auditor's public website, so the state temporarily shut that server down. The state says Ohioans' personal financial information is not believed to be at risk.

Attackers used AI software to automate parts of breaking into organizations in Japan. The AI helped run the attacks faster, with less manual work by the attacker.

1. How it works:
2. Operator sets goal
3. AI agents coordinate
4. Scan exposed targets
5. Access organization servers
6. Attackers gain automated access to victim systems

A cyberattack locked up computer systems at a major hospital network, so ambulances were diverted and many appointments were cancelled. A criminal group has claimed responsibility.

1. How it works:
2. Ransomware group
3. Systems breached
4. Services disrupted
5. Care impacted
6. Health system operations halted

An outside attacker got into Capcom's account system and reached personal data for millions of player accounts. Some accounts reportedly had their passwords changed, so you could be locked out.

1. How it works:
2. Attacker
3. Capcom ID
4. Account data
5. Passwords
6. Accounts exposed and some locked out

Scammers got hold of personal details of military members from a Pentagon data system. Those details can be used to impersonate people or open accounts in their names.

A criminal group called SafePay locks up company computers and files, then demands payment to unlock them. Law enforcement says they have hit at least 600 organizations since August 2024.

Companies that provide IT services to UK police forces were hacked several times, and police data held by those companies may have been exposed. Attackers got in through the suppliers rather than directly through police systems.

1. How it works:
2. Hackers
3. Supplier systems
4. Police data
5. Police data exposed via suppliers

Attackers got a secret key that proves Keystone crypto wallets are genuine. With that key they could make fake wallets that look real, so buyers could lose their crypto.

1. How it works:
2. Attacker breaches website
3. Verification key stolen
4. Counterfeit devices built
5. Buyer trusts fake
6. Counterfeit wallets could steal buyers' crypto

Hackers got into a test system at the University of Copenhagen that held personal information. About 525,000 people may have had their details exposed, and some PIN codes were exposed too.

1. How it works:
2. Hackers gain access
3. Test environment reached
4. Personal data accessed
5. PIN codes exposed
6. Personal data and PINs exposed

Attackers hide instructions inside ordinary text files that AI coding helpers read. The helper may follow those hidden instructions as if you had asked for them, possibly taking actions you did not intend.

1. How it works:
2. Attacker plants file
3. Project includes file
4. AI agent reads it
5. Agent acts on text
6. Assistant performs attacker-chosen actions

A cybercrime group used a hacking tool called ARTEX AI to break into more than 90 organizations in South Korea and steal millions of personal records. Anyone whose data was held by those organizations may be at risk of scams or identity mis

1. How it works:
2. Former pentester
3. ARTEX AI framework
4. 90+ organizations
5. 8.2M records
6. Millions of records stolen

Hackers have hidden malicious code in about 953 online shops, mostly ones built on Magento. Shoppers visiting these stores may have that code run in their browser without knowing it.

1. How it works:
2. Threat actor
3. Store compromised
4. Visitor loads page
5. Malicious loader runs
6. Shopper's browser runs attacker code

Attackers are using stolen GitHub access tokens to take passwords and cloud keys from software developers' code projects. Anyone whose project or access tokens are caught in this could have their cloud accounts and private data exposed.

1. How it works:
2. Attacker abuses tokens
3. Repositories accessed
4. Secrets harvested
5. Cloud access gained
6. Attacker reaches cloud secrets and data

Criminals pose as IT support in Microsoft Teams chats and talk people into installing malicious software. That software can lock files for ransom or steal data.

1. How it works:
2. Fake IT account
3. External Teams chat
4. Employee trusts it
5. Malware installed
6. Attacker gains access to the organization

Hackers are getting into internet-connected Dahua security cameras and video recorders. Once inside, they can watch live video, change settings, and create their own login accounts.

1. How it works:
2. Attacker scans
3. Weak access
4. Device taken over
5. Accounts added
6. Attacker keeps control of the cameras

A feature that shortens long chats with OpenAI's AI models could be misused to read the model's private reasoning, which is normally hidden from users. Competitors could use that to copy the model more cheaply.

