CVE-2026-63292 and others: Multiple vulnerabilities in Apache HTTP Server, up to 9.8 rating 🔥
Apache Software Foundation disclosed 20 new vulnerabilities. The most severe can lead to RCE, arbitrary code execution via stack-based buffer overflow, and DoS/potential RCE via use-after-free. Memory corruption, privilege escalation, and info disclosure bugs were also patched.
Search at Netlas.io:
👉 Link: https://nt.ls/fFMkT
👉 Dork: tag.name:"apache"
Vendor's advisory:
https://httpd.apache.org/security/vulnerabilities_24.html
Apache Software Foundation disclosed 20 new vulnerabilities. The most severe can lead to RCE, arbitrary code execution via stack-based buffer overflow, and DoS/potential RCE via use-after-free. Memory corruption, privilege escalation, and info disclosure bugs were also patched.
Search at Netlas.io:
👉 Link: https://nt.ls/fFMkT
👉 Dork: tag.name:"apache"
Vendor's advisory:
https://httpd.apache.org/security/vulnerabilities_24.html
❤3🔥2
CVE-2026-96940: EoP vulnerability in MS Exchange Server, 8.8 rating 🔥
Microsoft has updated its September 2026 Exchange Server security updates, addressing only one new vulnerability. It allows an authenticated attacker to elevate privileges over a network and gain unauthorized access to other users' mailboxes within the same organization.
Search at Netlas.io:
👉 Link: https://nt.ls/L5NIL
👉 Dork: tag.name:"microsoft_exchange"
Vendor's advisory:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940
Microsoft has updated its September 2026 Exchange Server security updates, addressing only one new vulnerability. It allows an authenticated attacker to elevate privileges over a network and gain unauthorized access to other users' mailboxes within the same organization.
Search at Netlas.io:
👉 Link: https://nt.ls/L5NIL
👉 Dork: tag.name:"microsoft_exchange"
Vendor's advisory:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940
🔥3❤1
CVE-2026-88779: DoS vulnerability in Citrix NetScaler ADC & Gateway, 8.7 rating 🔥
A recently disclosed memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to Denial of Service when configured as a SAML SP or IdP. This vulnerability is being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/1PpoX
👉 Dork (NetScaler ADC): http.headers.set_cookie:"citrix_ns_id" OR http.headers.set_cookie:"ns_af" OR http.headers.set_cookie:"NSC_" OR http.headers.set_cookie:"NSC_ESNS"
👉 Dork (NetScaler Gateway): http.title:"citrix gateway" OR http.headers.set_cookie:"pwcount" OR http.favicon.hash_sha256:7b2fe2b7235b6645998edcae988ce1edaac40764c202abc3a4766db1b8ae6360 OR http.favicon.hash_sha256:3e8f8b98d8fe34a5e627c3033f0940777144effe4b5f588c67bfc6ba3bf106fa
Vendor's advisory:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
A recently disclosed memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to Denial of Service when configured as a SAML SP or IdP. This vulnerability is being actively exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/1PpoX
👉 Dork (NetScaler ADC): http.headers.set_cookie:"citrix_ns_id" OR http.headers.set_cookie:"ns_af" OR http.headers.set_cookie:"NSC_" OR http.headers.set_cookie:"NSC_ESNS"
👉 Dork (NetScaler Gateway): http.title:"citrix gateway" OR http.headers.set_cookie:"pwcount" OR http.favicon.hash_sha256:7b2fe2b7235b6645998edcae988ce1edaac40764c202abc3a4766db1b8ae6360 OR http.favicon.hash_sha256:3e8f8b98d8fe34a5e627c3033f0940777144effe4b5f588c67bfc6ba3bf106fa
Vendor's advisory:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
❤2🔥2
🎯 Netlas v1.10
Track changes in your attack surface with the new private scan comparison. See which targets, services, and CVE matches appeared, disappeared, or changed.
✔ Compare scans in the UI and via API
✔ Rebuild attack surfaces with clearer guidance and fewer questions
✔ Discover building automation devices with KNXnet/IP support
✔ Explore host references with linked_hosts
✔ Try experimental misconfiguration detection, initially focused on SQL services
👉 Full changelog: https://docs.netlas.io/changelog/
Track changes in your attack surface with the new private scan comparison. See which targets, services, and CVE matches appeared, disappeared, or changed.
✔ Compare scans in the UI and via API
✔ Rebuild attack surfaces with clearer guidance and fewer questions
✔ Discover building automation devices with KNXnet/IP support
✔ Explore host references with linked_hosts
✔ Try experimental misconfiguration detection, initially focused on SQL services
👉 Full changelog: https://docs.netlas.io/changelog/
docs.netlas.io
Changelog - Netlas Docs
Explore the latest updates, enhancements, and fixes on the Netlas platform. Stay informed with our Changelog for all product and feature developments.
