Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-30 | 1 | Active Exploitation1 |
| 2026-07-31 | 1 | General1 |
New critical flaws in OliveTin & a Cisco FMC zero-day are impacting backend & network security (CVE-2026-67438, CVE-2026-67437, CVE-2026-20316). These pose significant risks to data privacy & integrity in transit. #Cybersecurity #News #Vulnerabilities
Post summary
The post announces critical CVEs impacting backend and network security but provides no further technical, exploitation, or mitigation details.
New critical CVEs, like CVE-2026-67437, just emerged. Russian hackers exploit MS OWA (CVE-2026-42897) for mailbox access, & CubePilot faced DNS hijacking. Data privacy/integrity are actively at risk! #Cybersecurity #News #Vulnerabilities
Post summary
The post reports that Russian hackers are actively exploiting CVE-2026-42897 to gain mailbox access on MS OWA and that CubePilot suffered a DNS hijacking incident, underscoring current risk.