Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including CVE-2026-83542, a CVSS 9.8 unauthenticated remote code execution flaw in the ERP platform.
Check Point Research says a patched ChatGPT HTML preview flaw escaped the sandbox and bypassed Lockdown Mode, enabling silent chat
Forever Security’s Gal Weizman says a Claude Dispatch flaw lets a browser extension send commands to Claude Desktop and run
Sonatype’s Nexus Repository 3.98.0 fixes seven flaws, led by CVE-2026-113373, a CVSS 9.1 SAML and OAuth2 bypass that lets locked
Zoho fixed 11 ManageEngine flaws, including CVE-2026-13594, a CVSS 9.1 access-control bug in Log360 and EventLog Analyzer, with no known
Debian and Ubuntu patched CVE-2026-109518, a critical APT flaw that lets a network attacker swap a verified package for malicious
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and
Apache disclosed 35 vulnerabilities across nine projects, 20 rated high, including ZooKeeper, OpenOffice and ActiveMQ. No exploitation has been confirmed.
CISA lists WordPress race-condition RCE CVE-2026-119977 as actively exploited, and Wordfence reports 12,632 blocked attack attempts in the last 24
Rails 8.0.5.2 and 8.1.4.1 fix 21 vulnerabilities, including a CVSS 9.8 Active Storage flaw that lets unauthenticated attackers write files
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.