🔥7
CVE-2026-106445 & CVE-2026-106446: Two RCE flaws in Handlebars.js, up to 9.8 rating 🔥
Two recently disclosed vulnerabilities in Handlebars.js allow an attacker to run arbitrary JavaScript on the server. Both the technical details and PoC exploit code are now public!
Search at Netlas.io:
👉 Link: https://nt.ls/KMYBH
👉 Dork: tag.name:"handlebars"
Vendor's advisory:
https://github.com/handlebars-lang/handlebars.js/security/advisories
Two recently disclosed vulnerabilities in Handlebars.js allow an attacker to run arbitrary JavaScript on the server. Both the technical details and PoC exploit code are now public!
Search at Netlas.io:
👉 Link: https://nt.ls/KMYBH
👉 Dork: tag.name:"handlebars"
Vendor's advisory:
https://github.com/handlebars-lang/handlebars.js/security/advisories
❤3🔥1
CVE-2026-76268 and others: Multiple vulnerabilities in Splunk Enterprise, up to 9.8 rating 🔥
Splunk has disclosed multiple vulnerabilities in Splunk Enterprise. The most serious is CVE-2026-76268, which allows an unauthenticated attacker to execute operating system commands through the Patroni REST API.
Search at Netlas.io:
👉 Link: https://nt.ls/GWmyZ
👉 Dork: http.title:"login - splunk" OR http.headers.server:"splunkd" OR http.unknown_headers.key:"x_splunk_version"
Vendor's advisory:
https://advisory.splunk.com/advisories/SVD-2026-1001
Splunk has disclosed multiple vulnerabilities in Splunk Enterprise. The most serious is CVE-2026-76268, which allows an unauthenticated attacker to execute operating system commands through the Patroni REST API.
Search at Netlas.io:
👉 Link: https://nt.ls/GWmyZ
👉 Dork: http.title:"login - splunk" OR http.headers.server:"splunkd" OR http.unknown_headers.key:"x_splunk_version"
Vendor's advisory:
https://advisory.splunk.com/advisories/SVD-2026-1001
🔥3❤2👾2
CVE-2026-102255: Pre-authentication SSRF via unintended forward-proxy in SonicWall SMA1000, 10.0 rating 🔥
SonicWall recently disclosed a critical pre-authentication SSRF vulnerability in its SMA1000 appliances. An unauthenticated attacker can exploit this flaw to make the appliance send requests on their behalf, reach internal functionality, and perform unauthorized actions. This vulnerability has also been observed being exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/fbAnv
👉 Dork: http.headers.server:"SMA" OR http.title:"SonicWall Workplace" OR (http.title:"Workplace" AND http.body:"SonicWall")
Vendor's advisory:
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
SonicWall recently disclosed a critical pre-authentication SSRF vulnerability in its SMA1000 appliances. An unauthenticated attacker can exploit this flaw to make the appliance send requests on their behalf, reach internal functionality, and perform unauthorized actions. This vulnerability has also been observed being exploited in the wild!
Search at Netlas.io:
👉 Link: https://nt.ls/fbAnv
👉 Dork: http.headers.server:"SMA" OR http.title:"SonicWall Workplace" OR (http.title:"Workplace" AND http.body:"SonicWall")
Vendor's advisory:
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
🔥4❤2👾2
CVE-2026-97229: Unauthenticated RCE in GitLab, 10.0 rating 🔥
A vulnerability in GitLab disclosed last week allows an unauthenticated attacker to execute arbitrary code on the server via a specially crafted regular expression in a CI/CD configuration.
Search at Netlas.io:
👉 Link: https://nt.ls/HVOHN
👉 Dork: http.title:"Sign in · GitLab" OR http.headers.set_cookie:"_gitlab_session" OR http.unknown_headers.key:"x_gitlab_meta" OR http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef
Vendor's advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
A vulnerability in GitLab disclosed last week allows an unauthenticated attacker to execute arbitrary code on the server via a specially crafted regular expression in a CI/CD configuration.
Search at Netlas.io:
👉 Link: https://nt.ls/HVOHN
👉 Dork: http.title:"Sign in · GitLab" OR http.headers.set_cookie:"_gitlab_session" OR http.unknown_headers.key:"x_gitlab_meta" OR http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef
Vendor's advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
🔥3❤2
🔥 Hidden Investigations Cyber Con 2026
We're excited to support this international cybersecurity conference and CTF, taking place October 30 – November 1!
🌐 Fully online and free to join, the event brings together security researchers, ethical hackers, and CTF enthusiasts from around the world.
