News
Apache Traffic Server: five more CVEs flip the ranking
InfrastructureSecurity
Apache disclosed 38 Traffic Server CVEs on July 29, 2026. Three hit 10.0 under CVSS 3.1 but 7.0-7.8 under 4.0, both official. And 9.1.15 does not exist.
2026.07.2954 views
News
CVE-2026-65667 Gave Teams a 10.0. Here's What Actually Needs Patching
SecurityInfrastructure
Of the 51 entries Microsoft published on July 23, 2026, the 14 cloud entries including all six scored 10.0 are already fixed and need no customer action. The work sits with 25 Azure Linux and 12 Edge entries scored far lower.
2026.07.2954 views
News
PostgreSQL Extension pglogical: CVE-2026-50736 Superuser Escalation
DevelopmentInfrastructureSecurity
Four flaws hit pglogical, a PostgreSQL add-on. The side receiving replicated data runs at the top privilege, so whoever sends it can take over. Fixed in 2.4.8.
2026.07.2956 views
News
Axis2 CVE-2026-66713 Rates 9.8 But Only Hits a Default-Off Feature
InfrastructureSecurityDevelopment
Apache Axis2 flaw CVE-2026-66713 shows 9.8 on NVD, but it only applies if you enabled a feature that ships disabled. How to check, and which release fixes it.
2026.07.2970 views
News
Terraform MCP Server: Others Can Act With Your Token (CVE-2026-16498)
AIInfrastructureSecurity
HashiCorp's official Terraform MCP server had three flaws letting one user act with another's credentials. CVE-2026-16498 scores 10.0. Fixed in 1.1.0.
2026.07.2959 views
News
WebSphere: 14 Flaws, Server Takeover Without a Login (CVE-2026-14512)
SecurityInfrastructure
IBM disclosed 14 WebSphere Application Server flaws on July 28, 2026. The worst lets attackers take over the server with no login. Fix Packs slip to September.
2026.07.2968 views
News
ManageEngine ADAudit Plus Unauthenticated RCE: CVE-2026-6516, CVSS 10
SecurityInfrastructure
ManageEngine ADAudit Plus has a CVSS 10.0 flaw: no login needed to run code on the server watching every AD account change. Builds below 8606 affected.
2026.07.2995 views
News
RabbitMQ can be taken down with no login, and no fixed release yet (CVE-2026-59248)
SecurityInfrastructure
An unauthenticated attacker can exhaust memory and take RabbitMQ down via its management ports. Every released version including 4.3.4 is affected, and no fixed RabbitMQ release exists yet.
2026.07.2845 views
News
Apache Thrift Hit by 5 Vulnerabilities: Traffic Eavesdropping and Service Outage Risks (CVE-2026-48144, CVSS 9.1)—Update to 0.24.0
SecurityDevelopmentInfrastructure
Apache Thrift, the communication framework behind many systems, has five vulnerabilities that could let attackers eavesdrop on or tamper with encrypted traffic and take services down. The worst, CVE-2026-48144, scores 9.1 of 10. Impact varies by language binding; the fix is updating to 0.24.0.
2026.07.2770 views
News
Red Hat OpenShift AI: in-cluster pods can impersonate any user (CVE-2026-16745)
SecurityInfrastructureAI
A flaw in Red Hat OpenShift AI (CVE-2026-16745, CVSS 8.8) lets an in-cluster attacker impersonate any user, including admins. Versions 2.25/3.3/3.4 affected; fixed in 3.5.
2026.07.2342 views
News
Check Point management console can be hijacked with no login (CVE-2026-16232) — exploited in the wild, patch now
InfrastructureSecurity
Check Point's management software (SmartConsole / the management server), used worldwide for corporate firewalls, has a flaw (CVE-2026-16232) that lets an attacker impersonate a top administrator without logging in. It is already used in real attacks and is on the U.S. CISA KEV list. If exploited, defense rules can be rewritten. Here are the affected versions and what to do now.
2026.07.2391 views
News
DNS software "BIND" hit by nine flaws that can block sites or crash the server (CVE-2026-13321 and more) — update to 9.20.26 / 9.21.24
SecurityInfrastructure
In July 2026, nine vulnerabilities were disclosed for BIND, the standard software behind the internet's address directory. Attackers can make it trust forged answers to block access to targeted sites, or crash the server outright; DNS at many companies and ISPs is affected. There are no reports of exploitation yet, and updating to 9.20.26 / 9.21.24 prevents it. Here is how to check whether you are affected and what to do.
2026.07.2395 views
