Articles & Writeups
Submit ArticleCommunity-curated external articles, writeups, and technical analysis about CVE vulnerabilities.
Unpatched Critical/High Flaws Dominate Amid Active PHP and Edge-Device RCE
Overview 4013 CVEs were published (347 Critical, 1462 High, 1584 Medium, 353 Low), 1 in CISA KEV, 360 with public exploit code. Critical Threats - CVE-2026-114625 (CRITICAL, CVSS 9.4) — Arista Networks VeloCloud Orchestrator privilege escalation via SQL injection, allowing any valid VCO account to gain operator-level access and impersonate the built-in superuser. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-109619 (CRITICAL, CVSS 9.2) — PHP use-after-free in per-request global state handling allows unauthenticated remote code execution against persistent workers; affects PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. Public exploit code available; vendor-released patches: 8.2.35, 8.3.36, 8.4.27, 8.5.12. - CVE-2026-109618 (CRITICAL, CVSS 9.2) — Unauthenticated remote code execution in PHP via out-of-memory condition during partial request initialization, affecting 8.2.x, 8.3.x, 8.4.x, and 8.5.x with Apache mod_php. Public exploit code available; vendor-released patches: 8.2.35, 8.3.36, 8.4.27, 8.5.12. - CVE-2026-110264 (CRITICAL, CVSS 10.0) — GitLab CE/EE remote code execution via a specially crafted regular expression triggering an integer overflow (CWE-190), affecting versions 7.0 through 19.5.1; unauthenticated remote attackers. Public exploit code available; vendor patch released. - CVE-2026-113802 (CRITICAL, CVSS 9.3) — Wavlink WL-WN530BE1-A unauthenticated OS command injection via forged `IP-FROM` header and crafted `file_id` parameter, allowing remote attackers to execute arbitrary commands as root; affects firmware through M30BE1_V251117. Public exploit code available; no vendor-released patch identified. - CVE-2026-110956 (CRITICAL, CVSS 9.8) — WordPress asVereinbase plugin authentication bypass allows unauthenticated remote attackers to log in as any user, including administrator, by exploiting acceptance of empty stored password or second-factor values. Public exploit code available; vendor-released patch: 1.1.8. - CVE-2026-109442 (CRITICAL, CVSS 9.3) — Unauthenticated remote code execution in PiFlow 2.0.0–2.0.1; network attackers can invoke the `exec_shell` tool via POST /chat or POST /chat/stream to run arbitrary commands without approval or an allow-list. Public exploit code available; no vendor-released patch identified. - CVE-2026-114382 (CRITICAL, CVSS 9.3) — TOTOLINK EX200 stack-based buffer overflow via crafted HTTP request to `setStaticDhcpConfig` in `/cgi-bin/cstecgi.cgi`. Public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers; affected firmware: 5.2.3c.7200. Threat Landscape Most-affected vendors: Oracle (1085), Google (381), WordPress (283), Linux (224), Apache (144). Most common attack techniques: Authentication Bypass (1210), Information Disclosure (886), Denial Of Service (646), RCE (473), Buffer Overflow (404). Patch coverage: 2020 of 4013 CVEs have a patch; 870 Critical/High remain unpatched. Key Trends - Volume is 26% down week-over-week (5403 → 4013 CVEs). - 1 CVE is in CISA's KEV catalog. - 360 CVEs have public exploit code.
