Vulnerability-Management

Mattermost has released a security advisory addressing multiple vulnerabilities affecting versions up to 11.10.0 and earlier maintenance releases.

The Canadian Centre for Cyber Security has released an advisory regarding multiple unidentified vulnerabilities impacting a wide range of Red Hat enterprise software products.

The Canadian Centre for Cyber Security has released an advisory concerning multiple security vulnerabilities in various Adobe products, recommending that users and administrators apply available security updates.

CVE-2026-82121 is an Origin Validation Error vulnerability in Hitachi HiRDB.

Craft CMS has released security updates for multiple products to address vulnerabilities in the core CMS platform and the Commerce-mollie plugin.

Red Hat has released security advisories concerning multiple vulnerabilities impacting various versions of Red Hat Enterprise Linux and Streams for Apache Kafka components.

Fortinet has released security hardening updates for FortiAnalyzer, FortiAuthenticator, FortiMail, FortiManager, and FortiOS to address multiple vulnerabilities.

Atlassian has released security updates addressing multiple vulnerabilities across its Data Center and Server product portfolio, including Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira, and Jira Service Management.

Cisco released security hardening updates for the Snort 3 engine to address multiple internally discovered vulnerabilities, including out-of-bounds write issues categorized as CWE-787.

The netdisk-fast-download package through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt cloud-drive credentials via a hard-coded AES key.

Webreaper Damselfly versions 4.5.3 and earlier contain an authentication bypass vulnerability in API routes that allows unauthenticated attackers to escalate privileges and perform administrative actions.

CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog, including code injection, path traversal, and authentication flaws affecting Palo Alto Networks, Cisco, and Ahsay products.

Multiple high-severity vulnerabilities in HPE Networking AOS-Switch could allow unauthenticated attackers to achieve remote code execution, perform unauthorized actions, or cause denial of service.

Multiple high and critical severity vulnerabilities in Red Lion Controls N-Tron 700 series switches, including hard-coded credentials and improper authentication, allow for unauthorized administrative access, configuration theft, and denial-of-service.

End-of-life Hitachi Energy RTU500 CMU firmware versions 11.x and prior are susceptible to multiple critical vulnerabilities, including authentication bypass and path traversal, which could allow remote attackers to compromise device integrity or disrupt industrial control operations.

RainyGao DocSys versions up to 2.02.85 contain a remote SQL injection vulnerability in the Database Management component, allowing unauthenticated attackers to execute arbitrary SQL commands via the url argument.

SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the questions-view.php script, allowing remote attackers to execute unauthorized database queries.

Multiple vulnerabilities in PgBouncer allow a remote, unauthenticated attacker to trigger a Denial of Service condition, impacting the availability of the connection pooler.

Cisco has confirmed active, in-the-wild exploitation of a zero-day vulnerability, CVE-2026-76460, affecting its Identity Services Engine (ISE) product.

This brief describes a detection capability designed to identify cloud assets exhibiting poor security posture by correlating high volumes of vulnerabilities, exploitable findings, and critical-severity bugs reported by the Wiz Cloud Security Platform.

CISA has added CVE-2025-39964 and CVE-2026-53266, two actively exploited Linux kernel vulnerabilities, to its Known Exploited Vulnerabilities catalog.

Microsoft's September 2026 update cycle addresses 974 vulnerabilities, including two privilege-escalation zero-days actively exploited in the wild and 20 potentially wormable RCE flaws.

An SQL injection vulnerability in the email parameter of the patient_login.php file allows unauthenticated remote attackers to execute arbitrary SQL commands in Doctor Appointment System 1.0.

The IC3 has issued an advisory regarding the active exploitation of Siemens S7 Series PLCs within US critical infrastructure sectors using CVE-2026-4357 to disrupt operational technology.

SourceCodester Simple Online Food Ordering System 1.0 is vulnerable to unauthenticated SQL injection via the admin login endpoint, allowing remote attackers to execute arbitrary SQL commands.

Mattermost has released critical security patches for multiple versions to address vulnerabilities tracked under CVE-2026-9816.

Microsoft's August 2026 security release addresses 415 vulnerabilities, including a zero-day (CVE-2026-68820) exploited in the wild that enables local privilege escalation in the Windows Ancillary Function Driver for WinSock.

MingSoft MCMS versions up to 3.0.6 contain a remote SQL injection vulnerability in the ms-mdiy component, allowing unauthenticated attackers to manipulate the formFields argument to execute arbitrary database queries.

WebPros has issued a security advisory addressing HTTP request smuggling and database privilege escalation vulnerabilities in cPanel and WP Squared products.

A vulnerability in SolarWinds Web Help Desk, identified as CVE-2024-28986, allows remote unauthenticated attackers to bypass security measures, potentially leading to unauthorized access.