Apache Kafka fixed 12 vulnerabilities, including CVE-2026-110985, a JWT validation bypass that lets unauthenticated attackers forge tokens for any user.
Defused saw exploratory attacks on its decoys against CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite patched
BerriAI fixed a CVSS 10.0 LiteLLM proxy flaw that lets unauthenticated attackers read local files and steal the master key
A Brazilian Magecart gang altered Convertr’s Plausible analytics script on checkout pages to steal card data and CPF taxpayer IDs
Adobe fixed nine critical vulnerabilities in Campaign Classic and Connect, led by CVE-2026-105781, a CVSS 10.0 SQL injection, in two
NVIDIA fixed CVE-2026-65145, a CVSS 10.0 missing-authentication flaw in the NeMo Agent Toolkit, plus five other bugs in NeMo, TensorRT-LLM
Google’s Chrome 156.0.8078.73 update fixes 52 flaws, four critical, including CVE-2026-118306, a FileSystem bug that allows code execution outside the
CISA added PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to its KEV catalog after honeypots logged 35 working shells, with a DPRK-linked
Microsoft shipped out-of-band .NET fixes and Palo Alto confirmed PAN-OS exposure to Brotli flaw CVE-2026-111497, as Wiz finds 91% of
HashiCorp fixed CVE-2026-110720, a CVSS 9.9 authorization flaw in consul-k8s that lets low-privileged users gain elevated Consul privileges across namespaces.
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.