CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
OverviewRapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when…
July 2026
Investigating Persistence Mechanisms in AWS
OverviewIn the cloud, your infrastructure may be short-lived, but an attacker’s persistence doesn’t have to be. While your environment scales…
Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
OverviewOn July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, including the…
Sunsetting the Public AttackerKB Platform
What’s changing, where AttackerKB-style analysis will live, and how users can continue finding Rapid7 vulnerability intelligence.On August 18, Rapid7 will…
Metasploit Wrap Up: An HTTP to SMB relay plus Payload Improvements
Metasploit Wrap Up HousekeepingWhile the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest…
[webapps] Grav CMS 2.0.0-beta.2 – Remote Code Execution
Grav CMS 2.0.0-beta.2 – Remote Code Execution According to Exploit-DB, grav cms 2.0.0-beta.2 – remote code execution. The development comes…
[webapps] OpenCATS 0.9.7.4 – SQL Injection
OpenCATS 0.9.7.4 – SQL Injection According to Exploit-DB, opencats 0.9.7.4 – sql injection. The development comes amid ongoing regulatory scrutiny…
[local] Realtek rtl819x – Local Privilege
Realtek rtl819x – Local Privilege According to Exploit-DB, realtek rtl819x – local privilege. The development comes amid ongoing regulatory scrutiny…
[hardware] MeiG Smart FORGE_SLT711 – OS Command Injection
MeiG Smart FORGE_SLT711 – OS Command Injection According to Exploit-DB, meig smart forge_slt711 – os command injection. The development comes…
[webapps] scramble – Remote Code Execution
scramble – Remote Code Execution According to Exploit-DB, scramble – remote code execution. The development comes amid ongoing regulatory scrutiny…