Blog

Analysis & field reports.

Name: CleanIssue
Price range: €€

Technical articles on web application security, exposure patterns we find, and practical guidance for SaaS product teams.

Our specialty: HR & Payroll software

MicrosoftCVESep 1, 2026 · 5 min

Exchange CVE-2026-62911: 21,899 Exposed Servers Still Unpatched as Exploit Code Circulates

The capture-replay authentication bypass fixed in the August 2026 Patch Tuesday (CVE-2026-62911, found by Orange Tsai/DEVCORE) lets an attacker with basic privileges take over every mailbox on an Exchange 2016, 2019, or SE server. The Dutch NCSC confirms exploit code is available online, and Shadowserver counts 21,899 exposed unpatched servers.

Read article

CVE7 min

PaperCut NG/MF: Two Zero-Days Chained for Unauthenticated RCE, Incomplete Patches, and a CISA Deadline

Flaws in the PaperCut NG and MF print management software are exploited in real attacks: an authentication bypass (CVE-2026-81578) followed by unsafe dynamic class loading (CVE-2026-82078) leads to arbitrary Java code execution without an account. Two successive emergency patches, patch bypasses already identified against the latest fully patched version, and a CISA KEV entry with a September 14, 2026 deadline.

Aug 31, 2026Read article

IA & LLM5 min

Claude Hijacked via Infostealers: Anthropic Revokes Stolen Sessions, but the Malware Stays on the Machine

Anthropic is notifying users that infostealers (Vidar, LummaC2, StealC, RedLine, Acreed on Windows, Atomic Stealer on Mac) are copying authenticated Claude sessions from infected browsers, then consuming their usage quotas. The vendor force-signs-out compromised sessions, removes saved payment methods, and refunds unauthorized charges — but signing out does not remove the malware.

Aug 31, 2026Read article

WordPress6 min

WordPress: Five Critical Flaws Including WPMU DEV Dashboard, Avada, and GiveWP (CVSS 9.8 to 10)

Five critical vulnerabilities disclosed August 29, 2026 across widely used WordPress plugins and themes: authentication bypass in WPMU DEV Dashboard with Hub SSO (CVE-2026-76581), arbitrary file write in Avada with Fusion Builder (CVE-2026-18431), admin password-reset URL leakage in TranslatePress (CVE-2026-19632), privilege escalation in Pods (CVE-2026-19598), and PHP object injection leading to RCE in GiveWP (CVE-2026-82222, CVSS 10).

Aug 30, 2026Read article

CVE6 min

ServiceNow: Three CVSS 10.0 Flaws Including a GraphQL Injection — Self-Hosted Instances Must Patch Themselves

Four vulnerabilities fixed on August 27, 2026 in the ServiceNow platform, three of them rated 10.0: code injection in the GraphQL Composite Data API (CVE-2026-18885), broken access control in the configuration image upload processor (CVE-2026-18886), SQL injection via a dynamic ORDER BY (CVE-2026-74820), plus a sandbox escape (CVE-2026-6876). ServiceNow-hosted instances are already protected.

Aug 29, 2026Read article

Next.js6 min

Next.js CVE-2026-75604: Unauthenticated RCE on Windows Plus an AVIF Heap Overflow — Emergency Patches from August 25

Vercel fixed two critical Next.js flaws: a path traversal exploitable without authentication when the server runs on a Windows filesystem (CVE-2026-75604, CVSS 9.0, no workaround), and a heap buffer overflow in the sharp/libheif chain triggered by a malicious AVIF image (CVSS v4 9.5). Fixes: 15.5.24 and 16.3.3. Vercel-hosted deployments are protected.

Aug 28, 2026Read article

Famous hacks7 min

DGFiP Breached by ZeroBytes: Inside France's Biggest Tax Data Leak of 2026

France's tax authority (DGFiP) confirmed unauthorized access to its information system: impersonated agent credentials, no blanket MFA, and over 2 million people potentially exposed through the cadastral records server.

Aug 20, 2026Read article

SharePoint7 min

SharePoint CVE-2026-55040 + CVE-2026-63520: The RCE Chain Found by an AI Agent

Two chained flaws (JWT bypass + RCE) enable unauthenticated full takeover of on-premise SharePoint. Over 8,500 internet-facing servers exposed, public PoC exploited within 24 hours.

Aug 19, 2026Read article

GitLab6 min

GitLab CVE-2026-19478: Unauthenticated GraphQL Injection Exploited Within 48 Hours

CVE-2026-19478 (CVSS 9.4) lets an attacker with no credentials modify or delete public GitLab projects through a poorly validated GraphQL directive. Exploited in the wild within 48 hours of disclosure.

Aug 18, 2026Read article

191 articles · Page 1/22

Need an external review of your HR SaaS?

Share your product, stack, and client context. We will come back with the right review scope.

Discuss your audit