Actively Exploited Edge-Device Auth Bypasses Dominate Week; Most Lack Patches
Overview This week tracked 5408 vulnerabilities, including 390 critical and 2408 high severity, with 5 confirmed in CISA KEV as actively exploited and 374 carrying public proof-of-concept code. Of particular concern, 824 critical and high vulnerabilities remain unpatched, a pattern reflected in the top findings where several KEV-listed flaws in Ivanti, BeyondTrust, Cisco, and Palo Alto products have no vendor patch identified. Defenders should prioritize the actively exploited edge and remote-access issues alongside the patchable GitLab and AnyDesk flaws with available exploit code. Critical Threats - CVE-2026-104935 (HIGH, CVSS 8.6) — Ivanti Connect Secure authentication bypass via spoofing allows remote unauthenticated attackers to execute arbitrary commands with full system compromise in versions before 25.1.3.0. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-102764 (CRITICAL, CVSS 9.3) — BeyondTrust Remote Support authentication bypass (CWE-290) in internal components that fail to validate message origin, potentially allowing unauthenticated file operations on the appliance; no vendor-released patch identified. Confirmed actively exploited (CISA KEV); no authentication or user interaction required. - CVE-2026-76519 (CRITICAL, CVSS 9.8) — Cisco Secure Email Gateway unauthenticated remote code execution via relative path traversal in attachment handling, allowing arbitrary file write and command execution as root when the AMP file reputation service is enabled. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-96951 (HIGH, CVSS 8.8) — Microsoft Windows Shell command injection allowing remote unauthenticated attackers to bypass a Windows security feature and execute arbitrary commands, affecting Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012/2016/2019/2022/2025, and Outlook; requires victim interaction. Confirmed actively exploited (CISA KEV); vendor-released patch available per advisory. - CVE-2026-0322 (HIGH, CVSS 8.6) — Palo Alto Networks PAN-OS code-injection flaw (CWE-94) in the management plane allows authenticated high-privilege administrative attackers to execute arbitrary code with root privileges on PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-97229 (CRITICAL, CVSS 10.0) — GitLab CE/EE remote code execution via specially crafted CI/CD configuration regex. Public exploit code available; vendor-released patch: 19.2.8, 19.3.5, 19.4.2. Unauthenticated remote attackers. - CVE-2026-111214 (HIGH, CVSS 8.6) — Netgate pfSense CE OS command injection in versions 2.7.0 through 2.9.0 allows an authenticated user with QinQ edit privilege to execute arbitrary commands as root via an unvalidated interface value interpolated into an ifconfig shell command. Public exploit code available; no vendor-released patch identified. - CVE-2026-109390 (CRITICAL, CVSS 9.8) — AnyDesk remote code execution via heap-based buffer overflow in the Linux session protocol stream packet handler before version 8.0.3; unauthenticated remote attackers can execute arbitrary code as root without victim interaction. Public exploit code available; vendor-released patch: 8.0.3. Threat Landscape Most-affected vendors: Microsoft (1354), Linux (500), WordPress (461), Red Hat (232), Juniper (153). Most common attack techniques: Information Disclosure (1419), Buffer Overflow (1085), Authentication Bypass (977), Denial Of Service (875), Memory Corruption (505). Patch coverage: 3580 of 5408 CVEs have a patch; 824 Critical/High remain unpatched. Key Trends - Volume is 68% up week-over-week (3227 → 5408 CVEs). - 5 CVEs are in CISA's KEV catalog. - 374 CVEs have public exploit code.
Langflow RCE and Widespread Unpatched Critical Flaws Define the Week
Overview 3230 CVEs were published (366 Critical, 1162 High, 1319 Medium, 198 Low), 0 in CISA KEV, 403 with public exploit code. Critical Threats - CVE-2026-105697 (CRITICAL, CVSS 9.9) — Langflow OS command injection via MCP stdio transport; attackers with access to the MCP server configuration endpoint or MCP Tools component can execute arbitrary OS commands with the privileges of the Langflow process user. Public exploit code available; vendor-released patch: 1.10.3. - CVE-2026-93674 (CRITICAL, CVSS 9.8) — IBM Langflow OSS unauthenticated remote code execution in versions 1.0.0 through 1.12.2. Public exploit code available; vendor-released patch available. Unauthenticated remote attackers with network access can execute arbitrary operating system commands on the underlying host with no user interaction required. - CVE-2026-76485 (CRITICAL, CVSS 9.8) — Cisco NX-OS Software stack-based buffer overflow in the VXLAN OAM (NGOAM) feature allows unauthenticated remote attackers with IP reachability to achieve arbitrary code execution with root privileges or force a device reload via crafted packets. Public exploit code available; no vendor-released patch identified. - CVE-2026-105110 (CRITICAL, CVSS 9.3) — Iskratel Innbox GPON ONT unauthenticated remote OS command injection via the `login.xgi` CGI endpoint; attackers with access to the web management interface can execute arbitrary commands with root privileges. Public exploit code available; no vendor-released patch identified. - CVE-2026-104028 (CRITICAL, CVSS 9.8) — Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) via arbitrary PHP file upload due to missing capability checks, nonce verification, and file-type validation. Public exploit code available; no vendor-released patch identified. - CVE-2026-106511 (CRITICAL, CVSS 9.8) — MultiversX `multisig-improved` reference smart contract (mx-multisig-and-modules) missing authorization checks allow a Proposer-role account to unilaterally drain 100% of a deployed contract's EGLD/ESDT balance in as few as two transactions with zero board signatures. Public exploit code available; no vendor-released patch identified. - CVE-2026-84734 (CRITICAL, CVSS 9.8) — Authentication bypass in the WordPress Mindstien Quick Login plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session. Public exploit code available; no vendor-released patch identified. - CVE-2026-85118 (CRITICAL, CVSS 9.8) — WordPress AI Content Generator Marketing plugin (versions through 1.0.0) allows unauthenticated attackers to update and delete arbitrary WordPress options via AJAX handlers that perform no nonce or capability checks, enabling full site takeover. Public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: WordPress (751), Google (297), Linux (230), IBM (117), Red Hat (88). Most common attack techniques: Authentication Bypass (777), Information Disclosure (743), Denial Of Service (356), XSS (333), Buffer Overflow (292). Patch coverage: 1633 of 3230 CVEs have a patch; 811 Critical/High remain unpatched. Key Trends - Volume is 33% up week-over-week (2424 → 3230 CVEs). - 403 CVEs have public exploit code.
