Skip to content

Blog · page 5/7

CVE analysis, as it happens

Critical vulnerabilities and CISA KEV additions, explained: what is affected, which versions fix it, and what to check first.

  1. Fortinet in KEV: 2 FortiSandbox RCEs and a Bypass of the FortiOS Anti-Persistence Patch

    CVE-2026-39808 and CVE-2026-25089 (FortiSandbox, unauthenticated command injection) and CVE-2025-68686 (FortiOS, symlink persistence patch bypass). Three CVEs in CISA KEV.

    CVE-2026-39808 CVE-2026-25089 CVE-2025-68686 · 8 min

  2. Arista VeloCloud Orchestrator CVE-2026-16812: Exploited 10.0 RCE on SD-WAN

    VeloCloud Orchestrator on-prem (formerly VMware SD-WAN) exposes internal functionality remotely: OS command injection, CVSS 10.0, active exploitation confirmed by the vendor. Versions and mitigation.

    CVE-2026-16812 · 6 min

  3. Langflow CVE-2026-0770: Unauthenticated Root RCE in LLM Tooling (CVSS 9.8)

    Langflow exposes the exec_globals parameter of its validate endpoint: code execution as root without authentication. With CVE-2026-55255 (running other users' flows), two CVEs in CISA KEV.

    CVE-2026-0770 CVE-2026-55255 · 8 min

  4. SharePoint: 4 CVEs Added to CISA KEV in 3 Weeks — Unauthenticated RCE Chain

    Microsoft SharePoint racked up 4 CISA KEV entries in July 2026: two CVSS 9.8 deserializations, an authentication bypass and an authenticated RCE. Chain analysis, detection and patching.

    CVE-2026-50522 CVE-2026-58644 CVE-2026-56164 CVE-2026-45659 · 6 min

  5. WordPress Core CVE-2026-60137 + 63030: Chained SQLi to Unauthenticated RCE

    Two WordPress core CVEs (6.9.x < 6.9.5, 7.0.x < 7.0.2) chain into unauthenticated RCE on default installations: REST API batch route confusion + author__not_in SQL injection. In CISA KEV.

    CVE-2026-60137 CVE-2026-63030 · 8 min

  6. Joomla: 4 Extensions Added to KEV in 4 Days — Unauthenticated Upload to RCE

    iCagenda, Balbooa Forms, Joomlack Page Builder, JoomShaper SP Page Builder: four Joomla extensions in CISA KEV in early July 2026, all arbitrary file upload leading to RCE. Audit and mitigation.

    CVE-2026-48939 CVE-2026-56291 CVE-2026-56290 CVE-2026-48908 · 7 min

  7. SimpleHelp CVE-2026-48558: Unverified OIDC Signature, RMM Takeover (CVSS 10.0)

    SimpleHelp ≤ 5.5.15 accepts OIDC tokens without verifying their cryptographic signature. A forged token grants a full technician session, MFA bypassed. CVSS 10.0, in CISA KEV.

    CVE-2026-48558 · 6 min

  8. Ubiquiti UniFi OS: 3 CVEs Added to KEV the Same Day, Chaining to Full Takeover

    CVE-2026-34908, 34909 and 34910: broken access control, path traversal and command injection on UniFi OS. Three CVEs added to CISA KEV on the same day, exploitable as a chain.

    CVE-2026-34908 CVE-2026-34909 CVE-2026-34910 · 7 min

  9. WordPress May 2026: 4 Critical Plugins with Auth Bypass / RCE (CVSS 9.8)

    Burst Analytics, Career Section, InfusedWoo Pro, Form Notify — 4 WordPress plugins with auth bypass / RCE / privilege escalation disclosed in May 2026. Versions and mitigation.

    CVE-2026-8181 CVE-2026-6271 CVE-2026-6510 CVE-2026-5229 · 5 min

  10. SAP S/4HANA CVE-2026-34260: Authenticated SQL Injection in Enterprise Search ABAP

    SAP S/4HANA Enterprise Search ABAP: SQL injection (CVSS 9.6) via user input concatenated without validation. Sensitive data exfiltration risk, audit recommended.

