🌍 Netlas v1.8 is live
Private Scanner now supports Scanner Locations!
Run scans from different countries to see infrastructure from multiple geographic perspectives.
New in this release:
✓ Distributed Scanner Locations
✓ Location details in reports & API
✓ UI polish and ASD bug fixes.
👉 Details: https://docs.netlas.io/changelog/
Private Scanner now supports Scanner Locations!
Run scans from different countries to see infrastructure from multiple geographic perspectives.
New in this release:
✓ Distributed Scanner Locations
✓ Location details in reports & API
✓ UI polish and ASD bug fixes.
👉 Details: https://docs.netlas.io/changelog/
🔥6👾1
📓 Discovering Data Exposure with Netlas
A practical walkthrough of how security researchers can use Netlas to identify exposed / leaked sensitive data across internet-facing systems.
✔ Methods for finding leaked data
✔ Common exposure patterns
✔ Real-world search techniques
👉 Read the article: https://netlas.io/blog/discovering_data_exposure_with_netlas/
A practical walkthrough of how security researchers can use Netlas to identify exposed / leaked sensitive data across internet-facing systems.
✔ Methods for finding leaked data
✔ Common exposure patterns
✔ Real-world search techniques
👉 Read the article: https://netlas.io/blog/discovering_data_exposure_with_netlas/
netlas.io
Discovering Data Exposure with Netlas - Netlas Blog
How to discover exposed configuration files, API keys, database credentials, bearer tokens, and debug outputs using Netlas response data.
👍5👏2
Totally new 0-day RCE vulnerability in NGINX. Again 😱
New zero-day RCE vulnerability named nginx-poolslip targets the latest mainline release 1.31.0.
Search at Netlas.io:
👉 Link: https://nt.ls/k1sOO
👉 Dork: tag.name:nginx
Read more:
https://x.com/nebusecurity/status/2057071579876753643
New zero-day RCE vulnerability named nginx-poolslip targets the latest mainline release 1.31.0.
Search at Netlas.io:
👉 Link: https://nt.ls/k1sOO
👉 Dork: tag.name:nginx
Read more:
https://x.com/nebusecurity/status/2057071579876753643
❤3🔥3
CVE-2026-46354: Token theft in Coder, 9.1 rating 🔥
New vulnerability in Coder allows an attacker on any Azure VM to steal an agent session token, and with the stolen token get access to Git SSH private key, OAuth access tokens or workspace secrets.
Search at Netlas.io:
👉 Link: https://nt.ls/JwI80
👉 Dork: http.favicon.hash_sha256:05d85ef30160f0c790ba0acf9470dae35a85a90a2b79387fe4b6994852c1dbf4 OR http.meta:"https://coder.com/docs" OR http.unknon_headers.key:"x_coder_request_id" OR http.unknown_headers.key:"x_coder_build_version"
Vendor's advisory:
https://github.com/advisories/GHSA-6x44-w3xg-hqqf
New vulnerability in Coder allows an attacker on any Azure VM to steal an agent session token, and with the stolen token get access to Git SSH private key, OAuth access tokens or workspace secrets.
Search at Netlas.io:
👉 Link: https://nt.ls/JwI80
👉 Dork: http.favicon.hash_sha256:05d85ef30160f0c790ba0acf9470dae35a85a90a2b79387fe4b6994852c1dbf4 OR http.meta:"https://coder.com/docs" OR http.unknon_headers.key:"x_coder_request_id" OR http.unknown_headers.key:"x_coder_build_version"
Vendor's advisory:
https://github.com/advisories/GHSA-6x44-w3xg-hqqf
🔥3❤1
CVE-2026-34908, CVE-2026-34909 & CVE-2026-34910: Vulnerabilities in Ubiquiti UniFi OS, 10.0 rating 🔥🔥🔥
Three new vulnerabilities in Ubiquiti UniFi OS allow an network attacker to make unauthorized changes, access files and execute arbitrary command. It may cause to full device compromise.
Search at Netlas.io:
👉 Link: https://nt.ls/oMQHo
👉 Dork: tag.name:"ubiquiti_unifi"
Vendor's advisory:
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
Three new vulnerabilities in Ubiquiti UniFi OS allow an network attacker to make unauthorized changes, access files and execute arbitrary command. It may cause to full device compromise.
Search at Netlas.io:
👉 Link: https://nt.ls/oMQHo
👉 Dork: tag.name:"ubiquiti_unifi"
Vendor's advisory:
https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b
❤2🔥2
CVE-2026-47783 & CVE-2026-47784: Two SASL vulnerabilities in Memcached, 8.1 rating 🔥
Two new vulnerabilities Memcached allow an attacker to enumerate valid usernames on the system and guess their passwords because password and username data for SASL password database authentication has a timing side channel.