KEV-Confirmed Exploitation Spans Zammad, Fortinet, Cisco, and Apple
Overview This week's briefing covers 2424 vulnerabilities, including 257 critical and 1011 high-severity findings. Six are confirmed on the CISA KEV list as actively exploited, and 266 have public exploit code available. Notably, 637 critical and high-severity vulnerabilities remain unpatched, including actively exploited flaws in Fortinet FortiMail and Cisco Catalyst SD-WAN Manager for which no vendor patch has been identified. Critical Threats - CVE-2026-102489 (CRITICAL, CVSS 9.4) — Zammad session fixation vulnerability in versions 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to hijack active sessions and escalate to remote code execution with 'zammad' service account privileges; requires passive user interaction. Confirmed actively exploited (CISA KEV); vendor-released patch available. - CVE-2026-102490 (CRITICAL, CVSS 9.4) — Zammad local privilege escalation allowing an attacker controlling the unprivileged 'zammad' service account to elevate to root, affecting versions 1.5.0 up to but not including 7.1.0-alpha. Confirmed actively exploited (CISA KEV); vendor-released patch: 7.1.0-alpha. - CVE-2026-104286 (CRITICAL, CVSS 9.8) — Fortinet FortiMail unauthenticated path traversal allowing arbitrary file write via crafted HTTP/HTTPS requests, affecting versions 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, and 8.0.0–8.0.1. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-76504 (CRITICAL, CVSS 9.8) — Cisco Catalyst SD-WAN Manager (vManage) authentication bypass allows unauthenticated remote attackers to reach a restricted HTTP API endpoint with admin privileges via crafted URI encoding. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-86950 (HIGH, CVSS 8.8) — Apple iOS, iPadOS, and macOS out-of-bounds write in file-parsing code allows arbitrary code execution when a victim opens a maliciously crafted file. Confirmed actively exploited (CISA KEV); vendor-released patches: iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. - CVE-2026-88779 (HIGH, CVSS 8.7) — Citrix NetScaler ADC and NetScaler Gateway denial-of-service vulnerability exploitable by unauthenticated remote attackers with no user interaction required. Confirmed actively exploited (CISA KEV); vendor-released patch: 14.1-73.41. - CVE-2026-101076 (CRITICAL, CVSS 9.3) — Netcore NR289-GE firmware 1.4.5102 unauthenticated OS command injection in CGI handler; remote attackers can execute arbitrary shell commands via a crafted `ntp_ip` value to `/set_ntp_server_ip.cgi`. Public exploit code available; no vendor-released patch identified. - CVE-2026-102240 (CRITICAL, CVSS 9.3) — Netcore NAP930 router OS command injection via the `sid` parameter of `/www/cgi-bin/network_tools` CGI in firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands; public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: WordPress (462), Red Hat (149), Apache (141), Linux (118), Nvidia (117). Most common attack techniques: Information Disclosure (557), Authentication Bypass (387), Denial Of Service (353), XSS (344), RCE (265). Patch coverage: 1164 of 2424 CVEs have a patch; 637 Critical/High remain unpatched. Key Trends - Volume is 18% down week-over-week (2959 → 2424 CVEs). - 6 CVEs are in CISA's KEV catalog. - 266 CVEs have public exploit code.
