Vulnerability & exploit intelligence CVE • EPSS • KEV • Exploit Evidence Prioritize what matters now. Know Before They Strike. https://xitter.cf/t.co/zbz8DJisKw
Joined June 2026
- Tweets1.4K
- Following36
- Followers433
- Likes438
🚨 PHP2Shell update: Unit 42 retracted its link between the European agency attack and the exploit.
The agency ran a vulnerable PHP app, but initial access remains unconfirmed.
Attribution matters. A vulnerable system doesn't prove the exploit path.
🔎 exploitgrid.net
🚨 What happens when a Brotli decoder bug goes beyond a crash?
We reproduced the out-of-bounds write behind CVE-2026-111497 in Node.js and broke down the details in our latest research.
See how it works and why it matters.
🔎 exploitgrid.net/blogs/cve-20…
🚨 Linux KSMBD: the lower-severity flaw may be more urgent.
ZDI-CAN-33367 reportedly has a public root exploit confirmed on AlmaLinux, Debian and Ubuntu, with no merged patch or CVE.
Admins should review exposure and apply the stopgap.
🔎 exploitgrid.net
🚨 Tailscale SSH flaws could let a compromised, authorized device gain root on permitted servers.
This isn’t unauthenticated RCE. Researchers say the findings are lab-tested, with scope under review.
Review SSH policies and disable forwarding if unused.
🔎 exploitgrid.net
Fascinating how many of these rely on workspace policies (AGENTS.md) and harness-level configs rather than raw user prompts. Agentic AI safety is moving way beyond simple chat framing.
💀CRITICAL Exploits Trending (all CVSS 10)
├CVE-2026-102785 · YOOtheme (Joomla) · 2nd exploit listing in 3 days
├CVE-2026-102255 · SonicWall SMA1000 ·Check tool live
├CVE-2025-32440 · NetAlertX · Auth bypass PoC live
├CVE-2024-25600 · Bricks Builder challenge environment live
├ CVE-2026-116067 · Paisa before 0.7.8 · Path traversal via Editor and Sheet API (8.8)
├ CVE-2026-116165 · Parse Server 9.0.0 before 9.10.4-alpha.4 · Unauthenticated class schema deletion (8.8)
🟠 HIGH PRIORITY (CVSS 8.8-9.2)
├ CVE-2026-116199 · Snipe-IT before 8.6.3 · Authentication bypass via Google SSO callback (9.2)
├ CVE-2026-116163 · Parse Server 9.0.0 before 9.10.5-alpha.2 · Authentication bypass via auth adapter (9.1)
🚨 Auth bypasses hit two popular open-source projects today: Snipe-IT via Google SSO and Parse Server via its auth adapter. vLLM also has an SSRF, and YOOtheme’s Joomla RCE now has a second public exploit.
Here’s what hit the feed 👇
🚨 Two critical Wasmtime flaws could let malicious WebAssembly modules escape the sandbox.
CVE-2026-115889 affects multiple architectures. CVE-2026-115893 targets ARM64.
No public exploits reported. Update to fixed releases and rebuild embedded apps.
🔎 exploitgrid.net
🚨 Brotli2Shell may reach beyond HTTP.
JFrog reports reproducing instruction-pointer control in FFmpeg using a crafted JPEG XL file, linking CVE-2026-111497 to a wider attack surface.
Brotli decoder users should check affected versions and apply fixes.
🔎 exploitgrid.net
[EXPLOIT] CVE-2024-25600 [CRITICAL/PoC]
CVSS: 10
TryHack3M-Bricks-Heist
🔗 exploitgrid.net/exploits/b37…
[EXPLOIT] CVE-2021-44228 [CRITICAL/PoC]
CVSS: 10 | Vendor: #ApacheSoftwareFoundation
log4shell-audit-3
🔗 exploitgrid.net/exploits/503…
ExploitGrid Daily Digest
🚨 Top Exploits:
CVE-2021-44228 (CVSS: 10) Apache Softw...
CVE-2024-25600 (CVSS: 10)
CVE-2025-32440 (CVSS: 10) jokob-sk
CVE-2026-102255 (CVSS: 10) sonicwall
CVE-2026-102785 (CVSS: 10) yootheme.com
..🧵👇
[CVE] CVE-2026-116165 [HIGH PRIORITY]
CVSS: 8.8 | Vendor: #parsecommunity
#Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletio...
🔗 exploitgrid.net/cve/CVE-2026…
[CVE] CVE-2026-116067 [HIGH PRIORITY]
CVSS: 8.8 | Vendor: #ananthakumaran
#Paisa before 0.7.8 Path Traversal via Editor and Sheet API
🔗 exploitgrid.net/cve/CVE-2026…
[CVE] CVE-2026-116163 [HIGH PRIORITY]
CVSS: 9.1 | Vendor: #parsecommunity
#Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapte...
🔗 exploitgrid.net/cve/CVE-2026…
[CVE] CVE-2026-116199 [HIGH PRIORITY]
CVSS: 9.2 | Vendor: #Grokability
#Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
🔗 exploitgrid.net/cve/CVE-2026…