This media is not supported in your browser
VIEW IN TELEGRAM
🗺 Netlas v1.9 — Rebuild Your Attack Surface
Attack surfaces change over time — infrastructure appears, disappears, and moves. With the new interactive rebuild in Netlas Discovery, you can update an existing attack surface using the latest Netlas data.
✔ Replay the complete discovery history step by step
✔ Decide whether to add newly discovered nodes
✔ Keep or remove data no longer found in current indices
✔ Preserve graph layout and comments
✔ New scanner protocols: BACnet and MSRPC
✔ New API endpoints for single and bulk rescans
✔ 20+ security fixes
Full changelog: https://docs.netlas.io/changelog/
Attack surfaces change over time — infrastructure appears, disappears, and moves. With the new interactive rebuild in Netlas Discovery, you can update an existing attack surface using the latest Netlas data.
✔ Replay the complete discovery history step by step
✔ Decide whether to add newly discovered nodes
✔ Keep or remove data no longer found in current indices
✔ Preserve graph layout and comments
✔ New scanner protocols: BACnet and MSRPC
✔ New API endpoints for single and bulk rescans
✔ 20+ security fixes
Full changelog: https://docs.netlas.io/changelog/
🔥6❤4👾2
CVE-2026-19632: Account takeover vulnerability in TranslatePress WordPress plugin, 9.8 rating 🔥
A recently disclosed vulnerability in the TranslatePress WordPress plugin allows unauthenticated attackers to extract an administrator’s password reset link, reset the account’s password, and log in as that administrator, leading to complete site takeover.
Search at Netlas.io:
👉 Link: https://nt.ls/oe1hr
👉 Dork: http.body:"plugins/translatepress-multilingual"
Vendor's advisory:
https://www.wordfence.com/blog/2026/08/400000-wordpress-sites-affected-by-account-takeover-vulnerability-in-translatepress-wordpress-plugin/
A recently disclosed vulnerability in the TranslatePress WordPress plugin allows unauthenticated attackers to extract an administrator’s password reset link, reset the account’s password, and log in as that administrator, leading to complete site takeover.
Search at Netlas.io:
👉 Link: https://nt.ls/oe1hr
👉 Dork: http.body:"plugins/translatepress-multilingual"
Vendor's advisory:
https://www.wordfence.com/blog/2026/08/400000-wordpress-sites-affected-by-account-takeover-vulnerability-in-translatepress-wordpress-plugin/
🔥5❤3
Zero-day vulnerability in PaperCut Software with active exploitation, no CVE assigned yet 🔥
PaperCut disclosed an emergency alert about a vulnerability in PaperCut NG/MF. No details have been disclosed, but it is known that it is being actively exploited in the wild.
Search at Netlas.io:
👉 Link: https://nt.ls/n7oWU
👉 Dork (PaperCut MF): http.favicon.hash_sha256:fab4df1b834bf0ff6389d2315cc0d639d55cf6daef8e0880302150d1d48b3576 OR http.favicon.hash_sha256:ce5cefdb0b9c7fbf8d204660447db9878316dbfe5d56f47455419f435ebd6464 OR http.meta:"PaperCut MF is a print management system"OR http.body:"<title>PaperCut Login"
Vendor's advisory:
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
PaperCut disclosed an emergency alert about a vulnerability in PaperCut NG/MF. No details have been disclosed, but it is known that it is being actively exploited in the wild.
Search at Netlas.io:
👉 Link: https://nt.ls/n7oWU
👉 Dork (PaperCut MF): http.favicon.hash_sha256:fab4df1b834bf0ff6389d2315cc0d639d55cf6daef8e0880302150d1d48b3576 OR http.favicon.hash_sha256:ce5cefdb0b9c7fbf8d204660447db9878316dbfe5d56f47455419f435ebd6464 OR http.meta:"PaperCut MF is a print management system"OR http.body:"<title>PaperCut Login"
Vendor's advisory:
https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/
❤4🔥1
CVE-2026-62911: Pre-auth RCE in Microsoft Exchange with public PoC, 8.0 rating 🔥
Disclosed at the August Patch Tuesday, this pre-auth RCE vulnerability allows unauthenticated attackers on local networks to achieve remote code execution as SYSTEM. And now a PoC exists!
Search at Netlas.io:
👉 Link: https://nt.ls/rnLCg
👉 Dork: tag.name:"microsoft_exchange"
Read more:
https://github.com/hypnguyen1209/CVE-2026-62911
Disclosed at the August Patch Tuesday, this pre-auth RCE vulnerability allows unauthenticated attackers on local networks to achieve remote code execution as SYSTEM. And now a PoC exists!
