Watch FloorMar 2, 7:00 PM to Mar 3, 7:00 PM ET
Daily brief, Tuesday, March 3, 2026
2 newly exploited, 33 new critical CVEs, 1 new breaches.
Breaking
Nothing spreading fast in technology large companies run.
Newly exploited in the wild
- 8.1CVE-2026-22719 Broadcom VMware Aria OperationsCISA KEVUnauthenticated attackers can run arbitrary commands, leading to remote code execution in VMware Aria Operations during support-assisted product migration.
- 7.8CVE-2026-21385 Qualcomm Multiple ChipsetsCISA KEVMultiple Qualcomm chipsets contain a memory corruption flaw triggered during memory allocation using alignments, which lets an attacker corrupt memory.
New public exploit code
No new Nuclei templates, Metasploit modules, Exploit-DB or VulnCheck XDB entries.
New critical CVEs
- 10.0CVE-2026-24898 Openemr openemrexploit codeDetectionAffected: OpenEMR prior to version 8.0.0. Attacker gains: Unauthenticated MedEx API tokens. Recommended action: Update OpenEMR to version 8.0.0 or later.
- 9.8CVE-2026-3136 Google cloud buildAn improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer a
- 10.0CVE-2026-28289 Freescout freescoutFreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE
- 9.8CVE-2026-1492 DetectionThe User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. Thi
- 9.9CVE-2026-24848 Open-Emr openemrOpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary locations on t
- 9.8CVE-2026-27971 Qwik qwikDetectionQwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP r
- 9.8CVE-2026-3485 Dlink dir-868l firmwareDetectionA flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has been published
- 9.8CVE-2024-55020 Weintek easywebA command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.
- 9.8CVE-2025-59059 Apache rangerRemote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
- 9.8CVE-2026-2628 The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as ot
- 9.1CVE-2026-26279 Froxlor froxlorFroxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to s
- 9.8CVE-2025-70240 Dlink dir-513 firmwareStack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51.
- 9.8CVE-2025-70237 Dlink dir-513 firmwareStack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr.
- 9.8CVE-2025-70234 Dlink dir-513 firmwareStack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS.
- 9.8CVE-2025-70239 Dlink dir-513 firmwareStack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55.
- 9.8CVE-2026-22891 Libbiosig Project libbiosigA heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can provide a mali
- 9.8CVE-2025-70236 Dlink dir-513 firmwareStack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter.
- 9.8CVE-2025-70241 Dlink dir-513 firmwareStack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5.
- 9.1CVE-2025-66945 Zdir zdirA path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially re
- 9.8CVE-2026-3204 Devolutions devolutions serverImproper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
13 more critical CVEs in this window: see them on the dashboard.
Ransomware
No leak-site posts collected.
New data breaches
- Provecho provecho.bio712,904 accounts
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Leak-site data: RansomLook, CC BY 4.0; sectors grouped and countries mapped by Watch Floor. Breaking stories as RSS or JSON. watchfloor.fyi
About · Sources · Privacy · Terms · Accessibility · Contact · Support Watch Floor · Powered by MikeGPT