News
Better Auth and 4 more: 11 CVEs, all already fixed (CVE-2025-71399)
SecurityDevelopment
Five projects got 11 CVE numbers on August 2, but none is a new flaw — every fix shipped between November 2025 and July 2026. Only FreeRDP needs action.
2026.08.0239 views
News
27 WordPress flaws at once, six with no patch: CVE-2026-16261
SecurityDevelopment
27 WordPress plugin and theme flaws landed on Aug 2, 2026. Six have no fix, and all six were pulled from the official directory, so no update notice appears.
2026.08.0265 views
News
Forged Apple login takes over WordPress admin: CVE-2026-8457 +2 flaws
SecurityDevelopment
Three WordPress plugin flaws went public on Aug 1, 2026. A forged 'Sign in with Apple' token can make anyone an administrator; two others let visitors read server files.
2026.08.0243 views
News
FreeRDP 3.29.0 is not enough: update to 3.30.0 (CVE-2026-68579)
DevelopmentLinuxSecurity
FreeRDP, the open-source engine behind Remmina and most Linux remote-desktop apps, has fixed 22 security flaws, including two critical bugs that let a malicious or intercepting server bypass encryption and spy on or hijack your session. Update to version 3.29.0. CVE-2026-66402 and more.
2026.08.0148 views
News
AI Engine WordPress Plugin Vulnerabilities: 3.6.6 Is Not Enough, Update to 3.7.1
DevelopmentAISecurity
AI Engine WordPress plugin vulnerability roundup: CVE-2026-15988 and CVE-2026-65545. 3.6.6 is not enough, as 65545 affects 3.6.8 and below. Update to 3.7.1.
2026.08.0142 views
News
Critical pgAdmin Flaw CVE-2026-17566 Lets Users Take Over the Server: Update to v9.17
DevelopmentSecurity
pgAdmin, the standard tool for managing PostgreSQL databases, has seven vulnerabilities, led by a severity-9.9 flaw that lets a logged-in user take over the server with ordinary permissions. Exploitation could run arbitrary commands on the database server. No attacks confirmed yet; here is who is affected and how to update to v9.17.
2026.08.0148 views
News
No-login order tampering: nine WordPress flaws (CVE-2026-13692)
SecurityDevelopment
Nine WordPress flaws, July 29 2026: PayU CommercePro lets an unauthenticated attacker cut order totals to zero, three have no fix, and none carry an NVD score.
2026.07.2940 views
News
libssh2: ten 2026 flaws, no release since 2024 (CVE-2026-66032)
SecurityDevelopment
Ten libssh2 flaws in 2026, and no upstream release since 2024. The client that connects out is what breaks. CVE-2026-66032 and three more remain unpatched.
2026.07.2948 views
News
ActiveMQ Shut Down Without Login: CVE-2026-59878, Fix in 5.19.9/6.2.8
DevelopmentSecurity
Apache ActiveMQ got two fixes on July 27, 2026: one lets anyone without a login stall the broker, the other lets a low-privilege user write past its limits.
2026.07.2958 views
News
PostgreSQL Extension pglogical: CVE-2026-50736 Superuser Escalation
InfrastructureSecurityDevelopment
Four flaws hit pglogical, a PostgreSQL add-on. The side receiving replicated data runs at the top privilege, so whoever sends it can take over. Fixed in 2.4.8.
2026.07.2956 views
News
Dompdf: 6 Flaws Including CVE-2026-59941, PHP PDF Apps Need 3.1.6
SecurityDevelopment
Dompdf, the PHP library behind countless invoice and report PDFs, disclosed six flaws. A 58-byte image can exhaust server memory. The fix is 3.1.6.
2026.07.2939 views
News
Axis2 CVE-2026-66713 Rates 9.8 But Only Hits a Default-Off Feature
InfrastructureDevelopmentSecurity
Apache Axis2 flaw CVE-2026-66713 shows 9.8 on NVD, but it only applies if you enabled a feature that ships disabled. How to check, and which release fixes it.
2026.07.2970 views
