⚠️⚠️ CVE-2026-115188 (CVSS 9.9) + CVE-2026-115189 (CVSS 8.8) + CVE-2026-115190 (CVSS 8.0): Mautic self-hosted marketing automation — 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯29.9K+ internet-facing Mautic surfaces are found on en.fofa.info in the past year. FOFA Query: app="mautic" 🔖Refer: securityonline.info/mautic-v… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-114509 (CVSS 9.2): Laravel TokenGuard authentication bypass 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯2.8M+ internet-facing Laravel surfaces are found on en.fofa.info in the past year. FOFA Query: app="Laravel-Framework" PoC: github.com/hakaioffsec/GHSA-… 🔖Refer: github.com/advisories/GHSA-f… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-109618 (CVSS 9.2) + CVE-2026-109619 (CVSS 9.2): "PHP2Shell" — unauthenticated RCE in the PHP runtime itself 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯229M+ Results are found on en.fofa.info in the past year. FOFA Query: app="php" PoC: github.com/eness/php2shell-C… 🔖Refer: thehackernews.com/2026/10/ph… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-96656 (CVSS 8.6): Plex2Shell — a 4-CVE chain (CVE-2026-96654/96655/96652) gives unauthenticated RCE on internet-facing Plex Media Server; now exploited in the wild (CISA KEV, 10/20) 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯2.1M+ Results are found on en.fofa.info in the past year. FOFA Query: app="Plex-Media-Server" PoC: github.com/code-zm/plex2shel… 🔖Refer: censys.com/advisory/cve-2026… #OSINT #FOFA #CyberSecurity #Vulnerability

🎉 FOFA has surpassed 1 MILLION users! Let’s celebrate with memberships + F-Points! Every search, discovery, and piece of feedback helped us get here. Thank you for exploring with us! 💚 🎁 Prizes: 1 lifetime Premium membership + 18 memberships with F-Points 💝 Participation reward: 888 F-Points ❤️ Like + quote this post with a comment to enter. Prize details on the poster. 📩 Membership winners: DM us your FOFA account email, and we’ll send you an activation code! 📩For 888 F-Points, DM us screenshots of your like + quote post with a comment, along with your FOFA account email. ⏰ Oct 22, 17:00 (UTC+8) 🎲 Random draw via xpickr.com

⚠️⚠️ CVE-2026-108097 (CVSS 9.8) + CVE-2026-108099 (CVSS 9.8): Unauthenticated RCE paths in Drupal core Field UI module and Entity List module — patch all supported branches now 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯1.7M+ internet-facing Drupal surfaces are found on en.fofa.info in the past year. FOFA Query: app="Drupal" 🔖Refer: drupal.org/sa-core-2026-014 #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-102764 (CVSS 9.3): BeyondTrust Remote Support (formerly Bomgar) auth bypass 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯1.1K+ Results are found on en.fofa.info in the past year. FOFA Query: app="BeyondTrust-RM" 🔖Refer: cisa.gov/news-events/alerts/… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-97229 (CVSS 10.0): Max-severity integer overflow in the CI/CD regex compiler lets unauthenticated attackers run arbitrary code on self-managed GitLab CE/EE servers via a crafted regex in pipeline config. Same compiler as 3-weeks-ago CVE-2026-93577 (9.9) — but this one needs no auth. GitLab = source, secrets, deploy keys & release signing in one box. 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯371.8K+ Results are found on en.fofa.info in the past year. FOFA Query: app="GitLab" 🔖Refer: cyberkendra.com/2026/10/cve-… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-42589 (CVSS 9.8) + CVE-2026-40281 (CVSS 10.0): unauthenticated argument injection in Gotenberg PDF engine metadata-write endpoint → RCE 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯6.6K+ Results are found on en.fofa.info in the past year. FOFA Query: body_hash="-1373567260" PoC: threatcluster.io/article/cve… 🔖Refer: dbu.gs/vulnerability/PT-2026… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2023-22894 (+ CVE-2023-22621): Actively exploited in the wild (CISA KEV 10/08) — cleartext storage in Strapi admin chains to unauthenticated remote code execution on self-hosted headless CMS instances. 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯169k+ Results are found on en.fofa.info in the past year. FOFA Query: app="strapi-Headless-CMS" 🔖Refer: cisa.gov/known-exploited-vul… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-76750 (CVSS 9.8): Unauthenticated RCE in HPE Aruba ClearPass Policy Manager via insecure deserialization 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯1.9K+ Results are found on en.fofa.info in the past year. FOFA Query: app="aruba-ClearPass" 🔖Refer: support.hpe.com/hpesc/public… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-97359 (CVSS 10.0): Unauthenticated RCE in Rejetto HFS2 via template injection in the multipart upload handler - a crafted filename injects an exec macro to run arbitrary OS commands as the HFS process. 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯23.5K+ Results are found on en.fofa.info in the past year. FOFA Query: app="HFS" PoC: github.com/wgetnz/hfs2/blob/… 🔖Refer: vulncheck.com/advisories/hfs… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-35273 (CVSS 9.8): Oracle PeopleSoft unauthenticated RCE via PSEMHUB Java deserialization 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯1.3K+ Results are found on en.fofa.info in the past year. FOFA Query: app="Oracle-PeopleSoft" 🔖Refer: thehackernews.com/2026/09/at… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-88771 (CVSS 9.5) + CVE-2026-88772 (CVSS 9.5): Citrix NetScaler ADC/Gateway zero-day RCE — now actively exploited in the wild 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯42.7K+ Results are found on en.fofa.info in the past year. FOFA Query: app="NetScaler-AAA" 🔖Refer: support.citrix.com/support-h… #OSINT #FOFA #CyberSecurity #Vulnerability

⚠️⚠️ CVE-2026-94127 (CVSS 9.8): Heap overflow in F5 BIG-IP APM OAuth processing -> unauthenticated RCE on internet-facing VPN/identity gateways. Now actively exploited. 🔗FOFA Link: en.fofa.info/result?qbase64=… 🎯1.5M+ Results are found on en.fofa.info in the past year. FOFA Query: app="f5-BIGIP" 🔖Refer: cert.europa.eu/publications/… #OSINT #FOFA #CyberSecurity #Vulnerability