Actively Exploited Edge Appliances Dominate; Six KEV, Many Unpatched
Overview This week logged 2965 vulnerabilities, including 239 critical and 1026 high-severity issues, with 6 confirmed on CISA's KEV list and 393 carrying public exploit code. Actively exploited flaws concentrate in internet-facing infrastructure—Citrix NetScaler, Check Point management, F5 BIG-IP, and Arista VeloCloud—several with no vendor patch identified. With 459 critical and high-severity vulnerabilities still unpatched, exposure remains elevated and prioritized remediation of exploited edge devices is urgent. Critical Threats - CVE-2026-88771 (CRITICAL, CVSS 9.5) — Citrix NetScaler ADC and NetScaler Gateway unauthenticated remote command execution. Confirmed actively exploited (CISA KEV); public exploit code available. Vendor-released patch: 14.1-73.37 / 13.1-64.23 (including FIPS and NDcPP builds). Unauthenticated remote attackers. - CVE-2026-88772 (CRITICAL, CVSS 9.5) — Citrix NetScaler ADC and Gateway unauthenticated remote code execution or denial of service affecting builds prior to 14.1-73.37 and 13.1-64.23 (including FIPS and NDcPP builds). Confirmed actively exploited (CISA KEV); public exploit code available; vendor-released patch: 14.1-73.37. - CVE-2026-93616 (CRITICAL, CVSS 9.8) — Check Point Quantum Security Management / Multi Domain Security Management unauthenticated remote code execution via directory traversal combined with malicious file upload to the management server file-upload interface. Confirmed actively exploited (CISA KEV); public exploit code available; no vendor-released patch identified. - CVE-2026-94127 (CRITICAL, CVSS 9.3) — F5 BIG-IP remote code execution via heap-based buffer overflow in the data plane on virtual servers configured with both an APM access policy and an OAuth profile. Confirmed actively exploited (CISA KEV); public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers. - CVE-2026-93952 (CRITICAL, CVSS 9.5) — Arista Networks VeloCloud Orchestrator (on-prem) unauthenticated remote access to privileged internal functionality, potentially compromising confidentiality, integrity, and availability of the orchestrator and managed data. Confirmed actively exploited (CISA KEV); public exploit code available; no vendor-released patch identified. - CVE-2026-87902 (HIGH, CVSS 8.1) — WordPress core unauthenticated remote code execution via `get_page_template()` local file inclusion outside active theme directories; requires specific server and active-theme preconditions. Confirmed actively exploited (CISA KEV); public exploit code available; vendor-released patch available. - CVE-2026-100382 (CRITICAL, CVSS 10.0) — MediaWiki ExternalData extension (PHP) OS command injection allows unauthenticated remote attackers to execute arbitrary operating-system commands on the wiki server. Public exploit code available; vendor-released patch: 3.7. - CVE-2026-97359 (CRITICAL, CVSS 10.0) — Rejetto HFS2 (HTTP File Server) unauthenticated remote code execution via server-side template injection in multipart upload filenames, allowing arbitrary command execution on the host without credentials. Public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: Linux (642), WordPress (266), Red Hat (126), IBM (103), Apache (60). Most common attack techniques: Information Disclosure (901), Authentication Bypass (378), Denial Of Service (317), XSS (258), RCE (226). Patch coverage: 2030 of 2965 CVEs have a patch; 459 Critical/High remain unpatched. Key Trends - Volume is 35% down week-over-week (4577 → 2965 CVEs). - 6 CVEs are in CISA's KEV catalog. - 393 CVEs have public exploit code.
