A public PoC for CVE-2026-64849, an unauthenticated MLflow SSRF (CVSS 9.3), is now live. watchTowr reports exploitation attempts. Patch to 3.15.0. Related Posts: CVE-2026-71290: Apache HttpClient Flaw Lets Attackers Intercept and Modify Traffic (CVSS 9.1) CVE-2026-75045: Unauthenticated Attacker Could Download YouTrack Database Backups GeoServer Unauthenticated SQL Injection (CVSS 9.8) Exploited in the Wild, PoC Public The post PoC Discloses for CVE-2026-64849: watchTowr Sees Attacks on MLflo

PoC exploit code for CVE-2026-8452, a Citrix NetScaler pre-auth RCE, is now public. The SAML heap overflow grants root. Patch now. Related Posts: CVE-2026-19188: Haiwell HMI Gateway Flaw Lets Attackers Execute Arbitrary OS Commands With Root Privileges (CVSS 10.0) Linux AF_PACKET Race (03390aa): PoC Exploit Enables Local Privilege Escalation Apache Struts Patches Five Flaws Including Unauthenticated DoS Bugs The post Citrix NetScaler Pre-Auth RCE CVE-2026-8452 Gets Public Exploit Code appeare