News
WordPress 'Kirki' flaw CVE-2026-8206 now exploited to hijack admins on 500k sites
Global CompaniesDevelopmentSecurity
Attacks are now hitting CVE-2026-8206 in Kirki, a WordPress plugin on 500,000+ sites. Wordfence blocked 222+ attempts in 24 hours. Unauthenticated attackers can hijack admin accounts — update to 6.0.7 now.
2026.06.0248 views
News
New Langroid server-takeover flaw CVE-2026-54769 (CVSS 10.0): AI-written code gives unauth RCE — update to 0.65.2
AISecurityDevelopment
Langroid's SQLChatAgent runs AI-generated SQL unchecked (CVE-2026-25879, CVSS 9.8): prompt injection can reach DB-host RCE. Update to v0.63.0; least privilege.
2026.06.0268 views
News
Four WordPress plugins hit with critical takeover flaws: CVE-2026-48866 and 3 more
Global CompaniesSecurityDevelopment
Four popular WordPress plugins were hit with critical flaws (up to CVSS 9.8): file deletion in Gravity Forms (CVE-2026-48866) and unauthenticated site takeover in Contest Gallery, wpForo and AIWU. Who's affected and what to update now.
2026.06.0264 views
News
Mautic Hit by Twig-Theme SSTI RCE: CVE-2026-9558, Bundled May Patch Fixes 7 CVEs
DevelopmentSecurity
CVE-2026-9558 (CVSS 9.9) in Mautic, the open-source marketing automation platform, lets authenticated users with theme-upload permission execute arbitrary code via Twig SSTI: themes were rendered without a sandbox. Fixed in 7.1.2 / 6.0.9 / 5.2.11 / 4.4.20 (ELTS), with six more CVEs (SQLi, SSRF, path traversal, authz bypass, stored XSS x2) shipped in the same May 28, 2026 release. ~18,000 live sites and a growing Japanese B2B marketing footprint backed by Acquia Japan.
2026.05.2958 views
News
ACF Extended Admin-Hijack Returns 4 Months Later: CVE-2026-8809, Fix 0.9.2.6
SecurityDevelopment
CVE-2026-8809 (CVSS 9.8) in the WordPress plugin Advanced Custom Fields: Extended (ACF Extended) lets unauthenticated attackers create administrator accounts. All ≤ 0.9.2.5 vulnerable, fixed in 0.9.2.6. 100,000+ sites affected. The second same-shape admin-hijack bug in ACFE in four months. Shipped silently — official changelog says only 'CSS tweaks'.
2026.05.2955 views
News
vLLM Ignores --trust-remote-code=False: Third RCE, CVE-2026-4944
AISecurityDevelopment
vLLM silently overrides your --trust-remote-code=False via hardcoded True in two model files (nemotron_vl.py, kimi_k25.py). Malicious HuggingFace repos can trigger RCE. Fixed in vLLM 0.18.0. The third bypass in the series.
2026.05.2988 views
News
Zed Editor RCE Fix (CVE-2026-44461–44466): Update to 0.229.0 — Opening a Malicious Repo Runs Code on Your Machine
DevelopmentAISecurity
Opening a malicious repo in the Zed editor runs arbitrary code on your machine. CVE-2026-44466 (CVSS 8.6) plus 3 more RCEs hit versions before 0.227.1/0.229.0. The fix is 0.229.0 — update now.
2026.05.29137 views
News
TinyMCE Stored XSS Fix (CVE-2026-47759–47762): Patch to 8.5.1 / 7.9.3 / 5.11.1 — Editors Can Hijack Admin
DevelopmentSecurity
TinyMCE ships four simultaneous stored-XSS fixes (CVE-2026-47759 through 47762, all CVSS 8.7) across data-mce-* attributes, nested SVGs, the media plugin, and mce:protected comments. Patch to 8.5.1, 7.9.3, or 5.11.1 LTS now.
2026.05.29137 views
News
Japan's 'Kokkai-Map' Goes Viral, Built Solo with Claude Haiku 4.5
DevelopmentAI
Kokkai-Map, a Japanese politician tracker built solo by construction-firm owner Shinnosuke Nakajima with Claude Haiku 4.5 and the National Diet Library API, went viral on May 27, 2026, surviving a 26-minute server outage to hit 21,000 X followers.
2026.05.2953 views
News
Jupyter Server's Login Page Can Be Abused for Phishing: Update to 2.20.0
SecurityAIDevelopment
CVE-2025-61669 (CVSS 6.1) lets attackers craft a Jupyter Server login URL that bounces researchers and data scientists to any external site, turning the familiar Jupyter login page into a phishing launcher. Jupyter Server 2.17.0 and earlier are affected, fixed in 2.18.0. JupyterLab and Notebook 7 inherit the flaw via their backend. Reported by Noriaki Iwasaki of Japan's Cyber Defense Institute.
2026.05.2853 views
News
Goobi Viewer Hit by Unauthenticated CVE-2026-45083: Digital Archives At Risk
SecurityInfrastructureDevelopment
CVE-2026-45083 (CVSS 9.8) lets unauthenticated network clients send arbitrary Solr streaming expressions to Goobi viewer, the digital archive platform widely used by libraries, museums and research institutions. Versions 4.8.0 through 26.04.0 are affected; the broken endpoint was removed in 26.04.1.
2026.05.2845 views
News
Budibase Hit by Five Critical Authz Flaws: CVE-2026-46425 et al., Update to v3.39.0
DevelopmentAISecurity
Five critical authorization and SSRF vulnerabilities in the Budibase low-code platform (CVE-2026-46425/48150/45716/45717/48153, CVSS 9.9 to 8.5) were disclosed on May 27, 2026. Issues range from SCIM router bypass to tenant-wide privilege escalation to global admin. Fixed in v3.39.0.
2026.05.2857 views