1. How it works:
2. Attacker uses compaction
3. Reasoning exposed
4. Traces copied
5. Rival model distilled
6. Hidden AI reasoning is copied

Attackers tricked people into signing in through a fake relay that copied their login session. They then reused that copied session to get into email accounts without needing the password again.

1. How it works:
2. Phishing lure
3. AitM relay
4. User signs in
5. Token stolen
6. Attacker reads email at compromised accounts

Attackers who steal GitHub login tokens are adding hidden automated jobs to code projects that print the project's passwords and keys into the build logs. The attackers then download those logs and delete them, so the secrets leave without

1. How it works:
2. Stolen token
3. Plant workflow
4. Secrets in logs
5. Download logs
6. Repository secrets are stolen

Attackers are actively using a serious weakness in F5 BIG-IP APM, a device that controls who can log in to a company's internal systems. If left unpatched, an outsider could potentially get into systems they should not reach.

A state-linked hacking group broke into ConnectWise's cloud backup software and used an AI-driven tool to speed up attacks on many customer accounts. Organizations that use this backup product may have been targeted.

1. How it works:
2. Storm-0940 actor
3. ConnectWise backup app
4. ARTEX AI tool
5. 2,200+ tenants
6. Many customer tenants exposed to attackers

A popular AI developer tool was compromised by attackers who secretly ran programs that collected passwords and access keys from its build system. Anyone who installed a bad version of the package could have had their own credentials stolen

1. How it works:
2. Master key leaked
3. Malicious workflows
4. Release pipeline hijacked
5. Users install bad version
6. Attacker harvests credentials from many users

Criminal groups reportedly used AI tools to run break-ins with less human effort, making attacks faster and easier to scale. Their goal is to steal data and demand payment.

Attackers got into company network gateways that let staff connect from home, and took tens of thousands of usernames and passwords. Those stolen logins could let attackers move deeper into company networks.

1. How it works:
2. Attacker scans
3. Device breached
4. Credentials stolen
5. Internal access
6. Attackers gain entry to victim networks

A hacker got into a system that some labs and clinics use to order patient tests, and patient records may have been stolen. If you have had blood or lab tests through Quest Diagnostics, your personal health information could be affected.

1. How it works:
2. Threat actor
3. Quanum LSM access
4. Patient records
5. Notification
6. Patient records potentially exposed

Hackers got into Capcom's account system and copied millions of customer email addresses. They also changed the passwords on some accounts, so affected players may be locked out.

1. How it works:
2. Attacker breaches system
3. Customer data copied
4. Passwords changed
5. Customer emails and some accounts compromised

Anyone with a login to the VeloCloud management server, even a read-only customer account, can gain top-level control over it. Attackers are already using this flaw.

1. How it works:
2. Attacker with login
3. SQL injection
4. Operator privileges
5. Internal functions
6. Attacker controls the orchestrator

A widely used compression library can be tricked by a specially crafted compressed file or web response into corrupting memory. This can crash programs, leak data, or in some cases let an attacker run their own code.

1. How it works:
2. Attacker sends crafted data
3. Target decompresses it
4. Memory overflow occurs
5. Attacker gains control
6. Attacker may run code or steal memory

Some digital certificates from an Indian certificate authority (eMudhra/emSign) were stolen, so attackers could pose as trusted secure websites. Updates now stop your software from trusting them.

1. How it works:
2. CA keys compromised
3. Attacker signs fake cert
4. App connects to fake server
5. Traffic intercepted
6. Client trusts impostor server

Attackers could potentially inject and run unwanted code on Cisco Expressway video-collaboration servers. Cisco found these problems itself and has released a software update to fix them.

Attackers can send specially crafted input that makes Cisco Expressway devices fail in an uncontrolled way. Cisco confirms this flaw is being exploited.

A bug in Cisco Expressway, the video and call gateway, can cause the software to crash or misbehave. Cisco confirms it is being exploited.

A flaw in Cisco Expressway video-collaboration servers can make the device stop working when a specially crafted input reaches a certain internal check. Cisco says attackers have used this flaw.

Attackers can send specially crafted data that makes Cisco Expressway devices write memory outside its allowed space, which can crash them or let attackers take control. Cisco confirms this is being exploited.