What to expect:
✔ 3 days of cybersecurity talks and discussions
✔ 48-hour CTF with 70+ challenges, including OSINT, forensics, web security, and AI
✔ $2,500 in cash prizes
✔ 6-month Netlas Business subscriptions for the Top 5 CTF teams!
We're proud to support the cybersecurity community and help talented researchers sharpen their skills.
Join the competition, challenge yourself, and win!
🌐 Conference: https://hicybercon.hiddeninvestigations.net/
🚩 CTF registration: https://ctf.hiddeninvestigations.net/
We're excited to support this international cybersecurity conference and CTF, taking place October 30 – November 1!
🌐 Fully online and free to join, the event brings together security researchers, ethical hackers, and CTF enthusiasts from around the world.
What to expect:
✔ 3 days of cybersecurity talks and discussions
✔ 48-hour CTF with 70+ challenges, including OSINT, forensics, web security, and AI
✔ $2,500 in cash prizes
✔ 6-month Netlas Business subscriptions for the Top 5 CTF teams!
We're proud to support the cybersecurity community and help talented researchers sharpen their skills.
Join the competition, challenge yourself, and win!
🌐 Conference: https://hicybercon.hiddeninvestigations.net/
🚩 CTF registration: https://ctf.hiddeninvestigations.net/
HI Cyber Con
HI Cyber Con 2026 (hicybercon) | Conference & CTF
Join HI Cyber Con 2026 (HI CyberCon), a free virtual cybersecurity conference and 48-hour CTF, 30 October–1 November. USD 2,500 CTF cash prize pool.
🔥4⚡2
CVE-2026-74040, CVE-2026-74041 and others: 15 new vulnerabilities in Wazuh, up to 9.1 rating 🔥
Wazuh has disclosed 15 new vulnerabilities in its open-source platform. Two of them could allow an attacker to execute code as root.
Search at Netlas.io:
👉 Link: https://nt.ls/lD8bp
👉 Dork: certificate.issuer_dn:"Wazuh" OR http.headers.server:"Wazuh" OR raw.banner:"Unable to add agent"
Vendor's advisory:
https://github.com/wazuh/wazuh/security/advisories
Wazuh has disclosed 15 new vulnerabilities in its open-source platform. Two of them could allow an attacker to execute code as root.
Search at Netlas.io:
👉 Link: https://nt.ls/lD8bp
👉 Dork: certificate.issuer_dn:"Wazuh" OR http.headers.server:"Wazuh" OR raw.banner:"Unable to add agent"
Vendor's advisory:
https://github.com/wazuh/wazuh/security/advisories
❤2🔥2
CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176: Three new vulnerabilities in NGINX, 9.2 rating 🔥
F5 has disclosed three new vulnerabilities in NGINX Plus and NGINX Open Source. All of them expose the data plane to remote DoS attacks and potential RCE. An unauthenticated attacker can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Search at Netlas.io:
👉 Link: https://nt.ls/Jv7X3
👉 Dork: tag.name:"nginx"
Vendor advisories:
https://my.f5.com/manage/s/article/K000162608
https://my.f5.com/manage/s/article/K000162607
https://my.f5.com/manage/s/article/K000162416
F5 has disclosed three new vulnerabilities in NGINX Plus and NGINX Open Source. All of them expose the data plane to remote DoS attacks and potential RCE. An unauthenticated attacker can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Search at Netlas.io:
👉 Link: https://nt.ls/Jv7X3
👉 Dork: tag.name:"nginx"
Vendor advisories:
https://my.f5.com/manage/s/article/K000162608
https://my.f5.com/manage/s/article/K000162607
https://my.f5.com/manage/s/article/K000162416
🔥4❤1
⚙️Hunting Exposed LLM Infrastructure with Netlas
In this new article by CyberBit, we explore how any publicly accessible instance of a self-hosted LLM platform can reveal the models it uses and even the runtime environment on which the AI service operates.
See how unsecured AI gateways, configuration files, and leaked API keys create security threats, and how to detect them using Netlas.
👉 https://netlas.io/blog/hunting_exposed_llm_infrastructure_with_netlas/
In this new article by CyberBit, we explore how any publicly accessible instance of a self-hosted LLM platform can reveal the models it uses and even the runtime environment on which the AI service operates.
See how unsecured AI gateways, configuration files, and leaked API keys create security threats, and how to detect them using Netlas.
👉 https://netlas.io/blog/hunting_exposed_llm_infrastructure_with_netlas/
netlas.io
How to Find Exposed LLM Infrastructure Using Netlas - Netlas Blog
Discover how exposed AI gateways, configuration files, and leaked API keys create security risks and how to hunt them using Netlas.
1🔥3