News
WordPress 'Kirki' flaw CVE-2026-8206 now exploited to hijack admins on 500k sites
Global CompaniesDevelopmentSecurity
Attacks are now hitting CVE-2026-8206 in Kirki, a WordPress plugin on 500,000+ sites. Wordfence blocked 222+ attempts in 24 hours. Unauthenticated attackers can hijack admin accounts — update to 6.0.7 now.
2026.06.0248 views
News
Flaw in two TP-Link Wi-Fi routers risks full takeover: CVE-2026-5509
InfrastructureGlobal CompaniesSecurity
TP-Link's Archer BE450 and BE7200 Wi-Fi routers have a flaw (CVE-2026-5509): an admin-logged-in attacker can take over the router. Update the firmware now.
2026.06.0275 views
News
New Langroid server-takeover flaw CVE-2026-54769 (CVSS 10.0): AI-written code gives unauth RCE — update to 0.65.2
AISecurityDevelopment
Langroid's SQLChatAgent runs AI-generated SQL unchecked (CVE-2026-25879, CVSS 9.8): prompt injection can reach DB-host RCE. Update to v0.63.0; least privilege.
2026.06.0268 views
News
Cloud Foundry UAA leaks its private key: CVE-2026-40965 (CVSS 10.0)
SecurityGlobal CompaniesInfrastructure
Cloud Foundry UAA exposes its EC private key via a public page (CVE-2026-40965, CVSS 10.0): token forgery risk. Only EC configs affected. Patch and rotate keys.
2026.06.0268 views
News
Oracle WebLogic vulnerabilities: exploited flaw and latest patch status
InfrastructureSecurityGlobal Companies
CISA added Oracle WebLogic CVE-2024-21182 to its KEV catalog as exploited in the wild. Data can be read without login; the fix shipped July 2024. What to check now.
2026.06.02109 views
News
Four WordPress plugins hit with critical takeover flaws: CVE-2026-48866 and 3 more
Global CompaniesSecurityDevelopment
Four popular WordPress plugins were hit with critical flaws (up to CVSS 9.8): file deletion in Gravity Forms (CVE-2026-48866) and unauthenticated site takeover in Contest Gallery, wpForo and AIWU. Who's affected and what to update now.
2026.06.0264 views
News
CATIA design-data server hijacked without login: CVE-2026-7858 (and DELMIA XSS CVE-2026-9024)
SecurityInfrastructureGlobal Companies
Dassault disclosed CVE-2026-7858 (CVSS 9.8): an unauthenticated takeover of the CATIA design-data server Teamwork Cloud, plus a DELMIA XSS flaw. Who's affected and what to do.
2026.06.0171 views
News
Major Vulnerabilities in Products Japanese Enterprises Use (2026)
SecurityJapanese CompaniesInfrastructure
In H1 2026, serious vulnerabilities hit products Japanese firms rely on, from Fujitsu and NEC to Microsoft and Oracle. A cross-vendor hub for in-house IT teams.
2026.06.01138 views
News
CVE-2026-48188: OTRS Helpdesk Auth Bypass, No Login Needed (Fix 2026.4.X)
PrivacySecurity
CVE-2026-48188 (CVSS 9.1) lets attackers break into the OTRS helpdesk with no login via unauthenticated SQL injection, but only when MySQL/MariaDB runs in NO_BACKSLASH_ESCAPES mode. Fixed in OTRS 2026.4.X; the end-of-life Community Edition 6.0.x is most at risk.
2026.06.0183 views
News
Fujitsu ServerView Agents Privilege Escalation: Fixed in V11.70.06 and Later
SecurityJapanese CompaniesInfrastructure
ServerView Agents for Windows, the PRIMERGY management software from Fsas Technologies (Fujitsu), has two privilege-escalation flaws: CVE-2026-27788 (CWE-732) and CVE-2026-32325 (CWE-268), CVSS 8.5. Anyone who can log in seizes Windows SYSTEM privileges; V11.60.04 and earlier are affected. Update to the latest version.
2026.06.0187 views
News
Casdoor SSO Auth Bypass (CVE-2026-9090 to 9098): No Patch Yet, Here Is How to Lock It Down Now
SecurityPrivacy
If your organization self-hosts Casdoor as its SSO login server, you are affected: CERT/CC disclosed nine authentication-bypass flaws (CVE-2026-9090 to 9098, VU#780781) in v2.362.0 and earlier that let an attacker log in as any user or admin. There is still no patch as of June 22, 2026, so the fix is operational: restrict the IdPs Casdoor accepts to trusted ones and audit your accounts now.
2026.06.01111 views
News
OpenCATS candidate-data flaw fixed in v0.10.0 (CVE-2026-49489)
SecurityPrivacy
OpenCATS (<=0.9.7.4) has SQL injection flaw CVE-2026-49489 (CVSS 8.5): any logged-in user can dump the candidate database. A public exploit exists; no fix yet.
2026.05.3151 views
