Practical articles on AI, online safety, and security (60 articles)
CISA added this flaw to the KEV catalog on August 24, 2026 with a remediation deadline of August 27. Exploitable over the network without authentication and scored 10.0 under CVSS 3.1, here are the affected versions, the patch to apply, and Oracle's own stance on workarounds.
JetFormBuilder for WordPress (about 80,000 active installs) lets an unauthenticated attacker create an administrator account. Wordfence scores it 9.8 CRITICAL on CVSS v3.1. This CVE itself is fixed in 3.6.2.1, but five more CVEs landed in September, so clearing all six takes 3.6.5.2 or later.
A crafted email is enough to run commands as root on Cisco Secure Email Gateway, with no authentication. Cisco scores it 9.8 CRITICAL on CVSS v3.1 and states it became aware of active exploitation in September 2026. There are no workarounds.
Self-managed GitLab has a flaw that lets an unauthenticated attacker read arbitrary files from the server. CVE-2026-85706 is scored 10.0 CRITICAL on CVSS v3.1 by GitLab. CISA added it to the Known Exploited Vulnerabilities catalog on 11 September 2026. Fixed in 19.1.8, 19.2.6 and 19.3.2.
A flaw in the WordPress plugin miniOrange 2FA lets any unauthenticated visitor delete arbitrary site options. WPScan scores it 10.0 CRITICAL on CVSS v3.1. Fixed in 6.3.1 (free) and 19.3 (Pro), with a proof of concept scheduled for public release on 8 October 2026.
Google shipped Chrome 153 (153.0.8010.36) to fix CVE-2026-87491, an out-of-bounds write in V8. Google rates it Medium, but its own release notes confirm an exploit exists in the wild, CISA set a 23 September 2026 deadline, and other Chromium browsers such as Edge and Opera are in scope too.
Google's Agent Development Kit for Python, google-adk 2.0.0 through 2.6.0, has a CVSS 10.0 code injection. A crafted test session replay against adk web on a host with pytest installed gives an unauthenticated attacker code execution. Fixed in 2.7.0 — and we verified in the source that 2.6.1 through 2.6.3 are unpatched too.
The WordPress plugin Frontend Admin by DynamiApps is vulnerable to a CVSS 9.8 authentication bypass in all versions up to and including 3.29.12. An unauthenticated attacker can overwrite an administrator's email address and take the account over through the password reset flow. Version 3.29.13 shipped on 25 August 2026. Around 9,000 active installs.
Inventory the web tier separately from WebLogic Server. Record Oracle Home patch history, the configured plug-in path and post-change checks in a handoff template.
MapLibre GL JS 6.4.0 and earlier carry a CVSS 10.0 XSS. The sanitizer skips one dangerous attribute out of every adjacent pair, and the surviving handler fires the moment the map renders its attribution. Update the maplibre-gl npm package to 6.4.1 or later.
CISA added LiteLLM's MCP auth bypass and Starlette's missing Host header validation to its KEV catalog of actively exploited flaws on September 2, 2026. Update LiteLLM to 1.84.0, Starlette to 1.0.1.
Amelia Premium 8.0 through 9.6.2 lets an unauthenticated attacker overwrite an administrator's password and take over the account (CVE-2026-9055, CVSS v3.1 9.8 CRITICAL). The fix is 9.6.3; the current release is 9.8.1. Check your version number first — the free edition uses a different version series.
PaperCut NG/MF, CVE-2026-81578 and CVE-2026-82078: restrict internet access to the admin interface now, then apply Emergency Patch Release 3. The two are being chained in real attacks and CISA added both to its Known Exploited Vulnerabilities catalog on 2026-08-31. Version numbers will not tell you whether you are safe.
An SMTP command injection in Nodemailer via envelope.size. It does not occur under default settings, and scoring is split between LOW and CRITICAL. Here is how to tell whether you are actually affected.
An authenticated user can write outside the intended Docker cache path, so a forged image gets cached under a trusted name. The CVSS score is only 5.3, but it was exploited in the wild and is now in CISA's KEV catalog.
