Actively Exploited KEVs and Widespread PoC-Available RCE Flaws Lead Week

Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.

Hardcoded static credentials in Cisco Secure Firewall Management Center (FMC) Software allow an unauthenticated remote attacker to log in to the web interface using a built-in low-privileged account and access sensitive data. The flaw affects an extensive range of FMC versions from 7.0.0 through 10.0.1 and is rooted in CWE-259 (Use of Hard-coded Password). Cisco has self-elevated the Security Impact Rating to High - despite a CVSS 5.3 Medium score - explicitly because this credential foothold can be chained with other FMC vulnerabilities to escalate privileges, making the real-world risk materially higher than the base score implies. No public exploit or CISA KEV listing has been confirmed at time of analysis.

Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch.

Server-side request forgery in Prebid Server (Go) versions before 4.4.0 lets remote unauthenticated attackers coerce the ad server into making HTTP requests to attacker-chosen destinations. Multiple bidder adapters (e.g. acuityads, adhese, bidmachine) interpolate an unvalidated user-supplied 'host'/'account' bid-request parameter directly into outbound URLs, enabling extraction of host-environment data and access to internal network services. No public exploit identified at time of analysis, but the fix commit and GHSA advisory are public; EPSS was not provided.

Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Because the FluentRender renderer writes CRD values (e.g. record_transformer records) into the config without escaping newlines, an attacker injects a `<match **>` block using the core `@type exec` plugin to run arbitrary commands. A working proof-of-concept is published in the GitHub advisory (GHSA-mjqf-28ph-426h); publicly available exploit code exists, but there is no CISA KEV listing indicating active exploitation.

SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter. All users passing user-controlled input are affected, and the vulnerability can lead to full disclosure, modification, or destruction of the database. A vendor patch is available, and there is no evidence of active exploitation in the wild.

Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.

Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. No public exploit code has been released at disclosure time (July 30, 2026), but independent researchers from Ethiack and GMO Flatt Security assess that AI-assisted POC development is feasible within hours, making immediate patching critical.