Articles

Apache CXF, the Java layer enterprises use for data exchange, has six new flaws. One lets a single message take over the server. Upgrade to 4.2.3/4.1.8/3.6.12.

2026.08.0617 views

Ten Flaws in Cisco IOS XE, Found by Cisco Itself — No Workarounds

SecurityInfrastructure

Cisco disclosed ten IOS XE vulnerabilities at once, the worst rated 9.8, none with a workaround. They did not surface through attacks — Cisco found them in its own internal review.

2026.08.0613 views

CISA Gives Three Days to Patch TeamCity Flaw CVE-2026-63077

CISA gave US agencies three days to patch a TeamCity flaw that lets anyone take over the build server with no login. Self-hosted only; fixed since July 27.

2026.08.0617 views

ana-ocs-family-link-service-outage-cover-en

Japanese CompaniesSecurity

ANA Group's overseas shopping service has been down 12 days, with no word on what leaked

OCS FAMILY LINK SERVICE, the ANA Group's online shop for Japanese residents overseas, has been offline since 23 July after a cyberattack. As of 5 August the site does not respond, and neither the affected data fields nor the number of people involved has been published. Customers who depended on it for Japanese food and household goods have been without it for twelve days.

2026.08.054 views

24 WordPress plugin flaws: two-factor authentication itself can be bypassed (CVE-2026-15372)

DevelopmentSecurity

Twenty-four WordPress plugin vulnerabilities were published on August 5, 2026, and four of them break two-factor authentication. WP 2FA never validated the second factor; miniOrange 2FA let an attacker re-point it. Four more expose password-protected content and three hand over the whole site. All 24 have fixed releases.

2026.08.0510 views

10 WordPress plugin flaws, 200,000-site PrettyLinks included — all already patched (CVE-2026-9273)

Ten WordPress plugin vulnerabilities were published on August 5, 2026. The heaviest, in Kadence Memberships, lets an unauthenticated attacker hijack an administrator's password reset. All ten already have released fixes, the oldest from May 20 — only sites that stopped updating are at risk. PrettyLinks on 200,000 sites is included.

2026.08.054 views

wordpress-plugins-2026-08-05-account-takeover-roundup-cover-en

Five WordPress Plugin Flaws, All Ending in Account Takeover (CVE-2026-9273)

DevelopmentSecurity

Five WordPress plugin vulnerabilities were published on August 5, 2026, and all five end in account takeover. Kadence Memberships lets an unauthenticated attacker hijack an administrator's password reset; Dokan lets anyone who can register as a vendor seize an administrator account. All five already have fixed releases, so updating ends it.

2026.08.055 views

Qualcomm patches 11 Snapdragon flaws: CVE-2026-25289 needs no login and no tap

MobileSecurity

Qualcomm published 11 vulnerabilities in Snapdragon and related chips on August 4. The heaviest sits in the Wi-Fi feature that discovers nearby devices, and works from within radio range with no login and no action by the user. No exploitation has been reported. Affected lists split by generation, and rollout timing is set by each handset maker.

2026.08.057 views

Japanese CompaniesSecurityInfrastructure

Two Flaws in Japan's NetKids iMark Network Monitor, and No Fixed Version Exists

Two vulnerabilities were disclosed in NetKids iMark, a Japanese-made network monitoring tool, on August 5, 2026. Anyone who can log in to the machine can seize SYSTEM privileges. Every build up to and including the current V5.2.5.0 is affected and no fix has shipped. Neither works over the internet, but a monitoring server holds the map of your network. Here are the two workarounds.

2026.08.058 views

Jetty auth bypass CVE-2026-10050: non-ASCII passwords collapse to ?