Drupal warns attackers are exploiting CVE-2026-118539, a missing-authorization flaw in Commerce Core that allows an access bypass on affected online
Wordfence logged more than 18,500 malicious requests in 21 hours against a WordPress Core upgrade flaw. WordPress 7.1.4 randomizes the
Attackers compromised DebugBear’s monitoring script to serve crypto-draining code on Polymarket, with about $2.5 million traced as stolen from trader
A CVSS 8.8 integer overflow in TeamViewer’s viewer lets a malicious remote host crash or run code on a support
Progress fixed 15 WS_FTP Server vulnerabilities, led by CVE-2026-84295, a CVSS 10.0 authentication flaw that exposes administrative credentials to attackers.
ServiceNow fixed CVE-2026-103093, a critical Rhino sandbox bypass that lets an authenticated admin run code on the host OS, plus
Forever Security’s EMBRACE research found embedded-browser flaws in Cursor, Copilot, Codex, VS Code and Claude Desktop; Codex and VS Code
Google’s Chrome 156 update fixes 21 vulnerabilities, including critical MediaStream memory corruption bug CVE-2026-76024, with no exploitation reported.
Proofpoint observed attackers exploiting Kerio Connect webmail flaw CVE-2026-112353 with crafted SVG attachments to steal user credentials and mailbox contents.
SignalWire disclosed three critical FreeSWITCH flaws and says exploitation of the SIP MESSAGE command execution bug CVE-2026-116779 has been seen
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.