All news with #vulnerability disclosure tag

🔒 Multiple critical vulnerabilities have been disclosed in popular WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. Reports from Wordfence and Patchstack describe issues ranging from authentication bypass and privilege escalation to arbitrary file writes and remote code execution. Affected versions span multiple releases and require immediate patching or mitigation to prevent complete site takeover.

🛡️ GiveWP, a WordPress donation plugin with over 100,000 installs, contained a critical vulnerability (CVE-2026-82222) that allowed attackers to execute arbitrary server commands. Patchstack researchers reported the issue on July 28, showing exploitation required chaining unsafe unserialization, attacker-controlled serialized donations, and a bundled gadget chain. The vendor released a patch in version 4.16.7.2 on August 27 that blocks serialized payloads and cleans affected databases.

🔒 Shadowserver reports over 8,300 Internet-exposed Gitea instances remain unpatched against a critical code injection flaw (CVE-2026-60004) exploited in active remote code execution attacks. The vulnerability, disclosed by a Salesforce researcher, lets authenticated users execute shell commands via the diffpatch API, and default open registration enables easy exploitation. Gitea issued version 1.27.1 on July 27 to fix the issue and urged immediate upgrades, while CISA added the flaw to its actively exploited catalog and ordered federal agencies to patch swiftly.

🔒 Security researcher Olivier Laflamme disclosed two independent root remote code execution (RCE) chains impacting the Unitree G1 EDU, tracked as CVE-2026-76639 and CVE-2026-76640. One path is network-adjacent via chat_go and bashrunner, the other begins from an unauthenticated BLE bootstrap write leading to Wi‑Fi provisioning and a buffer overflow. Unitree's cloud account-to-robot ownership check was reportedly patched in July 2026, but no fixed firmware release has been publicly confirmed for the G1 EDU.

🔒 ServiceNow released patches on August 27, 2026, for four vulnerabilities affecting the ServiceNow AI Platform, three rated CVSS 10.0 and exploitable by unauthenticated attackers in certain conditions. The company deployed updates to hosted instances and provided fixes to partners and self‑hosted customers, who must apply them manually. ServiceNow stated it has no current evidence of exploitation and continues to support customers applying the patches.

🛡️ Researchers disclosed a vulnerability in Amazon Kiro IDE (version 0.7.45 on Windows) that enables data exfiltration via prompt injection and manipulated Kiro Powers. Mindguard reported that attacker-controlled repository content and steering files can influence the agent to read and transmit sensitive local data when a malicious workspace file is opened and any message is sent to the agent. Amazon issued a remediation in Kiro IDE 0.8.140; the latest release is 1.0.337.

🔒 The US Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 26, urging prompt patching by government agencies and critical infrastructure. Two high-severity flaws—CVE-2026-8452 in Citrix NetScaler and CVE-2019-1068 in Microsoft SQL Server—carry CVSS scores of 8.8 and require immediate attention. Citrix has published updates to address the NetScaler memory overflow, while the SQL Server RCE remains actively exploited despite a seven-year-old patch. CISA set accelerated patch deadlines for the critical and other listed flaws.

🛡️ Academic researchers disclosed GPUThor, a Rowhammer attack that induces widespread bit flips on NVIDIA Ampere-class workstation GPUs with GDDR6, defeating recommended ECC mitigations and enabling denial-of-service and host privilege escalation. The University of Toronto team hammered DRAM banks for extended periods on multiple RTX A-series cards, producing up to 377,552 flips per gigabyte on an A5000. The exploit requires running an unprivileged CUDA kernel and the researchers advise avoiding cross-tenant GPU sharing, monitoring ECC counters, and restricting untrusted CUDA workloads.

🔒 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity issue in Citrix NetScaler ADC and NetScaler Gateway with evidence of active exploitation. The list includes flaws affecting Microsoft SQL Server, the Linux Kernel, Red Hat components, Ajax.NET Professional, and Citrix, with CISA issuing remediation deadlines for federal agencies. Security firms reported web shells and discovery activity tied to attempts exploiting the Citrix flaw, and telemetry has identified multiple attacker IPs worldwide. CISA also published a vulnerability review highlighting injection and memory-safety weaknesses as frequent root causes of exploitation.

🛡️A chain of six vulnerabilities in the Avada WordPress theme and Fusion Builder plugin allows an unauthenticated attacker to execute arbitrary PHP code via a zero-click exploit. Tracked as CVE-2026-18431 with a 9.8 score, the attack requires a precise sequence of authorization, input-validation, trust-boundary, and file-handling failures. ThemeFusion released patches in Avada 7.16.1 and Fusion Builder 3.16.1 after disclosure by Wordfence, which withheld full details to allow administrators time to update.