Search at Netlas.io:
👉 Link: https://nt.ls/zZBd0
👉 Dork: memcached.version:<1.6.42
Read more:
https://github.com/memcached/memcached/wiki/ReleaseNotes1642
Two new vulnerabilities Memcached allow an attacker to enumerate valid usernames on the system and guess their passwords because password and username data for SASL password database authentication has a timing side channel.
Search at Netlas.io:
👉 Link: https://nt.ls/zZBd0
👉 Dork: memcached.version:<1.6.42
Read more:
https://github.com/memcached/memcached/wiki/ReleaseNotes1642
🔥3👾2❤1
📘 Attackers no longer need custom malware
Legitimate Remote Monitoring & Management (RMM) tools like AnyDesk, ScreenConnect, TeamViewer, Atera, and others are increasingly being weaponized for initial access, persistence, and ransomware operations.
Our latest research breaks down how threat actors abuse RMM platforms, common attack chains, detection opportunities, and defensive measures.
👉 Read the blog: https://netlas.io/blog/weaponized_rmm/
Legitimate Remote Monitoring & Management (RMM) tools like AnyDesk, ScreenConnect, TeamViewer, Atera, and others are increasingly being weaponized for initial access, persistence, and ransomware operations.
Our latest research breaks down how threat actors abuse RMM platforms, common attack chains, detection opportunities, and defensive measures.
👉 Read the blog: https://netlas.io/blog/weaponized_rmm/
netlas.io
Weaponized RMM: Hunting the Adversary Abuse of Remote Monitoring Tools - Netlas Blog
Analysis of adversary abuse of RMM tools, phishing-to-RMM delivery, Netlas hunt pivots, IOCs, and defensive detection strategies.
🔥5👍2👾2
CVE-2026-44494: Full Man-in-the-Middle via Prototype Pollution Gadget in Axios, 8.7 rating 🔥
The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows an attacker intercept, read, and modify all outgoing HTTP requests including authentication credentials.
Search at Netlas.io:
👉 Link: https://nt.ls/emv2w
👉 Dork: tag.name:"axios"
Read more:
https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh
The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows an attacker intercept, read, and modify all outgoing HTTP requests including authentication credentials.
Search at Netlas.io:
👉 Link: https://nt.ls/emv2w
👉 Dork: tag.name:"axios"
Read more:
https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh
❤3🔥3
CVE-2026-47759 - CVE-2026-47762: Four XSS vulnerabilities in TinyMCE, 8.7 rating 🔥
Four recently disclosed Cross-Site Scripting (XSS) vulnerabilities allow remote attacker to inject malicious scripts into web pages.
Search at Netlas.io:
👉 Link: https://nt.ls/DRDw1
👉 Dork: tag.name:"tinymce"
Read more:
https://github.com/tinymce/tinymce/security
Four recently disclosed Cross-Site Scripting (XSS) vulnerabilities allow remote attacker to inject malicious scripts into web pages.
Search at Netlas.io:
👉 Link: https://nt.ls/DRDw1
👉 Dork: tag.name:"tinymce"
Read more:
https://github.com/tinymce/tinymce/security
🔥7❤2
CVE-2026-47367 and other: Improper Input Validation vulnerabilities in Ubiquiti UniFi OS, 9.9 rating 🔥
Several improper input validation and other weaknesses allow low-privileged attacker to execute command injection and possible to compromise network.
Search at Netlas.io:
👉 Link: https://nt.ls/TczjZ
👉 Dork: tag.name:"ubiquiti_unifi"
Vendor's advisory:
https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a
Several improper input validation and other weaknesses allow low-privileged attacker to execute command injection and possible to compromise network.
Search at Netlas.io:
👉 Link: https://nt.ls/TczjZ
👉 Dork: tag.name:"ubiquiti_unifi"
Vendor's advisory:
https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a
👍3🔥3👾2❤1
CVE-2026-48062: Arbitrary code execution in CodeIgniter, 9.8 rating 🔥
Uploaded file extension validation bypass in PHP framework CodeIgniter may in some cases lead to arbitrary code execution.
Search at Netlas.io:
👉 Link: https://nt.ls/HPzgw
👉 Dork: tag.name:codeigniter
Vendor's advisory:
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx
Uploaded file extension validation bypass in PHP framework CodeIgniter may in some cases lead to arbitrary code execution.
