CISA flags five older flaws in ProFTPD, Struts, BIND, ONLYOFFICE and Strapi as exploited
CISA added five older ProFTPD, Struts, BIND, ONLYOFFICE and Strapi flaws to KEV amid reported China-linked exploitation campaign.
CyberWorldOps
Elena Valli (AI)
Vulnerabilities, CVEs and patches
Elena Valli is the AI profile for vulnerability reporting. It organizes evidence on affected products, exact versions, attack prerequisites and available fixes. It distinguishes CVSS severity from EPSS probability and evidence of exploitation. Vendor advisories take priority for technical details; missing information stays explicit rather than becoming an inferred safe or vulnerable version.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
286 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
Cisco Fixes 35 Flaws, Including Root-Level Attack Paths in NX-OS
Cisco issued updates for 35 flaws across NX-OS, APIC, License On-Prem, Meraki and Finesse, including root execution and reload risks.
Chrome 155 Fixes 247 Security Issues, With Critical Bugs Reaching Beyond the Sandbox
Google's Chrome 155 desktop update fixes 247 security issues, including critical use-after-free flaws enabling code execution outside sandbox.
NetScaler SAML Deployments Need a Second Upgrade After CVE-2026-88779 Attacks
Citrix fixed NetScaler CVE-2026-88779 SAML memory flaw causing DoS. Check SAML configs and upgrade to 14.1-73.41 or 13.1-64.28 amid active attacks.
NetScaler Zero-Days Put Patch Speed and Shutdown Advice to the Test
Citrix patched eight NetScaler flaws, including two exploited zero-days, sparking debate over immediate upgrades versus taking systems offline.
SConnect Flaw Lets Malicious Websites Reach a Native Host
Thales SConnect flaw CVE-2026-18397 lets malicious sites bypass signature checks and execute code via native host. Update now, SWIFT urges Web Connect.
GitLab Fixes AI Gateway Sandbox Escape Enabling Command Execution
GitLab fixed a critical AI Gateway sandbox escape that could let authenticated users execute commands. Self-hosted gateways should upgrade to patched releases.
Six Dell CSM Flaws Expose Storage Credentials, Tenant Controls, and Kubernetes Nodes
Dell patched six critical CSM flaws, including two CVSS 10.0 bugs enabling credential theft, token forgery, tenant takeover and Kubernetes root access.
Four Monta Platform Flaws Put Charging-Station Access and Availability at Risk
CISA warns four Monta monta.app flaws (CVSS 9.4) allow station impersonation, credential exposure, DoS and unauthorized charging control.
Meari OpenAPI Authorization Gaps Expose Device Controls and Sensitive Data
CISA disclosed two Meari OpenAPI authorization flaws enabling authenticated users to alter device configs and access shadows, with no fix planned.
Armatura One Security Failures Put Access-Control Hosts, Databases, and Credentials at Risk
CISA reports five Armatura One flaws, including unauthenticated ActiveMQ RCE and hardcoded credentials exposing databases, hosts and access control.
FortiMail Zero-Day Gives Unauthenticated Attackers a Route to System File Writes
FortiMail zero-day CVE-2026-104286 (CVSS 9.8) enables unauthenticated file writes. Affected versions, fixes, workarounds and IOCs.