    CVE-2026-34260 · 6 min

  11. Microsoft Patch Tuesday May 2026 — Wave 2: Hyper-V LPE, Entra ID Spoofing, Authenticator

    May 2026 Patch Tuesday follow-up: 3 new CRITICAL CVEs — Hyper-V use-after-free LPE (9.3), Entra ID spoofing (9.3), Microsoft Authenticator info disclosure (9.6). Patch now.

    CVE-2026-40402 CVE-2026-40379 CVE-2026-41615 · 6 min

  12. ArchiveBox CVE-2026-42601: RCE via /add/ — No Patch Available (CVSS 9.8)

    ArchiveBox ≤ 0.8.6rc0: the /add/ endpoint merges an unvalidated config JSON into plugin environment variables. Unauthenticated RCE, no official fix. Mitigation.

    CVE-2026-42601 · 5 min

  13. Angular Expressions CVE-2026-44643: Sandbox Escape → RCE (CVSS 10.0)

    angular-expressions < 1.5.2: an attacker can craft a filter expression that escapes the sandbox and executes arbitrary code. CVSS 10.0, scope changed. Patch and mitigation.

    CVE-2026-44643 · 5 min

  14. Adobe Connect: 2 Critical CVEs (Deserialization + Auth Bypass) — CVE-2026-34659 & 34660

    Adobe Connect ≤ 2025.9.15: deserialization of untrusted data (CVSS 9.6) + incorrect authorization (CVSS 9.3) → RCE and script injection. Patch and hardening.

    CVE-2026-34659 CVE-2026-34660 · 5 min

  15. PHP 8.x: 3 CRITICAL CVEs at once (PDO Firebird SQLi + 2 SOAP UAFs)

    PHP 8.2.31 / 8.3.31 / 8.4.21 / 8.5.6 fix 3 CRITICAL CVEs (CVSS 9.8): PDO Firebird NUL-byte SQL injection + 2 SOAP use-after-free flaws exploitable for RCE.

    CVE-2025-14179 CVE-2026-6722 CVE-2026-7261 · 6 min

  16. OpenClaw: 3 Critical Auth Bypass CVEs in the Browser Sandbox

    OpenClaw < 2026.4.15 stacks 3 CRITICAL CVEs (CVSS 9.6-9.8): exposed noVNC, Feishu webhook without validation, CDP relay on 0.0.0.0. Patch and hardening guide.

    CVE-2026-43575 CVE-2026-44109 CVE-2026-43581 · 6 min

  17. Microsoft Patch Tuesday May 2026: 4 CRITICAL CVEs (Netlogon, DNS, Dynamics, Azure)

    May 2026 Patch Tuesday — 4 CRITICAL CVEs: Windows Netlogon RCE (9.8), Windows DNS RCE (9.8), Dynamics 365 code injection (9.9), Azure Logic Apps EoP (9.9).

    CVE-2026-41089 CVE-2026-41096 CVE-2026-42898 CVE-2026-42823 · 6 min

  18. Gotenberg CVE-2026-40281: PDF API Takeover via ExifTool Injection (CVSS 10.0)

    Gotenberg ≤ 8.30.1: a newline in PDF metadata values injects ExifTool pseudo-tags — arbitrary file overwrite/symlinks in the container. CVSS 10.0, patch 8.31.0.

    CVE-2026-40281 · 5 min

  19. GitHub Enterprise Server CVE-2026-8034: SSRF via Notebook Viewer (URL Parser Confusion)

    GitHub Enterprise Server < 3.21 contains an SSRF (CVSS 9.8) in the notebook viewer — URL parser confusion between validation and HTTP request. Patch and mitigation.

    CVE-2026-8034 · 5 min

  20. Chrome CVE-2026-7910: Use-After-Free in Views (Site Isolation Bypass)

    Chrome < 148.0.7778.96 contains a use-after-free in Views (CVSS 9.6) allowing site isolation bypass from a compromised renderer. Urgent browser patch.

    CVE-2026-7910 · 5 min