1. How it works:
2. Attacker sends crafted input
3. Expressway processes it
4. Memory written out of bounds
5. Device crashes or is compromised
6. Attacker may take control of the device

Attackers may be able to sneak database commands into normal requests and read or change data stored by the phone system. Cisco confirms this flaw is being exploited.

1. How it works:
2. Attacker sends crafted input
3. Input not sanitized
4. Database runs attacker query
5. Data read or changed
6. Attacker reads or alters server database

Attackers could send specially crafted input that these Cisco phone and calling servers do not properly check, which may let them cause problems or take control of the system. Cisco has released updates to fix it.

Attackers may be able to inject malicious code into web pages used to manage Cisco phone and calling systems. A user who opens a crafted link could have their session or actions hijacked.

1. How it works:
2. Crafted input
3. Page rendered unsafely
4. Admin opens page
5. Session hijacked
6. Attacker controls the admin's session

Attackers may be able to get past the login checks on Cisco phone and calling servers without valid credentials. Cisco confirms this is being exploited, so treat these servers as at risk.

1. How it works:
2. Attacker targets server
3. Login check bypassed
4. Admin access gained
5. Calling system controlled
6. Attacker controls the voice system

Attackers may be able to take control of Cisco phone and voice servers without logging in. Cisco has confirmed the flaw is being exploited, so patching quickly matters.

Snort 3, a network inspection engine inside some Cisco products, has flaws that could let an attacker overload it so it slows down or stops working. Cisco says these were found in its own review and that the issue is already being exploited

1. How it works:
2. Attacker sends traffic
3. Snort 3 processes it
4. Resources consumed
5. Device slows or fails
6. Network inspection disrupted or halted

A flaw in Cisco's Snort 3 security software could let someone gain more access on the system than they should have. Cisco says this flaw has been used in real attacks.

Cisco's Snort 3 security engine has a bug in how it does some internal math, which can cause a security flaw. Cisco has confirmed it is being exploited.

Snort is a network security tool that inspects traffic. Bugs in it can let an attacker write data outside the memory space meant for it, which can crash the tool or let the attacker run their own commands.

1. How it works:
2. Attacker sends traffic
3. Snort 3 parses data
4. Out-of-bounds write
5. Device compromised
6. Attacker may gain control of the device

Attackers took over more than 300 relay computers used by the Tor anonymity network. They used them to secretly send some people's remote-login attempts to fake servers that recorded their passwords.

1. How it works:
2. Attacker hijacks relays
3. SSH traffic redirected
4. Passwords captured
5. Credentials stolen
6. Attacker collects SSH passwords

Oracle's business software has a flaw that lets someone on the internet take control of part of it without logging in. Attackers have started scanning for systems that have not yet been updated.

1. How it works:
2. Attacker scans
3. Crafted HTTP request
4. SQL injection
5. Code execution
6. Attacker takes over the Oracle EBS component

Attackers can send a crafted web request that makes PHP crash its memory handling and then run their own commands on the server. Attacks on this flaw are confirmed in the wild.

1. How it works:
2. Attacker sends request
3. Memory left uninitialized
4. Cleanup reads bad memory
5. Code execution
6. Attacker controls the server

A flaw in the PHP software that runs many websites lets an outsider send crafted requests and make the server run their commands. The attacker does not need a password, and attacks against this flaw are already happening.

1. How it works:
2. Attacker sends request
3. PHP mishandles memory
4. Code runs on server
5. Data taken
6. Attacker controls the server

Some digital certificates used to prove a website is genuine were compromised. Attackers holding them could pose as a trusted server to apps built with Electron if they can intercept network traffic.

1. How it works:
2. Attacker obtains certificate
3. Intercepts traffic
4. Impersonates server
5. Electron app trusts it
6. Attacker impersonates a trusted server to the app

Attackers on the internet may be able to pretend to be trusted internal parts of the product and get past the login check. Once inside, they can read, add, or change files on the device that runs your remote support.

1. How it works:
2. Remote attacker
3. Internal component
4. Login bypassed
5. File operations
6. Attacker gains file control on the appliance

Siemens Software Center loads helper files (DLLs) from folders it searches in an unsafe order. A logged-in user on the same computer can drop a fake helper file there, and the program will run it with its own permissions.

