NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 8 Sep 2026 𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan: 🕳️ Database dump left readable in the web root — every stored record, password hashes included, from one anonymous GET (code-projects CVE-2026-86519) 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🖥️ Management API serving with no password set — full workspace and config control, plus a one-call public tunnel that puts the open instance on the internet (knowns CVE-2026-86543) 🖥️ Setup wizard still reachable on an unconfigured server — gives up the exact build number, and leaves the first admin account there for the taking (JetBrains YouTrack) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM
Post summary
The post lists newly covered CVEs with basic technical details but does not provide proof of concepts, exploit code, patch information, or evidence of active exploitation.