Gitea 1.17 through 1.27.0 lets an attacker plant a live Git hook through the diffpatch API and run commands as the Gitea service account. CISA added it to KEV on August 25 with an August 28 due date. Affected versions, real preconditions, and checks.
CVE-2026-4342 starts with a low-privileged user who can create or modify Ingress annotations. This correction lists the exact affected and fixed versions and resulting impact.
An unauthenticated SQL injection can lead to Metabase administrator access. Update to the fixed release for the deployed branch and perform the vendor's compromise checks.
The previous CVE identifier and WordPress 7.0.4 claims were incorrect. This correction uses the official 7.0.2 release and CVE-2026-60137/63030 details.
Microsoft lists a Critical security bypass and a High-severity RCE, but not confirmed exploitation at publication. Apply the product-specific updates promptly.
Hotfix 1 has been superseded by additional mitigation. On-premises deployments should install 2026.3.1.10 and investigate for compromise because exploitation has been observed.
The three NVMe/TCP, SMC, and SCTP issues should not be described collectively as CVSS 9.8 remote RCEs. This correction uses the official Linux CVE announcements.
An urgent backdoor, CVE-2026-18072, has been discovered in WordPress plugin 'Advanced Responsive Video Embedder (ARVE)' version 10.8.7. Please delete the affected plugin immediately.
A security settings checklist that Web service developers should integrate into their weekly routine. Review it now and maintain secure operations.
CVE-2026-16812 lets an unauthenticated remote attacker reach privileged internal functionality in VeloCloud Orchestrator On-Prem. Arista rates it CVSS v3.1 10.0. Install the fixed build for your branch immediately.
An urgent vulnerability (CVE-2026-47304) affecting Microsoft .NET and Visual Studio has been discovered, allowing unauthenticated attackers to bypass security features. Immediate update to a patched version is mandatory.
An authentication bypass vulnerability (CVE-2026-66013) has been discovered in OpenRemote versions prior to 1.26.2. Unauthorized attackers could update console assets and hijack notifications, necessitating an immediate update to the patched version.
A practical recurring checklist for patching, MFA, least privilege, backups, and logging. Prioritize each control for your assets and risk instead of relying on a daily news cycle.
REST API batch-route confusion and SQL injection can lead to remote code execution. Check the applicable fixed release: 6.9.5 for the 6.9 branch or 7.0.2 for 7.0.
Separate SharePoint authentication-bypass privilege escalation CVE-2026-56164 from deserialization RCE CVE-2026-58644 and install each fixed build. Microsoft's scores are 5.3 MEDIUM and 9.8 CRITICAL.
A heap buffer overflow affects NGINX map regular-expression processing. It can restart workers and cause DoS; code execution requires ASLR to be disabled or bypassed. Install a fixed release.
Cisco IOS 12.4 on the Cisco 871 has CSRF flaws that abuse an authenticated administrator session. Disable or restrict HTTP administration and migrate to supported hardware.
CVE-2026-53359 affects x86 KVM shadow paging and can cross the guest-to-host security boundary. Check the virtualization host's patch status. The earlier success-rate claims have been withdrawn.
A flaw in Linux rtmutex handling can lead to use-after-free through local futex operations. Install the kernel vendor's fixed package and verify that the fix is running.
A critical path traversal vulnerability, CVE-2026-48282, in Adobe ColdFusion is being actively exploited. With a CVSS score of 10.0, immediate patching for this vulnerability is imperative.
NetScaler ADC/Gateway configured as a SAML IdP has an unauthenticated memory over-read flaw. The CNA rates it CVSS v4.0 8.8 HIGH. Update the affected build.
A severe authenticated RCE vulnerability, 'CVE-2026-45659,' has been discovered in Microsoft SharePoint Server and added to the CISA KEV catalog. It allows code execution even by low-privileged users, necessitating immediate patch application.