1. How it works:
2. Local attacker
3. Plant fake DLL
4. Software Center starts
5. Code executes
6. Attacker runs code with Software Center privileges

A flaw in SiteGuard Server Edition lets an attacker type commands that the server then runs on its own. Because those commands run with the highest system rights, the attacker can take full control of the machine.

A flaw in the document editing server bundled with the Nextcloud app lets an outsider send a crafted request and run commands on the machine. Attackers are already using it.

1. How it works:
2. Attacker sends request
3. CODE server is down
4. Command injection
5. Code runs on server
6. Attacker controls the Nextcloud server

An attacker can send a specially crafted email attachment to the email gateway and take control of the device, without needing a password. Attacks are already happening.

1. How it works:
2. Attacker sends email
3. Gateway processes attachment
4. Path traversal write
5. Command execution
6. Attacker controls the email appliance as root

Someone who already has a login to the firewall's management page could run their own commands with full control of the device. Because the firewall guards your network, that control could let them reach or change everything behind it.

1. How it works:
2. Attacker with login
3. Reaches management interface
4. Injects malicious code
5. Runs as root
6. Attacker controls the firewall

Attackers can get past the login screen without a password and then run commands on the device. The device is a remote-access gateway, so attackers could reach the internal network behind it.

1. How it works:
2. Remote attacker
3. Spoofed request
4. Auth bypass
5. Command execution
6. Attacker controls the VPN appliance

A flaw in a core part of Windows lets an outsider sneak commands into the system and get past a protection feature, without needing a password. Attackers are already using it.

1. How it works:
2. Remote attacker
3. Network access
4. Windows Shell
5. Security bypass
6. Attacker bypasses Windows protections remotely

Attackers who don't have a login can read certain files on your Atlassian server, and some of those files may hold secrets. Attackers are already using this flaw.

1. How it works:
2. Attacker sends request
3. Request reaches server
4. Server returns file
5. Sensitive data exposed
6. Attacker reads sensitive files from the server

Attackers can send a specially crafted request to the backup server and make it run their own commands on the machine. Attacks on this flaw have been confirmed.

1. How it works:
2. Remote attacker
3. Internet
4. AhsayCBS endpoint
5. OS command runs
6. Attacker controls the backup server

Attackers on the internet can trick the backup server into letting them in without valid credentials. Anyone who gets in can view or change the backup data it holds.

1. How it works:
2. Remote attacker
3. Crafted API request
4. checkSysPwd bypassed
5. Backup access
6. Attacker gains unauthorized access to backups

A flaw in Citrix NetScaler appliances can let an outsider knock the device offline by sending it crafted traffic. These devices sit at the edge of many company networks, so an outage can cut off remote access for everyone.

1. How it works:
2. Attacker
3. Internet
4. NetScaler appliance
5. Service crash
6. Remote access and gateway services go down

Attackers can send specially crafted web requests to FortiMail email security appliances and write files anywhere on the system, without logging in. This can let them take control of the device.

1. How it works:
2. Unauthenticated attacker
3. Crafted HTTP request
4. Path traversal bypass
5. Arbitrary file written
6. Attacker gains control of the appliance

A normal account on the Zammad server could take over the entire server, including all its data. Attackers who already have a foothold on the machine can use this to get full control.

1. How it works:
2. Local account
3. Privilege flaw
4. Root access
5. Data exposed
6. Attacker gains root on the server

Attackers can take over a logged-in user's session in Zammad, the help desk software, and from there run their own commands on the server. Anyone who can reach an unpatched Zammad over the internet is at risk.

1. How it works:
2. Attacker
3. Session fixation
4. Session hijack
5. Remote code execution
6. Attacker controls the Zammad server

Attackers on the internet can send a specially crafted web request that skips the login check and gets full administrator access to the management system. Anyone who can reach that system can then control the network it manages.

1. How it works:
2. Remote attacker
3. Crafted HTTP request
4. SD-WAN Manager API
5. Admin session
6. Attacker controls the SD-WAN Manager

A specially crafted file can make an Apple device run an attacker's code without the user doing much. Apple reports this was used in very targeted attacks against specific people.

1. How it works:
2. Attacker crafts file
3. Victim opens file
4. Memory overwritten
5. Code runs
6. Attacker controls the device

Attackers on the internet can send specially crafted traffic to Citrix NetScaler devices and run their own code on them, or crash them. Attackers are already doing this in the wild.