🛡️ Defused warns attackers are chaining two Microsoft SharePoint flaws — CVE-2026-55040 and CVE-2026-63520 — to achieve remote code execution on unpatched servers. Public proof-of-concept exploits were published in August and were quickly weaponized, with probes observed against honeypots and large-scale internet-exposed SharePoint instances. CISA has issued directives to secure SharePoint servers while Microsoft monitors exploitation activity.

🛡️ CERT/CC disclosed two unpatched vulnerabilities in Kaltura's mwEmbed/html5lib player that allow unauthenticated remote file reads and remote code execution via unsafe PHP deserialization. The flaws (CVE-2026-19913 & CVE-2026-19912) stem from mwEmbedLoader.php accepting an attacker-controlled ServiceUrl and using PHP's unserialize() without validation. No patch is available and CERT/CC was unable to reach Kaltura; administrators are advised to restrict endpoint access, allow-list ServiceUrl, and take mitigation steps including rotating credentials in local.ini.

🛡️ Marimo fixed a high-severity code injection that let a crafted notebook supply a malicious Model Context Protocol (MCP) command executed as a local subprocess when opened in edit mode. Tracked as CVE-2026-75149 and scored ~8.7–8.8, the flaw affected versions prior to 0.23.15 and required user interaction but no attacker authentication. Marimo released version 0.23.15 and later versions to remediate the issue.

🔒 An unpatched authentication flaw in Calix GS7 XGS (GS5239XG) residential gateways running EXOS/6.6.47 lets remote unauthenticated attackers create and manipulate port-forwarding rules via the MiniUPnPd control endpoint on TCP port 5000. Researcher Brian Khan Quintana reported the issue as CVE-2026-75501 after failed vendor notification and worked with CERT/CC for disclosure. Exploitation can permanently open firewall rules that expose internal cameras, NAS, IoT devices, and admin interfaces; users are advised to disable UPnP or contact their ISP if the setting is locked.

🔒 A critical vulnerability in Elementor Pro allows attackers to upload executable files leading to remote code execution on affected WordPress sites. Identified as CVE-2026-32475, the bug stems from inconsistent handling of empty filename entries between the validation and processing loops in the File Upload module. Exploitation requires a published Elementor form with a File Upload field and multiple file upload enabled; administrators should update immediately and inspect uploads directories for rogue PHP files.

🔒 Two vulnerabilities in JFrog Artifactory let anonymous or low-privileged users manipulate package metadata without altering artifacts, creating a potential software supply chain risk. Oligo Security reported the flaws to JFrog on June 25 and published research on August 20 detailing CVE-2026-69106 (score 8.8) and CVE-2026-65922 (score 5.4). The issues concern unverified X-Orig-Client-Uri header handling and writes into trusted .jfrog/ metadata paths. JFrog has issued fixes; operators are advised to upgrade, restrict anonymous access, and strip or overwrite hazardous headers at the routing boundary.

🛡️ Researchers disclosed a critical vulnerability in isolated-vm, an open-source Node.js sandbox library, that permits guest code to corrupt host memory and potentially escape the sandbox. The flaw (GHSA-864f-rcv7-6rh4) affects versions up to 7.0.0 and was patched in 6.2.0 and 7.0.1. It stems from a type confusion in the ExternalCopy handling of the transferList option, enabling memory corruption, crashes, and possible host control-flow hijack. Maintainers urge users to upgrade to the patched releases immediately.

🛡️ A critical Zimbra Collaboration flaw (CVE-2026-73570, CVSS 8.9) allowing command injection and remote code execution is being actively exploited, CERT Polska warns. The issue affects ZCS versions prior to 10.1.20 when the optional zimbra-snmp package and SNMP notifications are enabled; it was patched in 10.1.20. Administrators are urged to inspect /var/log/zimbra.log for suspicious restarts and check recent files in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.

🛡️ Cybersecurity researchers disclosed a critical vulnerability in the Elementor Pro WordPress plugin that permits unrestricted upload of dangerous file types, tracked as CVE-2026-32475 with a CVSS score of 9.0. The issue stems from the Forms module's File Upload field where extension checks and file-move operations run in separate loops, enabling unauthenticated attackers to bypass the extension blocklist by submitting duplicate file parts and write PHP files into wp-content/uploads/elementor/forms. The flaw affects versions up to 4.2.1 and was patched in 4.2.2 on August 19 after disclosure.

🔒 GitLab patched a critical code-injection vulnerability in its GraphQL directive that could let unauthenticated attackers modify or delete repositories with a single HTTP request. The update also fixes a high-risk CSRF flaw in the GraphQL multiplex handler. GitLab released multiple patched CE and EE versions and advises administrators to restrict access to /api/graphql and make repos private until updates are applied.