Daily brief, Thursday, July 16, 2026

Breaking

Nothing spreading fast in technology large companies run.

Newly exploited in the wild

• 9.8CVE-2026-58644 Microsoft SharePointCISA KEVDetectionAn attacker gains remote code execution with Microsoft SharePoint.
• 9.1CVE-2026-39808 Fortinet FortiSandboxCISA KEVDetectionAn attacker gains arbitrary system command execution and remote code execution on the Fortinet FortiSandbox appliance.
• 9.1CVE-2026-25089 Fortinet FortiSandboxCISA KEVAn attacker gains remote code execution and full control of the Fortinet FortiSandbox appliance.

New public exploit code

No new Nuclei templates, Metasploit modules, Exploit-DB or VulnCheck XDB entries.

New critical CVEs

• 9.1CVE-2026-39808 Fortinet FortiSandboxKEVexploit codeDetection+1 more CVEs in the same releaseAn attacker gains arbitrary system command execution and remote code execution on the Fortinet FortiSandbox appliance.
• 9.8CVE-2026-58644 Microsoft SharePointKEVexploit codeDetectionAn attacker gains remote code execution with Microsoft SharePoint.
• 9.8CVE-2026-53412 Zoom workplace desktopImproper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.
• 9.3CVE-2026-59865 Microsoft kiotaKiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the s
• 9.3CVE-2026-59866 Microsoft kiotaKiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generat
• 9.3CVE-2026-59864 Microsoft kiotaKiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into ge
• 9.3CVE-2026-54733 Microsoft o365-moodleThe Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-d
• 9.8CVE-2026-63087 Grafana-Cold-Storage oncallGrafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values
• 9.8CVE-2026-3031 TOKUHIROM Image::EPEGImage::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.
• 9.1CVE-2026-57073 CODECHILD HTML::BareHTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buff
• 9.9CVE-2026-46512 Mwtcmi frogmanFrogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensio
• 9.1CVE-2026-57074 CODECHILD XML::BareXML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffe
• 10.0CVE-2026-45336 StratonWebDesigners HireFlowHireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers
• 9.1CVE-2026-45568 Netfoundry zrokzrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace th
• 10.0CVE-2026-44181 Jupyter enterprise gateway+2 more CVEs in the same releaseJupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering of
• 9.9CVE-2026-54526 Argoproj argo workflowsArgo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUse
• 9.8CVE-2026-15013 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads t
• 9.8CVE-2026-12492 The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing use
• 9.8CVE-2023-49899 An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.
• 9.8CVE-2023-49900 An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.

13 more critical CVEs in this window: see them on the dashboard.

Ransomware

No leak-site posts collected.

New data breaches

No new breaches published.