Status of High-Risk Vulnerabilities
| No. | Vulnerability No. (CVE) | Content | CVSS | Risk Level |
|---|---|---|---|---|
| 1 | CVE-2026-48276 | Adobe ColdFusion Arbitrary File Upload RCE | 10 | CRITICAL |
| 2 | CVE-2026-48286 | Adobe Campaign Classic Authorization Bypass RCE | 10 | CRITICAL |
| 3 | CVE-2026-10134 | IBM Langflow OSS Code Injection | 10 | CRITICAL |
| 4 | CVE-2026-50160 | Hoppscotch Mass Assignment Authentication Bypass | 10 | CRITICAL |
| 5 | CVE-2026-48316 | Adobe ColdFusion Improper Input Validation RCE | 10 | CRITICAL |
| 6 | CVE-2026-57572 | Crawl4AI Docker API Argument Injection RCE | 10 | CRITICAL |
| 7 | CVE-2026-15409 | SonicWall SMA1000 Server-Side Request Forgery | 10 | CRITICAL |
| 8 | CVE-2026-16812 | Arista VeloCloud Orchestrator On-Prem OS Command Injection | 10 | CRITICAL |
| 9 | CVE-2026-61239 | Oracle PeopleSoft eProcurement Improper Access Control | 9.9 | CRITICAL |
| 10 | CVE-2026-61237 | Oracle PeopleSoft Integration Improper Privilege Management | 9.9 | CRITICAL |
Distribution of Web Application Attack Types
| No. | Attack Type | % | Key Features and Purpose |
|---|---|---|---|
| 1 | System File Access | 29.02% | Unauthorized attempts to access internal server files and directories |
| 2 | SQL Injection | 28.74% | Database manipulation, privilege escalation, and sensitive data exfiltration |
| 3 | Default Page | 11.62% | Collection of system information through exposure of default configuration pages |
| 4 | Directory Traversal | 10.27% | Attempts to access sensitive files through path manipulation |
| 5 | Application Vulnerability | 10.09% | Exploitation of application-level flaws (insufficient authentication, misconfigurations) |
Major Attack Detection by Industry
| No. | Industry | Total | First Attack Type | Second Attack Type |
|---|---|---|---|---|
| 1 | Education Industry | 4,250,000 cases | System File Access ~ 1,820,000 cases | SQL Injection ~ 910,000 cases |
| 2 | Service Industry | 3,700,000 cases | SQL Injection ~ 1,590,000 cases | System File Access ~ 930,000 cases |
| 3 | Manufacturing Industry | 2,760,000 cases | Default Page ~ 990,000 cases | System File Access ~ 780,000 cases |
| 4 | Public Institutions | 1,640,000 cases | SQL Injection ~ 610,000 cases | System File Access ~ 490,000 cases |
The Threat Intelligence Report provides the latest web vulnerability analyses, industry-specific attack patterns,
and key CVE-based vulnerability information, all based on processed data from the AI/ML-powered threat intelligence platform AILabs.
Subscribe to receive the full monthly Threat Intelligence Report!
[ Subscribe → ]