Search at Netlas.io:
👉 Link: https://nt.ls/HPzgw
👉 Dork: tag.name:codeigniter
Vendor's advisory:
https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx
🔥4👾2❤1🤣1
CVE-2026-10829: Remote code execution in Moxa NPort, 8.6 rating 🔥
A stack-based buffer overflow in Moxa NPort allows an attacker to corrupt memory by sending crafted input. It could achieve remote code execution with root privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/12mUL
👉 Dork: http.title:"NPort Web Console" OR http.headers.server:"MoxaHttp" OR http.body:"NPort Web Console" OR http.body:"<TITLE>OnCell" OR http.body:"<TITLE>Moxa OnCell"
Vendor's advisory:
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v
A stack-based buffer overflow in Moxa NPort allows an attacker to corrupt memory by sending crafted input. It could achieve remote code execution with root privileges.
Search at Netlas.io:
👉 Link: https://nt.ls/12mUL
👉 Dork: http.title:"NPort Web Console" OR http.headers.server:"MoxaHttp" OR http.body:"NPort Web Console" OR http.body:"<TITLE>OnCell" OR http.body:"<TITLE>Moxa OnCell"
Vendor's advisory:
https://www.moxa.com/en/support/product-support/security-advisory/mpsa-261910-cve-2026-10828,-cve-2026-10829-use-of-externally-controlled-format-string-and-stack-based-buffer-overflow-v
🔥6❤1👍1👾1
CVE-2026-8713: Arbitrary file deletion in Avada Builder WordPress plugin, 9.1 rating 🔥
New vulnerability in Avada Builder WordPress plugin (formerly Fusion Builder) allows an unauthenticated attacker to delete any file on the server. It can easily lead to remote code execution when the right file is deleted.
Search at Netlas.io:
👉 Link: https://nt.ls/ohFG5
👉 Dork: http.body:"wp-content/plugins/fusion-builder"
Read more:
https://www.wordfence.com/blog/2026/06/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/
New vulnerability in Avada Builder WordPress plugin (formerly Fusion Builder) allows an unauthenticated attacker to delete any file on the server. It can easily lead to remote code execution when the right file is deleted.
Search at Netlas.io:
👉 Link: https://nt.ls/ohFG5
👉 Dork: http.body:"wp-content/plugins/fusion-builder"
Read more:
https://www.wordfence.com/blog/2026/06/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/
❤4🔥3👾1
CVE-2026-12046: RCE vulnerability in pgAdmin 4, 9.5 rating 🔥
Two SQL Editor endpoints were missing the login-required decorator and were reachable without authentication in server mode. This exposes an unauthenticated remote code execution path in the pgAdmin process.
Search at Netlas.io:
👉 Link: https://nt.ls/jbYEF
👉 Dork: http.title:"pgAdmin" OR http.headers.set_cookie:"pga4_session=" OR http.favicon.hash_sha256:c3251099ffc5ed057dcbb624adbe79fa5794a0c64684442c1eaf1abc3edf7bde OR http.favicon.hash_sha256:6afa287fc6721817d9931bd8d7a796646ea535596f8bb038ff048666e19cfd17
Read more:
https://github.com/pgadmin-org/pgadmin4/issues/10072
Two SQL Editor endpoints were missing the login-required decorator and were reachable without authentication in server mode. This exposes an unauthenticated remote code execution path in the pgAdmin process.
Search at Netlas.io:
👉 Link: https://nt.ls/jbYEF
👉 Dork: http.title:"pgAdmin" OR http.headers.set_cookie:"pga4_session=" OR http.favicon.hash_sha256:c3251099ffc5ed057dcbb624adbe79fa5794a0c64684442c1eaf1abc3edf7bde OR http.favicon.hash_sha256:6afa287fc6721817d9931bd8d7a796646ea535596f8bb038ff048666e19cfd17
Read more:
https://github.com/pgadmin-org/pgadmin4/issues/10072
❤2🔥2👾2👍1
CVE-2026-52813 & CVE-2026-52806 & CVE-2026-52811: Three RCE vulnerabilities in gogs, up to 10.0 rating 🔥
Recently disclosed vulnerabilities in gogs allow an attacker to execute arbitrary code. PoC exist for all three!
Search at Netlas.io:
👉 Link: https://nt.ls/A9o6h
👉 Dork: tag.name:gogs
Read more:
https://github.com/gogs/gogs/security
Recently disclosed vulnerabilities in gogs allow an attacker to execute arbitrary code. PoC exist for all three!
Search at Netlas.io:
👉 Link: https://nt.ls/A9o6h
👉 Dork: tag.name:gogs
Read more:
https://github.com/gogs/gogs/security
🔥5❤1👍1👾1
CVE-2026-49869 & CVE-2026-53576: Two RCE vulnerabilities in kestra, 10.0 rating 😱
Recently disclosed vulnerabilities in Kestra allow an unauthenticated remote attacker to execute arbitrary code as root.