Search at Netlas.io:
👉 Link: https://nt.ls/rnLCg
👉 Dork: tag.name:"microsoft_exchange"
Read more:
https://github.com/hypnguyen1209/CVE-2026-62911
🔥3❤1
Authentication bypass in Proxmox VE with public exploit and active exploitation, no CVE assigned yet ❗️
A recently disclosed vulnerability in EOL releases of Proxmox VE allows unauthenticated remote attackers to log in as root without a password. Public PoC now exists! This vulnerability is being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/qLCVL
👉 Dork: tag.name:"proxmox_ve"
Vendor's advisory:
https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#-subject-psa-2026-00043-1-authentication-bypass-in-eol-proxmox-ve-7-release
A recently disclosed vulnerability in EOL releases of Proxmox VE allows unauthenticated remote attackers to log in as root without a password. Public PoC now exists! This vulnerability is being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/qLCVL
👉 Dork: tag.name:"proxmox_ve"
Vendor's advisory:
https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#-subject-psa-2026-00043-1-authentication-bypass-in-eol-proxmox-ve-7-release
🔥3❤1
CVE-2026-84645: RCE in Jenkins, 8.8 rating 🔥
Jenkins disclosed numerous vulnerabilities in its security advisory. The most dangerous one allows remote code execution through unsafe deserialization.
Search at Netlas.io:
👉 Link: https://nt.ls/7bpLG
👉 Dork: tag.name:"jenkins"
Vendor's advisory :
https://www.jenkins.io/security/advisory/2026-09-02/
Jenkins disclosed numerous vulnerabilities in its security advisory. The most dangerous one allows remote code execution through unsafe deserialization.
Search at Netlas.io:
👉 Link: https://nt.ls/7bpLG
👉 Dork: tag.name:"jenkins"
Vendor's advisory :
https://www.jenkins.io/security/advisory/2026-09-02/
🔥2❤1
CVE-2026-85602: Grav Form Plugin reCAPTCHA v3 Authentication Bypass, 9.3 rating 🔥
The Grav Form plugin selects which reCAPTCHA version to use for validation based solely on the presence of a specific response field key in the submitted payload. This allows an anonymous attacker to bypass reCAPTCHA v3 bot protection.
Search at Netlas.io:
👉 Link: https://nt.ls/VcB4a
👉 Dork: tag.name:"grav"
Vendor's advisory :
https://github.com/getgrav/grav/security/advisories/GHSA-89j6-8h38-2cc3
The Grav Form plugin selects which reCAPTCHA version to use for validation based solely on the presence of a specific response field key in the submitted payload. This allows an anonymous attacker to bypass reCAPTCHA v3 bot protection.
Search at Netlas.io:
👉 Link: https://nt.ls/VcB4a
👉 Dork: tag.name:"grav"
Vendor's advisory :
https://github.com/getgrav/grav/security/advisories/GHSA-89j6-8h38-2cc3
🔥4❤1
CVE-2026-67276 and others: MikroTik RouterOS vulnerabilities exploited in the wild (MikroTrick), up to 9.2 rating 🔥
Recently disclosed vulnerabilities in MikroTik RouterOS allow an attacker to take full control of the device without authentication if the device supports remote access via the SSH protocol. These vulnerabilities are being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/318sx
👉 Dork: tag.name:"mikrotik"
Vendor's advisory :
https://mikrotik.com/supportsec/september-2026-vulnerability/
Recently disclosed vulnerabilities in MikroTik RouterOS allow an attacker to take full control of the device without authentication if the device supports remote access via the SSH protocol. These vulnerabilities are being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/318sx
👉 Dork: tag.name:"mikrotik"
Vendor's advisory :
https://mikrotik.com/supportsec/september-2026-vulnerability/
🔥2❤1
CVE-2026-75650: Adobe Commerce and Magento Open Source RCE vulnerability (StyleSmuggler) exploited in the wild, 10.0 rating 🔥
Recently disclosed vulnerability in Adobe Commerce and Magento Open Source allows an unauthenticated attacker to execute arbitrary code. This vulnerability is being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/bX5dx
👉 Dork: tag.name:"magento"
Read more :
https://sansec.io/research/stylesmuggler-0day
Recently disclosed vulnerability in Adobe Commerce and Magento Open Source allows an unauthenticated attacker to execute arbitrary code. This vulnerability is being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/bX5dx
👉 Dork: tag.name:"magento"
Read more :
https://sansec.io/research/stylesmuggler-0day
❤1🔥1
CVE-2026-44756: A memory corruption vulnerability in SAP (OVERPASS), 10.0 rating 🔥
A recently disclosed memory corruption vulnerability, which resides in the SAP kernel's processing of the Extended Passport (EPP), allows unauthenticated attackers to run arbitrary OS commands on the SAP host with SAP administrative privileges, potentially leading to a total compromise of underlying business data and processes.
