🚨 Cisco NX-API Flaw CVE-2026-76471 Allows Unauthenticated Root Code Execution on Nexus and UCS Devices

Critical Vulnerability Alert!
Cisco NX-OS (Nexus 3000/9000 standalone; UCS 6300 fabric interconnects via UCS Manager XML API) is affected by CVE-2026-76471.

🔍 Identify Targets via ZoomEye:

Search Dork: app="Cisco NX-OS"
Exposure: 586 instances identified globally.

ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBOWC1PUyI%3D

#Infosec #CyberSecurity #ZoomEye

CVE-2026-102255: Pre-authentication SSRF via unintended forward-proxy in SonicWall SMA1000, 10.0 rating ‍🔥

SonicWall recently disclosed a critical pre-authentication SSRF vulnerability in its SMA1000 appliances. An unauthenticated attacker can exploit this flaw to make the appliance send requests on their behalf, reach internal functionality, and perform unauthorized actions. This vulnerability has also been observed being exploited in the wild!

Search at Netlas.io:
👉 Link: https://nt.ls/fbAnv
👉 Dork: http.headers.server:"SMA" OR http.title:"SonicWall Workplace" OR (http.title:"Workplace" AND http.body:"SonicWall")

Vendor's advisory:
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

🚨 CVE-2026-76271: Regular Expression DoS in the Discover Splunk Observability Cloud App

Critical Vulnerability Alert!
Splunk Enterprise (Discover Splunk Observability Cloud app) is affected by CVE-2026-76271.

🔍 Identify Targets via ZoomEye:

Search Dork: app="Splunk Enterprise"
Exposure: 114.3k instances identified globally.

ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJTcGx1bmsgRW50ZXJwcmlzZSI%3D

#Splunk #CVE #DoS #ZoomEye

🚨 Citrix NetScaler ADC and NetScaler Gateway: CVSS 9.5 Flaws Actively Exploited (CVE-2026-88771 through CVE-2026-88778)

Critical Vulnerability Alert!
Citrix NetScaler ADC and NetScaler Gateway is affected by CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778.

🔍 Identify Targets via ZoomEye:

Search Dork: app="Citrix NetScaler"
Exposure: 239.7k instances identified globally.

ZoomEye Search Link:
👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXRyaXggTmV0U2NhbGVyIg%3D%3D

#Infosec #CyberSecurity #ZoomEye

🔥🚒 pfSense Firewall 0day - 5 RCEs! 🚒 🔥

Exploits
- https://github.com/abraxas/pfsense-qinq-parent-if
- https://github.com/abraxas/pfsense-openvpn-wizard-crlf
- https://github.com/abraxas/pfsense-carp-vhid
- https://github.com/abraxas/pfsense-limiter-number
- https://github.com/abraxas/pfsense-ipsec-login-banner

Writeups
- https://abraxaslabs.tech/research/pfsense-qinq-parent-if
- https://abraxaslabs.tech/research/pfsense-openvpn-wizard-crlf
- https://abraxaslabs.tech/research/pfsense-carp-vhid
- https://abraxaslabs.tech/research/pfsense-limiter-number
- https://abraxaslabs.tech/research/pfsense-ipsec-login-banner

CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176: Three new vulnerabilities in NGINX, 9.2 rating ‍🔥

F5 has disclosed three new vulnerabilities in NGINX Plus and NGINX Open Source. All of them expose the data plane to remote DoS attacks and potential RCE. An unauthenticated attacker can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Search at Netlas.io:
👉 Link: https://nt.ls/Jv7X3
👉 Dork: tag.name:"nginx"

Vendor advisories:
https://my.f5.com/manage/s/article/K000162608
https://my.f5.com/manage/s/article/K000162607
https://my.f5.com/manage/s/article/K000162416

You can automate a large part of your bug bounty workflow with Claude.

A practical setup:

Target → Scope Check
↓
Recon → Subdomains + URLs
↓
Asset Processing → Deduplicate + Categorize
↓
Claude → Analyze endpoints + prioritize targets
↓
Security Tools → Run authorized checks
↓
Claude → Correlate results + explain findings
↓
Human → Validate vulnerability
↓
Claude → Generate report

Example stack:

Claude Code

+ Python
+ Subfinder
+ httpx
+ Katana
+ Nuclei
+ Burp Suite
+ SQLite/PostgreSQL

The key is giving Claude structured outputs from each stage instead of dumping raw scan results into the model.

Automate the repetitive work.

Keep exploitation and final validation under human control.

Only test assets explicitly authorized by the program.

🔐 Certificate Ripper

A CLI tool to extract server certificates

https://github.com/Hakky54/certificate-ripper

#cybersecurity #pentesting #bugbounty

YesWeHack Claude Kit

A Claude Code plugin that helps bug bounty hunters write clear, well-evidenced reports - the kind a triager can validate quickly.

Source: https://github.com/yeswehack/claude-kit

CVE-2026-109618 & CVE-2026-109619: Two RCE vulnerabilities in PHP (PHP2Shell), rating 9.2 for both 🔥

Today the PHP security team released an emergency update addressing two critical vulnerabilities in the PHP core, which allow unauthenticated remote code execution as the web worker account.
Details of the two vulnerabilities were disclosed by researchers yesterday, ahead of today’s release.

Search at Netlas.io:
👉 Link: https://nt.ls/MDn37
👉 Dork: tag.name:"php"

Vendor advisories:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🎯 Target: Apache Nextcloud + richdocumentscode
⚡ Type: RC3 ➜ Websh3ll / Blind RC3

✅ Full fingerprinting — identifies Nextcloud and app version
✅ Command injection via URL through proxy.php (supports Base64/hex payloads)
✅ Webshell deployment via file upload and execution
✅ Timing-based attack (blind RC3) as a fallback
✅ Multi-threaded — supports mass scanning of target lists
✅ HTTPS support with certificate bypass
✅ JSONL/TXT output, ready for integration into pipelines
✅ Raw HTTP socket — preserves $(CMD) syntax without URL normalization

🔥 AFECTING + 1,300,000 websites

DM  👉 @Mm_fit

Channel: https://t.me/fox_security_cve

#AD