News
Bouncy Castle 1.85 fixes 32 CVEs, and no scanner will flag them
SecurityDevelopment
A timing flaw in Bouncy Castle's post-quantum ML-KEM code can leak a private key. It was already fixed in 1.78 (April 2024); only versions 1.73 to 1.77 are exposed.
2026.07.2896 views
News
Eighteen WordPress plugin flaws, two with no fix at all (CVE-2026-15014)
DevelopmentSecurity
Eighteen WordPress plugin flaws, July 28 2026 — eleven need no login and two have no fix at all. Bookly's published affected range is wrong: 27.7 is still exploitable.
2026.07.2856 views
News
vBulletin Forum Software Hit by Critical Flaw CVE-2026-61511: Unauthenticated Server Takeover
SecurityDevelopment
vBulletin, the forum software used by community sites worldwide, has a flaw (CVE-2026-61511, severity 9.8) that lets anyone take over the server without logging in. A working exploit was published on July 27, 2026, though no in-the-wild attacks have been confirmed. Versions up to 5.7.5 and 6.2.1 are affected; the fix is to update to 6.2.2 immediately.
2026.07.281057 views
News
Apache Thrift Hit by 5 Vulnerabilities: Traffic Eavesdropping and Service Outage Risks (CVE-2026-48144, CVSS 9.1)—Update to 0.24.0
InfrastructureSecurityDevelopment
Apache Thrift, the communication framework behind many systems, has five vulnerabilities that could let attackers eavesdrop on or tamper with encrypted traffic and take services down. The worst, CVE-2026-48144, scores 9.1 of 10. Impact varies by language binding; the fix is updating to 0.24.0.
2026.07.2770 views
News
Four WordPress plugins hit by critical site-takeover flaws (July 23)
DevelopmentSecurity
Four WordPress plugins have site-takeover flaws; three are a critical 9.8 needing no login (GoDAM, a helpdesk plugin, an AI MCP connector, MDJM). Update now.
2026.07.2339 views
News
Fastjson RCE (CVE-2026-16723) puts Spring Boot apps at risk — act now
DevelopmentSecurity
Crafted data can hijack servers running old Fastjson 1.2.68-1.2.83 (CVE-2026-16723, CVSS 9.0). Only some Spring Boot apps are affected, and there is no 1.x fix.
2026.07.23124 views
News
Free Backup Tool 'Duplicati' Has an Admin-Takeover Flaw (CVE-2026-16157) — Only a Risk for Non-Default Install Folders
DevelopmentSecurity
The Windows edition of Duplicati, a widely used free backup tool, has a flaw that could let someone seize the PC's most powerful (administrator) account. But it is only dangerous if you installed it in a non-default folder; a standard install is barely affected. Exploitation requires the ability to operate the machine, and the fix is to reinstall to the default folder or tighten the permissions.
2026.07.2341 views
News
Grav: 2.0.13 Is No Longer Enough Either — Update to Core 2.0.15
SecurityDevelopment
In July 2026, a batch of vulnerabilities that could let attackers take over a website was disclosed for Grav, the software used to build homepages and blogs. If exploited, an attacker could impersonate an administrator and deface the site. Older versions are affected; updating to the latest release prevents it. Here is how to check if your site is affected and what to do.
2026.07.2241 views
News
Plane Bug CVE-2026-46558 Lets Any Logged-In User Read and Delete Other Teams' Files — Update to v1.3.1
SecurityDevelopment
A flaw in the open-source project management tool Plane (CVE-2026-46558) lets any logged-in user read, overwrite, and delete files belonging to other teams. Companies self-hosting Plane must update to the fixed v1.3.1. A separate flaw leaking member emails even before login was patched at the same time.
2026.07.2254 views
News
Ninja Forms: seven flaws, one lets buyers pay zero. Update to 3.15.0
DevelopmentSecurity
Ninja Forms, a WordPress form-builder used on 600,000+ sites, has two flaws rated 9.3. CVE-2026-65048 can take over an administrator from a form submission with no login; CVE-2026-65049 can bulk-delete all form data on multisite. Fix 3.14.9 (latest 3.14.10) is out — here's how to update and confirm you're safe.
2026.07.2256 views
News
Perfect-10 unauthenticated takeover in PrestaShop's search module: CVE-2026-54159 — update ps_facetedsearch to 4.0.4
SecurityDevelopment
PrestaShop, the popular free software for building online stores, has a maximum-severity (10.0) flaw in its standard filtered-search feature. Tracked as CVE-2026-54159, a single crafted URL can take over the shop and server with no login. The affected module is Faceted Search 3.0.0-4.0.3; update to 4.0.4.
2026.07.1851 views
News
WordPress core flaws CVE-2026-60137 / CVE-2026-63030: update now
SecurityDevelopment
WordPress, used by about 40% of all websites, has two database-tampering flaws (SQL injection) in its core. Tracked as CVE-2026-60137 and CVE-2026-63030, when chained they can let attackers take over a site with no login. Fixes 6.8.6, 6.9.5, and 7.0.2 shipped and auto-updates were force-pushed. Here's how to confirm your site is already fixed.
2026.07.18173 views