Search at Netlas.io:
👉 Link: https://nt.ls/58ToN
👉 Dork: http.title:kestra OR http.favicon.hash_sha256:26119c9b0a6c4e82ae8c2d367e4a7cb56a30c4da664b7185d14f6fbdf50f8ec8
Read more:
https://github.com/kestra-io/kestra/security
Recently disclosed vulnerabilities in Kestra allow an unauthenticated remote attacker to execute arbitrary code as root.
Search at Netlas.io:
👉 Link: https://nt.ls/58ToN
👉 Dork: http.title:kestra OR http.favicon.hash_sha256:26119c9b0a6c4e82ae8c2d367e4a7cb56a30c4da664b7185d14f6fbdf50f8ec8
Read more:
https://github.com/kestra-io/kestra/security
🔥3❤1
CVE-2026-48276 and other: A lot of vulnerabilities in Adobe ColdFusion, 6 of them are 10.0 rating 😱
The last Adobe security bulletin disclosed 6 RCE vulnerabilities in Adobe ColdFusion with highest severity and other critical issues such as arbitrary file read and privilege escalation.
Search at Netlas.io:
👉 Link: https://nt.ls/GxXdK
👉 Dork: tag.name:"adobe_coldfusion"
Vendor's advisory:
https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
The last Adobe security bulletin disclosed 6 RCE vulnerabilities in Adobe ColdFusion with highest severity and other critical issues such as arbitrary file read and privilege escalation.
Search at Netlas.io:
👉 Link: https://nt.ls/GxXdK
👉 Dork: tag.name:"adobe_coldfusion"
Vendor's advisory:
https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
❤4
🚧 Planned Maintenance
Netlas will be unavailable for up to an hour today, starting at 11:30 UTC.
We have to reboot the whole system after maintenance. Thank you for your understanding and patience. We are sorry for any inconvenience this may cause.
Netlas will be unavailable for up to an hour today, starting at 11:30 UTC.
We have to reboot the whole system after maintenance. Thank you for your understanding and patience. We are sorry for any inconvenience this may cause.
🕊3
CVE-2026-57517: Blind SQL Injection in Control Web Panel, 9.8 rating 🔥
SQL Injection flow in Control Web Panel allows remote code execution. PoC is now available!
Search at Netlas.io:
👉 Link: https://nt.ls/biQe7
👉 Dork: http.title:"CWP ADMIN" OR http.favicon.hash_sha256:69cd33a03067a7a00b6a743e52b357cd46ffdfeb1d72beaf44f2ffd9abfc153a OR http.headers.server:cwpsrv
Read more:
https://karmainsecurity.com/KIS-2026-12
SQL Injection flow in Control Web Panel allows remote code execution. PoC is now available!
Search at Netlas.io:
👉 Link: https://nt.ls/biQe7
👉 Dork: http.title:"CWP ADMIN" OR http.favicon.hash_sha256:69cd33a03067a7a00b6a743e52b357cd46ffdfeb1d72beaf44f2ffd9abfc153a OR http.headers.server:cwpsrv
Read more:
https://karmainsecurity.com/KIS-2026-12
🔥4❤2👍1👾1
CVE-2026-12184: Remote DoS in PHP, 8.2 rating 🔥
Failure to setup TLS handshake with a remote server can lead to DoS.
Search at Netlas.io:
👉 Link: https://nt.ls/pjJC5
👉 Dork: tag.name:php
Vendor's advisory:
https://github.com/php/php-src/security/advisories/GHSA-mhmq-mmqj-2v39
Failure to setup TLS handshake with a remote server can lead to DoS.
Search at Netlas.io:
👉 Link: https://nt.ls/pjJC5
👉 Dork: tag.name:php
Vendor's advisory:
https://github.com/php/php-src/security/advisories/GHSA-mhmq-mmqj-2v39
🔥3❤2👍2
CVE-2026-56843: Cleartext FTP Password Exposure in Plesk's XML API, 9.9 rating 🔥
Exposure of cleartext FTP credentials is possible in Plesk's XML API, which may allow a low-privileged attacker to upload malicious files and execute arbitrary code remotely (RCE) as another tenant's system user.
Search at Netlas.io:
👉 Link: https://nt.ls/MZtlo
👉 Dork: tag.name:"plesk"
Vendor's advisory:
https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure
Exposure of cleartext FTP credentials is possible in Plesk's XML API, which may allow a low-privileged attacker to upload malicious files and execute arbitrary code remotely (RCE) as another tenant's system user.
Search at Netlas.io:
👉 Link: https://nt.ls/MZtlo
👉 Dork: tag.name:"plesk"
Vendor's advisory:
https://support.plesk.com/hc/en-us/articles/41178305151255-Vulnerability-in-Plesk-XML-API-Cleartext-FTP-Password-Exposure
❤1🔥1