Actively Exploited Cisco and Oracle Flaws Dominate Unpatched Critical Risk
Overview 4579 CVEs were published (457 Critical, 1981 High, 1227 Medium, 300 Low), 4 in CISA KEV, 529 with public exploit code. Critical Threats - CVE-2026-76460 (CRITICAL, CVSS 10.0) — Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector authentication bypass allows an unauthenticated remote attacker to reach a privileged API endpoint and gain unauthorized access via the web-based management interface. Confirmed actively exploited (CISA KEV); public exploit code available; no vendor-released patch identified. - CVE-2026-76461 (CRITICAL, CVSS 9.8) — Cisco Secure Email Gateway unauthenticated remote command execution with root privileges via SQL injection in the mail-parsing pipeline, affecting AsyncOS 13.x, 14.x, 15.x, and 16.x. Confirmed actively exploited (CISA KEV); public exploit code available; no vendor-released patch identified. - CVE-2026-58704 (HIGH, CVSS 8.8) — Google Android/Pixel cellular modem firmware permission bypass allows a nearby unauthenticated attacker to escalate privileges and achieve full compromise (C:H/I:H/A:H) via crafted radio signaling. Confirmed actively exploited (CISA KEV); public exploit code available; no vendor-released patch identified. - CVE-2026-87886 (HIGH, CVSS 7.8) — Acronis Backup integration plugins for cPanel & WHM, Plesk, and DirectAdmin on Linux allow local privilege escalation via insecure file and directory permissions. Confirmed actively exploited (CISA KEV); vendor-released patch available. - CVE-2026-76423 (CRITICAL, CVSS 10.0) — Cisco Identity Services Engine (ISE) and ISE-PIC unauthenticated remote takeover via missing authorization checks in the REST API web service, granting full administrative privileges over policy configuration and identity data. No vendor-released patch identified. - CVE-2026-83059 (CRITICAL, CVSS 10.0) — Oracle Internet Directory LDAP server component allows unauthenticated remote attackers to fully compromise the directory service; affected versions 12.2.1.4.0 and 14.1.2.1.0. No vendor-released patch identified. - CVE-2026-83020 (CRITICAL, CVSS 10.0) — Oracle Fusion Middleware OPSS (Platform Security for Java) authentication bypass in the Centralized Thirdparty Jars component, affecting versions 12.2.1.4.0 and 14.1.2.0.0; unauthenticated remote attackers can achieve full system takeover. No vendor-released patch identified. - CVE-2026-83021 (CRITICAL, CVSS 10.0) — Oracle WebLogic Server authentication bypass in the Web Container component allows unauthenticated remote attackers to achieve full server takeover on versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 over HTTP. No vendor-released patch identified. Threat Landscape Most-affected vendors: Linux (899), Oracle (643), WordPress (326), Apple (256), Google (185). Most common attack techniques: Information Disclosure (1125), Authentication Bypass (908), Denial Of Service (652), Buffer Overflow (444), Privilege Escalation (328). Patch coverage: 2503 of 4579 CVEs have a patch; 1278 Critical/High remain unpatched. Key Trends - Volume is 21% up week-over-week (3774 → 4579 CVEs). - 4 CVEs are in CISA's KEV catalog. - 529 CVEs have public exploit code.
Actively Exploited Critical RCE and File-Read Flaws Dominate the Week
Overview 3774 CVEs were published (359 Critical, 1726 High, 1295 Medium, 193 Low), 6 in CISA KEV, 311 with public exploit code. Critical Threats - CVE-2026-85706 (CRITICAL, CVSS 10.0) — GitLab CE/EE unauthenticated arbitrary file read via the repository commits API, allowing remote attackers to retrieve files from the GitLab server without authentication; affects all 18.7 releases through 19.3.2 (before 19.1.8, 19.2.6, and 19.3.2). Confirmed actively exploited (CISA KEV); public exploit code available; vendor-released patch: 19.3.2. - CVE-2026-75650 (CRITICAL, CVSS 10.0) — Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows unauthenticated remote attackers to execute arbitrary code (CWE-1336); confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-84869 (CRITICAL, CVSS 9.9) — ConnectWise ScreenConnect unauthorized file transfer and execution allows a party to an active remote session to push and run arbitrary files on the Host machine without authorization. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-87491 (HIGH, CVSS 8.8) — Google Chrome V8 JavaScript engine out-of-bounds write allows remote code execution within the renderer sandbox via a crafted HTML page. Confirmed actively exploited (CISA KEV); vendor-released patch: 153.0.8010.3. - CVE-2026-81963 (HIGH, CVSS 7.8) — Microsoft Windows Update Stack symlink following (CWE-59) enabling local privilege escalation to SYSTEM on Windows 11 23h2, 24h2, 25h2, 26h1, and Windows Server 2025. Confirmed actively exploited (CISA KEV); public exploit code available; vendor-released patch available. - CVE-2026-85880 (HIGH, CVSS 7.8) — Microsoft Windows heap-based buffer overflow in the ALPC subsystem allows a low-privileged local attacker to elevate privileges to SYSTEM level across Windows 10 1607, Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Confirmed actively exploited (CISA KEV); vendor-released patch available. - CVE-2026-85103 (CRITICAL, CVSS 9.8) — Check Point Quantum Security Gateway and Quantum Security Management remote code execution via heap-based buffer overflow in the ASN.1 decoder parsing VPN certificates; public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers. - CVE-2026-85102 (CRITICAL, CVSS 9.8) — Check Point Quantum Security Gateway remote code execution via improper certificate trust validation during VPN negotiation (CWE-295). Public exploit code available; no vendor-released patch identified. Unauthenticated remote attackers. Threat Landscape Most-affected vendors: Microsoft (892), Linux (444), Google (321), WordPress (268), Adobe (159). Most common attack techniques: Information Disclosure (733), Buffer Overflow (608), Denial Of Service (428), Heap Overflow (333), Memory Corruption (294). Patch coverage: 2532 of 3774 CVEs have a patch; 556 Critical/High remain unpatched. Key Trends - Volume is 66% up week-over-week (2268 → 3774 CVEs). - 6 CVEs are in CISA's KEV catalog. - 311 CVEs have public exploit code.