1. How it works:
2. Remote attacker
3. Crafted request
4. NetScaler device
5. Code execution
6. Attacker controls the NetScaler device

Attackers on the internet may be able to send specially crafted requests to Citrix NetScaler devices and make them run commands, without needing a password. These devices sit at the edge of company networks, so a compromise can give attacke

1. How it works:
2. Unauthenticated attacker
3. Crafted request sent
4. Input not validated
5. Arbitrary command runs
6. Attacker controls the NetScaler appliance

Someone on the internet without a login could trick WordPress into loading a PHP file it should not, which can let them take control of the website server. Attacks on this flaw are confirmed.

1. How it works:
2. Unauthenticated attacker
3. Crafted page request
4. WordPress includes file
5. Code executes
6. Attacker controls the web server

A flaw in Plex Media Server can let someone with admin rights plant a file that the server then runs on its own, which can take control of the server. Attackers are already using this flaw.

1. How it works:
2. Admin account
3. Set transcoder option
4. Write .so file
5. Server startup
6. Attacker runs code on the server

A logged-in Plex user can trick the server into fetching web addresses it should not reach, including systems inside your own network. Attackers already use this flaw in real attacks.

1. How it works:
2. Attacker logs in
3. Crafted transcode request
4. Server makes request
5. Internal systems reached
6. Internal network reached through Plex server

A flaw in Plex Media Server's web page lets an attacker trick it into running hidden functions in its plugins, using specially crafted web addresses. Attackers are already using it, so update quickly.

1. How it works:
2. Attacker crafts URL
3. Server processes input
4. Plugin function called
5. Unintended actions run
6. Attacker controls plugin actions on server

A flaw lets someone with any valid login token make your Plex server send outgoing requests to a website or system of their choosing. This can be used to probe your internal network or reach services you did not intend to expose.

1. How it works:
2. Attacker sends request
3. Plex server
4. Forced outgoing POST
5. Internal or external target
6. Attacker uses server to reach targets

Attackers can reach the router's remote login service without a password and make it run commands. They can then create, overwrite, or read configuration and diagnostic files on the device.

1. How it works:
2. Unauthenticated attacker
3. Connects to SSH
4. Session opens
5. Exec command runs
6. Attacker controls router files and settings

A logged-in user with some access can send specially crafted input that makes SharePoint run code they should not be able to run. Attackers are already using this flaw.

1. How it works:
2. Authorized attacker
3. Network request
4. Code injection
5. Code execution
6. Attacker runs code on SharePoint server

A person who already has admin login on these Fortinet devices can abuse certain command-line commands to change or delete files they should not be able to reach. This can break the device or let them hide further changes.

1. How it works:
2. Admin account
3. Crafted CLI command
4. Escape directory
5. Write or delete files
6. Device files tampered or destroyed

Attackers who can reach the Strapi admin login page can ask it sneaky questions and get back private account details, including password reset codes. With those codes they can take over admin accounts.

1. How it works:
2. Unauthenticated attacker
3. Crafted GET request
4. Strapi API responds
5. Reset token leaked
6. Attacker gains Super Administrator access

Attackers can trick the document server into saving files outside the folder it should use, which can let them run their own code on the machine. Attackers are actively exploiting this.

1. How it works:
2. Attacker sends request
3. Request reaches server
4. Path traversal occurs
5. Code executed
6. Attacker controls the server

A specially crafted network request can make the BIND DNS server stop running. When it crashes, computers relying on it may lose name lookups and websites or services may stop working.

1. How it works:
2. Attacker
3. Internet
4. BIND server
5. named exits
6. DNS service goes offline

Attackers on the internet can send a specially crafted web request and make the server run commands they choose. This can give them full control of the affected website or application.

1. How it works:
2. Attacker sends request
3. Request reaches site
4. Expression evaluated
5. Code executes
6. Attacker controls the server

A file-transfer server called ProFTPD has a weakness that lets someone outside the network copy or overwrite files on the server without logging in properly. Attackers can use it to steal or tamper with data.

1. How it works:
2. Remote attacker
3. ProFTPD server
4. Arbitrary files
5. Attacker reads and writes server files