Daily briefing · July 4, 2026
July 4th: Public Exploits Flood Hosting Panels, Pickle Security Tools, and Open-Source E-Commerce
The July 4th bulletin brings no actively exploited (KEV) vulnerabilities and no CVSS Critical scores, but 64 new CVEs were published — several carrying CVSS 8.8 and public proof-of-concept exploit code. The day's most pressing risks cluster around web hosting control panels, Python pickle-security tooling, and a wave of PoC-backed flaws in open-source web applications, all of which demand immediate attention from teams running these stacks.
Today’s brief
- Two CVSS 8.8 flaws in Trail of Bits fickling undermine pickle-security scanning, potentially returning false 'safe' results for malicious payloads
- Authenticated RCE in myVesta (vesta) and broken access control in HestiaCP allow low-privileged users to seize admin control of hosting panels
- A deserialization flaw in Ecommerce-CodeIgniter-Bootstrap (CVSS 8.8) is publicly exploitable and remotely triggerable
- Six additional PoC-backed flaws in open-source grocery, hotel, restaurant, and fish-tracking apps round out a day heavy on exploitable web application risks
0
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
A deserialization vulnerability in the ShoppingCart library of Ecommerce-CodeIgniter-Bootstrap allows remote attackers to exploit the getCartItems function by manipulating the shopping_cart argument; with a public exploit already available, any internet-exposed deployment should be treated as immediately at risk.
2
In fickling up to 0.1.11, the UnsafeImportsML pass registers import nodes in a shared context in a way that causes the MLAllowlist pass to silently suppress unsafe findings, meaning pickle payloads that should be flagged as dangerous may be reported as safe — directly undermining any security pipeline relying on fickling for ML model vetting.
3
Fickling up to 0.1.10 omits critical Python standard-library modules (_posixsubprocess, site, atexit) from its unsafe-imports denylist, so check_safety() returns LIKELY_SAFE for pickle payloads capable of executing arbitrary OS-level commands — a silent blind spot for any team using fickling to gate model ingestion.
4
An authenticated RCE flaw in myVesta allows low-privileged users to inject arbitrary OS commands via the v_ftp_user parameter during FTP username deletion, with a public PoC available; successful exploitation can result in full admin-level command execution on the hosting server.
5
HestiaCP's cronjob feature has a broken access control vulnerability that lets unprivileged users modify panel cronjobs to run management scripts with passwordless sudo, enabling full administrator account takeover — a critical escalation path even without direct root access.
6
The AJAX endpoint in restaurant-website-php-mysql lacks authentication entirely, allowing any remote attacker to interact with admin functionality without credentials; a public exploit is already in circulation, making unauthenticated access trivially achievable.
7
A SQL injection in the registration handler of SourceCodester Multi-Vendor Online Grocery Management System 1.0 can be triggered remotely by manipulating the Name argument, with a public exploit available that could expose or corrupt the underlying database.
8
An improper authorization flaw in the same Grocery Management System's save_users function allows remote attackers to bypass access controls, with a public exploit available that could enable unauthorized privilege escalation within the application.
9
A SQL injection via the email parameter in the admin login page of itsourcecode Online Hotel Management System 1.0 is remotely exploitable with a publicly available proof of concept, potentially allowing attackers to bypass authentication or extract sensitive data.
10
A partial string comparison flaw in BettaFish's InsightEngine deduplication logic can be abused remotely to manipulate search results; while the CVSS score is moderate, the public exploit and available fix (pending pull request) mean unpatched instances remain exposed to data integrity attacks.
Today’s recommendation: Teams running myVesta, HestiaCP, or any fickling-based ML pipeline should prioritize patching today, as public PoCs dramatically lower the bar for exploitation; all open-source web applications in the bulletin should be audited for exposure and updated or isolated immediately if patches are not yet available.
With multiple public exploits dropping on the same day across hosting panels and security tooling, now is the right moment to validate which of these components are present in your environment and whether they are exposed to untrusted users or the internet.Don’t wait to become a statistic: validate today, at no cost, whether any of these vectors reach your systems.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →