Vulnerabilities and Exploits

Explore the latest Rapid7 articles and research about Vulnerabilities and Exploits.

Latest articles about Vulnerabilities and Exploits

CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)

Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)

CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry

Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)

CVE-2026-0826: How an Old Bug Can Feed AI-Powered Impersonation

Douglas McKee, Director, Vulnerability Intelligence

CVE-2026-0826: Critical unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones (FIXED)

Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

CVE-2026-52806: Authenticated RCE via Argument Injection in Gogs (FIXED as of June 7, 2026)

CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS

CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)

Jonah Burgess, Stephen Fewer

The Dark Side of Efficiency: When Network Controllers Become "God Mode" for Attackers

Douglas McKee, Director, Vulnerability Intelligence

Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)

CVE-2026-41940: cPanel & WHM Authentication Bypass

CVE-2026-33032: Nginx UI Missing MCP Authentication

ClickFix Phishing Campaign Masquerading as a Claude Installer

Nicholas Spagnola

FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Eric Carey, Olivia Henderson, Noah Hemker

From Vectors to Verdicts: Web App Testing with Vector Command

CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out-of-Bounds Read

CVE-2026-31381, CVE-2026-31382: Gainsight Assist Information Disclosure and Cross-Site Scripting (FIXED)

Christopher O’Boyle

Critical Cisco Catalyst Vulnerability Exploited in the wild (CVE-2026-20127)

The Phone is Listening: A Cold War–Style Vulnerability in Modern VoIP

Douglas McKee, Director, Vulnerability Intelligence