Search at Netlas.io:
👉 Link: https://nt.ls/U7K8V
👉 Dork: http.headers.server:"SAP"
Read more :
https://onapsis.com/blog/sap-overpass-remediation/
A recently disclosed memory corruption vulnerability, which resides in the SAP kernel's processing of the Extended Passport (EPP), allows unauthenticated attackers to run arbitrary OS commands on the SAP host with SAP administrative privileges, potentially leading to a total compromise of underlying business data and processes.
Search at Netlas.io:
👉 Link: https://nt.ls/U7K8V
👉 Dork: http.headers.server:"SAP"
Read more :
https://onapsis.com/blog/sap-overpass-remediation/
❤3🔥3
CVE-2026-67401: SQL Injection Vulnerability in cPanel, 9.9 Rating 🔥
A vulnerability in cPanel's EmailTrack component allows an authenticated attacker with mail-related privileges to create arbitrary files on the server via SQL injection. This may lead to code execution as the root user, giving the attacker full control of the server.
Search at Netlas.io:
👉 Link: https://nt.ls/dIEpd
👉 Dork: http.title:cpanel OR http.headers.set_cookie:"cprelogin" OR http.headers.set_cookie:"cpsession"
Vendor's advisory:
https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
A vulnerability in cPanel's EmailTrack component allows an authenticated attacker with mail-related privileges to create arbitrary files on the server via SQL injection. This may lead to code execution as the root user, giving the attacker full control of the server.
Search at Netlas.io:
👉 Link: https://nt.ls/dIEpd
👉 Dork: http.title:cpanel OR http.headers.set_cookie:"cprelogin" OR http.headers.set_cookie:"cpsession"
Vendor's advisory:
https://support.cpanel.net/hc/en-us/articles/43187903921559-Security-CVE-2026-67401-SQL-Injection-Vulnerability-in-cPanel-s-EmailTrack-Functionality-September-8-2026
🔥3❤1👾1
CVE-2026-85102 and CVE-2026-85103: Two RCE Vulnerabilities in Check Point Products, 9.8 Rating 🔥
Two critical VPN-related vulnerabilities recently disclosed in Check Point Security Gateways, firewall appliances, and the Security Management Server could allow unauthenticated remote code execution under specific conditions. Both vulnerabilities exist in the way the products handle VPN certificates.
Search at Netlas.io:
👉 Link: https://nt.ls/hJmZ6
👉 Dork: http.headers.server:"CPWS" OR http.favicon.hash_sha256:78bd48391c96c6ac257e74e109783cc2750b39ea144a849f8d830f4f8f279267 OR http.favicon.hash_sha256:475a554d9a6c971ebf248fe45bcecafbab2b663edd7f080486a995c877dd1216 OR http.body:"TITLE>GAiA</TITLE>" OR path:"/sslvpn/Login/Login" OR http.headers.set_cookie:"CheckCookieSupport"
Vendor's advisory:
https://community.checkpoint.com/t5/General-Topics/Action-Required-Critical-Security-Advisory-VPN-Vulnerabilities/td-p/281995
Two critical VPN-related vulnerabilities recently disclosed in Check Point Security Gateways, firewall appliances, and the Security Management Server could allow unauthenticated remote code execution under specific conditions. Both vulnerabilities exist in the way the products handle VPN certificates.
Search at Netlas.io:
👉 Link: https://nt.ls/hJmZ6
👉 Dork: http.headers.server:"CPWS" OR http.favicon.hash_sha256:78bd48391c96c6ac257e74e109783cc2750b39ea144a849f8d830f4f8f279267 OR http.favicon.hash_sha256:475a554d9a6c971ebf248fe45bcecafbab2b663edd7f080486a995c877dd1216 OR http.body:"TITLE>GAiA</TITLE>" OR path:"/sslvpn/Login/Login" OR http.headers.set_cookie:"CheckCookieSupport"
Vendor's advisory:
https://community.checkpoint.com/t5/General-Topics/Action-Required-Critical-Security-Advisory-VPN-Vulnerabilities/td-p/281995
🔥3❤1
🔌 Plug & Pwn: Mapping the Windows PnP Auto-Install Attack Surface
Windows Plug & Play can automatically install signed vendor software with SYSTEM privileges. With RDP USB redirection, this attack surface may also be reachable remotely — no physical USB device required.
Look at how this attack works and how Netlas can help map exposed RDP infrastructure.
👉 https://netlas.io/blog/windows_pnp_auto_install_attack_surface/
Windows Plug & Play can automatically install signed vendor software with SYSTEM privileges. With RDP USB redirection, this attack surface may also be reachable remotely — no physical USB device required.
Look at how this attack works and how Netlas can help map exposed RDP infrastructure.
👉 https://netlas.io/blog/windows_pnp_auto_install_attack_surface/
netlas.io
Plug & Pwn: Mapping the Windows PnP Auto-Install Attack Surface - Netlas Blog
How Windows PnP auto-install becomes a privilege-escalation path, what Netlas can reveal about RDP exposure, and which controls reduce the risk.
🔥6👍4❤1