Actively Exploited Edge and Browser Flaws Anchor This Week's Risk
Overview Of 2268 vulnerabilities tracked this week, 285 were critical and 780 high, with 3 confirmed in CISA's Known Exploited Vulnerabilities catalog spanning SonicWall SMA1000 and Google Chrome. Public exploit code exists for 372 issues, and 605 critical or high vulnerabilities remain unpatched, including several WordPress plugin flaws enabling remote code execution. Critical Threats - CVE-2026-83548 (CRITICAL, CVSS 10.0) — SonicWall SMA1000 pre-authentication server-side request forgery in the Work Place interface allows unauthenticated remote attackers to reach internal functionality and perform unauthorized operations; affects firmware through 12.4.3-03453 and 12.5.0-02835. Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-85046 (HIGH, CVSS 8.8) — Google Chrome type confusion in V8 JavaScript engine enables unauthenticated remote attackers to execute arbitrary code within the renderer sandbox by enticing a user to visit a specially crafted HTML page. Confirmed actively exploited (CISA KEV); vendor-released patch: 152.0.7977.82. - CVE-2026-83549 (HIGH, CVSS 7.8) — SonicWall SMA1000 Appliance Management Console OS command injection allows a remote authenticated administrator to execute arbitrary commands (CWE-78). Confirmed actively exploited (CISA KEV); no vendor-released patch identified. - CVE-2026-4357 (CRITICAL, CVSS 10.0) — Unrestricted file upload in the Embed HTML5 Game WordPress plugin (versions through 1.3) allows unauthenticated attackers to upload arbitrary PHP files, enabling remote code execution. Public exploit code available; no vendor-released patch identified. - CVE-2026-77009 (CRITICAL, CVSS 9.9) — Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user, including low-privilege subscribers, to execute arbitrary PHP via an unrestricted debugging console. Public exploit code available; no vendor-released patch identified. - CVE-2025-9314 (CRITICAL, CVSS 9.8) — Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) via the bundled SWFUpload component, enabling remote code execution. Public exploit code available; no vendor-released patch identified. - CVE-2026-78362 (CRITICAL, CVSS 9.8) — WordPress SEO Flow by LupsOnline plugin (versions 3.0.0 through 3.0.2) authentication bypass via improper API credential validation, allowing unauthenticated attackers to operate with administrator-level privileges and achieve full site takeover. Public exploit code available; vendor-released patch: 3.0.3. Unauthenticated remote attackers. - CVE-2026-82971 (CRITICAL, CVSS 9.3) — QVidium Opera11 (firmware 3.3.2a26-Ax4x-opera11) command injection via the `ipaddr` argument of `/cgi-bin/net_tr.cgi` allows unauthenticated remote attackers to execute arbitrary OS commands. Public exploit code available; no vendor-released patch identified. Threat Landscape Most-affected vendors: WordPress (318), Linux (188), IBM (70), Suse (57), Google (53). Most common attack techniques: Information Disclosure (444), Authentication Bypass (363), Denial Of Service (211), XSS (208), RCE (188). Patch coverage: 1107 of 2268 CVEs have a patch; 605 Critical/High remain unpatched. Key Trends - Volume is 11% down week-over-week (2558 → 2268 CVEs). - 3 CVEs are in CISA's KEV catalog. - 372 CVEs have public exploit code.