This third-party WordPress plugin allows an authenticated Author-level user to execute code. Versions through 1.10.2 are affected; it is not a Cloudflare product.
An unrestricted upload of a dangerous file type can lead to code execution without authentication or user interaction. Install the fixed releases in Adobe bulletin APSB26-68.
Partial copy-on-write handling in tc pedit can corrupt page-cache data. This is a local CAP_NET_ADMIN attack, not remote RCE. Install a fixed distribution kernel.
Ultimate Member 2.11.4 and earlier can expose password-reset links to an authenticated Contributor-level attacker, enabling takeover of accounts including administrators.
A critical vulnerability has been discovered in the Deno runtime that allows bypassing the --deny-net rule, enabling access to internal networks. Immediate update to version 2.8.1 or later is required.
A compromised update server distributed malicious code to three Pro plugins. Install each product's fixed release, rotate credentials, and investigate the site for persistence.
JCE 1.0.0 through 2.9.99.4 can allow unauthenticated creation of editor profiles followed by PHP upload and execution. Apply JCE's fixed release or official legacy patch.
A severe unauthenticated SQL injection vulnerability has been discovered in WordPress plugin 'eCommerce Product Catalog' versions 3.5.5 and below, allowing database manipulation without authentication. Immediate update is mandatory.
A critical vulnerability has been discovered in applications that process JavaScript embedded in PDF files. Maliciously crafted PDFs could lead to arbitrary code execution.
An authentication bypass vulnerability has been discovered in the PHP application of Nefteprodukttekhnika BUK TS-G. This could allow a remote, unauthenticated attacker to seize administrator privileges and manipulate the system.
A severe vulnerability (CVSS 9.8) allowing unauthenticated remote code execution has been discovered in Oracle PeopleSoft Enterprise PeopleTools, and numerous organizations have been compromised by zero-day attacks. Immediate patching and access restrictions are required.
An unauthenticated OS command injection vulnerability in Ivanti Sentry has been urgently disclosed. Rated with a CVSS score of 10.0, active exploitation has already been confirmed. Immediate patch application and access restrictions are mandatory.
A vulnerability in WordPress's popular backup plugin 'UpdraftPlus' is being actively exploited, potentially allowing unauthenticated attackers to gain administrator privileges and execute remote code.
A certificate-validation logic flaw in deprecated IKEv1 can let an unauthenticated attacker establish Remote Access VPN without a valid user password.
V8 in Chrome before 149.0.7827.103 has an out-of-bounds read/write that can execute code inside the sandbox through crafted HTML. Install Google's fixed release.
A critical denial-of-service (DoS) vulnerability, CVE-2026-49975, has been disclosed in the mod_http module of Apache HTTP Server. Versions 2.4.17 through 2.4.67 are affected, and a prompt update is recommended.
CVE-2026-49975 combines HTTP/2 HPACK compression with flow-control stalling to consume large server resources from limited traffic. It is rated CVSS v3.1 7.5 HIGH. Apply the product-specific fix or official mitigation.
Unauthenticated RCE in Everest Forms Pro and SQL injection in PDO Firebird are separate issues. Their authoritative scores are CVSS v3.1 9.8 and CVSS v4.0 7.4.
Full Page Cache Warmer for Magento 2 before 1.11.12 unsafely deserializes the CacheWarmer cookie, allowing unauthenticated RCE through available gadget chains.
WP Maps Pro 6.1.0 and earlier exposes a nonce and temporary-access handler that can create an administrator without authentication. Update to version 6.1.1 or later.
WP Maps Pro 6.1.0 and earlier exposes a nonce and temporary-access handler that can create an administrator without authentication. Update to version 6.1.1 or later.
XPath injection in APS Application Catalog search can let a low-privileged authenticated user execute OS commands. The authoritative CVSS v3.1 score is 9.9, not 10.0.
A severe authentication bypass vulnerability (CVE-2026-0257) has been disclosed in Palo Alto Networks PAN-OS GlobalProtect, and active exploitation has been confirmed. Urgent patch application and mitigation measures are essential.