sn1per pro - Sn1perSecurity

CVE-2026-42533: NGINX map Directive Heap Buffer Overflow – Advisory + Nuclei Detection

xer0dayz — Mon, 03 Aug 2026 17:08:57 +0000

CVE-2026-42533 is a critical heap buffer overflow in the NGINX script engine reached through the map directive, with weaponized public exploit code that defeats ASLR. A plain-English advisory, a tested non-destructive Nuclei detection template, and the two-window version trap that makes naive scanners clear every mainline 1.31.x host as patched.

The post CVE-2026-42533: NGINX map Directive Heap Buffer Overflow – Advisory + Nuclei Detection first appeared on Sn1perSecurity.

CVE-2026-42945 (NGINX Rift): Heap Buffer Overflow in the Rewrite Module – Advisory + Nuclei Detection

xer0dayz — Mon, 03 Aug 2026 17:08:55 +0000

CVE-2026-42945, known as NGINX Rift, is a critical heap buffer overflow in ngx_http_rewrite_module reachable from a single unauthenticated request, with exploitation reported in the wild. A plain-English advisory, a tested non-destructive Nuclei detection template, a configuration audit template for the pattern nginx -t will not warn you about, and why upgrading to 1.30.1 leaves you exposed.

The post CVE-2026-42945 (NGINX Rift): Heap Buffer Overflow in the Rewrite Module – Advisory + Nuclei Detection first appeared on Sn1perSecurity.

CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) – Advisory + Nuclei Detection

xer0dayz — Fri, 31 Jul 2026 19:54:35 +0000

CVE-2026-61511 is a critical unauthenticated RCE in vBulletin 5.x and 6.x, caused by eval injection in the runMaths() template handler. A plain-English advisory, a tested non-destructive Nuclei detection template, the 6.x patch-level trap that hides unpatched hosts, and how to find vulnerable vBulletin at scale with Sn1per.

The post CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) – Advisory + Nuclei Detection first appeared on Sn1perSecurity.

CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server – Advisory + Nuclei Detection

xer0dayz — Tue, 28 Jul 2026 20:50:20 +0000

CVE-2026-50522 is a critical, actively-exploited unauthenticated RCE in on-prem Microsoft SharePoint Server (2016, 2019, Subscription Edition). A plain-English advisory, a ready-to-run non-destructive Nuclei detection template, remediation with machine-key rotation, and how to detect vulnerable SharePoint at scale with Sn1per.

The post CVE-2026-50522: Unauthenticated Deserialization RCE in Microsoft SharePoint Server – Advisory + Nuclei Detection first appeared on Sn1perSecurity.

wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core – Advisory + Nuclei Detection

xer0dayz — Sat, 18 Jul 2026 19:00:36 +0000

wp2shell (CVE-2026-63030) is an unauthenticated pre-auth RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. A plain-English advisory, a ready-to-run Nuclei detection template, remediation, and how to detect affected WordPress at scale with Sn1per.

The post wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core – Advisory + Nuclei Detection first appeared on Sn1perSecurity.

Network and Subnet Discovery: Map Your Internal Attack Surface with Sn1per Pro 2026

xer0dayz — Sun, 12 Jul 2026 13:33:26 +0000

Discover live hosts, open ports, services, and connected devices across your internal subnets with Sn1per Professional 2026 - a self-hosted, automated network and subnet discovery tool you run from the CLI or a web dashboard.

The post Network and Subnet Discovery: Map Your Internal Attack Surface with Sn1per Pro 2026 first appeared on Sn1perSecurity.

Continuous Penetration Testing (PTaaS): Beyond the Once-a-Year Pentest

xer0dayz — Thu, 18 Jun 2026 16:18:20 +0000

The annual pentest is stale within weeks. A 2026 guide to continuous penetration testing and PTaaS - how it differs from point-in-time testing and from continuous ASM, and how to run it with Sn1per.

The post Continuous Penetration Testing (PTaaS): Beyond the Once-a-Year Pentest first appeared on Sn1perSecurity.

Automated Penetration Testing: What It Is, How It Works, and Where It Needs Humans (2026)

xer0dayz — Thu, 18 Jun 2026 16:18:10 +0000

Automated penetration testing, explained without the hype. What it is, automated vs manual (and why you need both), what automation can and cannot do, the workflow, and where Sn1per fits.

The post Automated Penetration Testing: What It Is, How It Works, and Where It Needs Humans (2026) first appeared on Sn1perSecurity.

Continuous Attack Surface Testing: From Periodic Red Team Engagements to Always-On Validation

xer0dayz — Wed, 17 Jun 2026 18:18:00 +0000

The annual pentest is a photograph of a moving target. A 2026 guide to continuous attack surface testing, the CTEM framework, and building an always-on red team loop with Sn1per - scheduled scans, drift detection, and validation.

The post Continuous Attack Surface Testing: From Periodic Red Team Engagements to Always-On Validation first appeared on Sn1perSecurity.

Red Team Attack Surface Management: How Offensive Teams Map and Validate the External Attack Surface (2026)

xer0dayz — Wed, 17 Jun 2026 18:17:58 +0000

A red team sees your organization from the outside in. A 2026 guide to red team attack surface management - the offensive ASM workflow, why an inventory is not an attack surface, and what to look for in an attack surface management platform.

The post Red Team Attack Surface Management: How Offensive Teams Map and Validate the External Attack Surface (2026) first appeared on Sn1perSecurity.