Attackers exploited CVE-2026-110447 in Nextcloud's built-in Collabora CODE app to plant web shells, with the first logged attack on September 10. Collabora says disabling the app does not help, so administrators must update to 26.4.303 or remove it.
Perspective Coverage
5 publishers
- Builder
- Builder 24%
- Operator
- Operator 65%
- Investor
- Investor 11%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence80
Microsoft says attackers are using CVE-2026-73570 to run commands on Zimbra mail servers with one crafted email and no login. Zimbra shipped the fix in 10.1.20 on July 20, 24 days before disclosure, so anyone who waited for the advisory to patch was already late.
Perspective Coverage
4 publishers
- Builder
- Builder 21%
- Operator
- Operator 68%
- Investor
- Investor 11%
Reality
- Evidence80
- Adoption40
- Hype gap+5
- Incentives
- Not scored
- Confidence75
buildOne report1 publisher One COPY line runs a shell despite AWS's read-only Postgres MCP filter
AWS published CVE-2026-87911, a CVSS 9.6 command injection in its own postgres-mcp-server, where one COPY ... TO PROGRAM line runs a shell on the host. The read-only promise lives in a regex filter that lets the COPY keyword through.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives40
- Confidence50
buildConfirmed2 publishers OpenAI has fixed a Critical Codex flaw in which a semicolon in a branch name leaked the agent's GitHub OAuth token on all four Codex surfaces. How far one leaked token could reach was set by its scope, which is chosen by whoever provisions the agent.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives45
- Confidence60
CVE-2026-22755 opens 37 VIVOTEK camera models to remote command execution
CISA lists 37 VIVOTEK camera models open to CVE-2026-22755, a command injection bug that can give attackers remote command execution, potentially as root. Exploit code was public before the advisory, so the first job for owners is finding out which of their cameras are on the list.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
Parallels puts the ParaShells root fix behind an Apple silicon requirement
JFrog says a non-admin account on a Mac can reach root through Parallels Desktop's dispatcher service by planting a double quote in a folder name. The change that stops it is in version 27, and that release needs Apple silicon.
Reality
- Evidence60
- Adoption25
- Hype gap+12
- Incentives65
- Confidence55
buildOne report1 publisher On the far side of a macOS admin prompt, a free-text DNS field ran commands as root
Sonar's developer routed a custom resolver string straight into the arguments of a privileged networksetup call. He found it himself, in a pre-version-2 pass that produced twenty-six fixes, four of which he describes.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+12
- Incentives62
- Confidence45
buildOne report1 publisher Zimbra's SNMP notifier turns a crafted SMTP message into command execution as the zimbra user
CERT Polska says CVE-2026-73570 is already being exploited. Two of the three preconditions are configuration, not code, which makes reachability the control you can change now.
Reality
- Evidence58
- Adoption42
- Hype gap−8
- Incentives30
- Confidence55