Watch FloorJun 2, 8:00 PM to Jun 3, 8:00 PM ET
Daily brief, Wednesday, June 3, 2026
1 newly exploited, 9 new critical CVEs, 1 new breaches.
Breaking
Nothing spreading fast in technology large companies run.
Newly exploited in the wild
New public exploit code
No new Nuclei templates, Metasploit modules, Exploit-DB or VulnCheck XDB entries.
New critical CVEs
- 9.8CVE-2026-45247 Mirasvit Mirasvit Full Page Cache WarmerKEVexploit codeDetectionAn unauthenticated attacker achieves remote code execution with Mirasvit Full Page Cache Warmer.
- 9.1CVE-2026-46244 Linux linux kernelIn the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all e
- 9.1CVE-2026-46266 Linux linux kernelIn the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);
- 9.9CVE-2025-14771 Abb t-mac plusFiles or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
- 9.8CVE-2026-47065 Apache minaZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.rea
- 9.8CVE-2026-35075 Mbs-Solutions universal gateway firmwareAn unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
- 9.8CVE-2026-36576 An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request.
- 9.6CVE-2026-5241 Huggingface transformersA vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, inte
- 9.0CVE-2026-36748 RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
Ransomware
No leak-site posts collected.
New data breaches
- DentaQuest dentaquest.com2,553,599 accounts
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Breaking stories as RSS or JSON. watchfloor.fyi
Powered by MikeGPT