threataft

I run ThreatAft (threataft.com), an independent cybersecurity publication focused on CVE analysis and vulnerability intelligence. I publish daily articles covering critical CVEs, mass disclosures, and

Joined on Sep 29, 2026

threataft

Oct 8

Splunk Patched an Unauthenticated RCE in Its Own SIEM — Here's What You Need to Know

#security #splunk #siem #infosec

2 min read

threataft

Oct 8

Cisco Dropped 18 CVEs Yesterday — Here's What Actually Needs Your Attention

#security #networking #cisco #infosec

1 min read

threataft

Oct 6

CVE-2026-94293: AAS Edge Client — CVSS 9.8 IIoT Data Tampering, No Patch, Decommission Now

#security #cve #iot #industrial

1 min read

threataft

Oct 6

HyperShift CVE-2026-101919 — CVSS 8.8 Tenant Isolation Bypass via Kubeconfig Passthrough

#security #kubernetes #vulnerabilities #devops

1 min read

threataft

Oct 5

Legcord (Discord Client) — 2 CVEs: XSS in Discord Page Becomes RCE + Persistent Traffic Interception

#security #electron #cybersecurity #discord

1 min read

threataft

Oct 5

ZITADEL Cluster: 7 CVEs, Peak CVSS 9.3 — Cross-Org Account Takeover via Passkey Enrollment

#security #identity #cybersecurity #vulnerabilities

1 min read

threataft

Oct 5

CVE-2026-88779 — Citrix NetScaler SAML Memory Overflow, Actively Exploited, CISA KEV

#security #cve #vulnerabilities #infosec

1 min read

threataft

Oct 3

YesWiki 9 CVEs — CVSS 8.6 SQL Injection Can Dump Your Entire Database

#security #webdev #vulnerabilities #php

1 min read

threataft

Oct 3

UTMStack Cluster — 7 CVEs, Peak CVSS 9.9 Missing Auth on STOMP Command WebSocket

#security #cybersecurity #vulnerabilities #devops

1 min read

threataft

Oct 2

WordPress Auth Bypass Cluster — 4 CVSS 9.8, Full Site Takeover via Plugin Flaws

#security #wordpress #vulnerabilities #webdev

1 min read

threataft

Oct 2

Ghost CMS Mass Disclosure — 6 CVEs Including CVSS 8.1 Staff Session Bypass

#security #webdev #cybersecurity #vulnerabilities

1 min read

threataft

Oct 2

Mooncake Mass Disclosure — CVSS 9.8 Arbitrary Memory Read/Write in KV Cache Transfer Engine

#security #machinelearning #llm #vulnerabilities

1 min read

threataft

Oct 1

Dockhand CVE-2026-53988 — CVSS 10.0 Unauthenticated Webhook Auth Bypass

#security #devops #docker #vulnerabilities

1 min read

threataft

Oct 1

Deno CVE-2026-103473 — CVSS 8.1 Command Injection in node:child_process on Windows

#deno #security #javascript #vulnerabilities

1 min read

threataft

Sep 30

Cisco SD-WAN Manager CVE-2026-76504 — CVSS 9.8 Auth Bypass via URI Encoding, Actively Exploited

#security #networking #vulnerabilities #cybersecurity

1 min read

threataft

Sep 30

Five vulnerabilities in AiSOC (the open-source SOC platform) were disclosed today.

#ai #vulnerabilities #cybersecurity #security

1 min read

threataft

Sep 30

LightLLM Mass Disclosure — 2 CVSS 9.8 Unauthenticated RCE in LLM Serving Framework

#ai #security #python #vulnerabilities

2 min read

threataft

Sep 30

CTranslate2 CVE-2026-102566 & CVE-2026-102567 — Heap Overflow in AI Model Loader

#ai #security #cybersecurity #vulnerabilities

2 min read

threataft

Sep 29

RaspAP Mass Disclosure — 3 CVEs, Privilege Escalation + RCE, No Patch

#security #vulnerabilities #cybersecurity #networking

2 min read

DEV Community

threataft

Badges

Writing Debut

Splunk Patched an Unauthenticated RCE in Its Own SIEM — Here's What You Need to Know

Cisco Dropped 18 CVEs Yesterday — Here's What Actually Needs Your Attention

CVE-2026-94293: AAS Edge Client — CVSS 9.8 IIoT Data Tampering, No Patch, Decommission Now

HyperShift CVE-2026-101919 — CVSS 8.8 Tenant Isolation Bypass via Kubeconfig Passthrough

Legcord (Discord Client) — 2 CVEs: XSS in Discord Page Becomes RCE + Persistent Traffic Interception

ZITADEL Cluster: 7 CVEs, Peak CVSS 9.3 — Cross-Org Account Takeover via Passkey Enrollment

CVE-2026-88779 — Citrix NetScaler SAML Memory Overflow, Actively Exploited, CISA KEV

YesWiki 9 CVEs — CVSS 8.6 SQL Injection Can Dump Your Entire Database

UTMStack Cluster — 7 CVEs, Peak CVSS 9.9 Missing Auth on STOMP Command WebSocket

WordPress Auth Bypass Cluster — 4 CVSS 9.8, Full Site Takeover via Plugin Flaws

Ghost CMS Mass Disclosure — 6 CVEs Including CVSS 8.1 Staff Session Bypass

Mooncake Mass Disclosure — CVSS 9.8 Arbitrary Memory Read/Write in KV Cache Transfer Engine

Dockhand CVE-2026-53988 — CVSS 10.0 Unauthenticated Webhook Auth Bypass

Deno CVE-2026-103473 — CVSS 8.1 Command Injection in node:child_process on Windows

Cisco SD-WAN Manager CVE-2026-76504 — CVSS 9.8 Auth Bypass via URI Encoding, Actively Exploited

Five vulnerabilities in AiSOC (the open-source SOC platform) were disclosed today.

LightLLM Mass Disclosure — 2 CVSS 9.8 Unauthenticated RCE in LLM Serving Framework

CTranslate2 CVE-2026-102566 & CVE-2026-102567 — Heap Overflow in AI Model Loader

RaspAP Mass Disclosure — 3 CVEs, Privilege Escalation + RCE, No Patch