Trending Vulnerabilities

CVE-2026-58231 is a maximum-severity vulnerability in SAP Commerce Cloud’s Data Hub Adapter affecting COM_CLOUD 2211 and COM_CLOUD 2211-JDK21. The issue is described as an improper authorization and insufficient input validation flaw in which an unauthenticated attacker can abuse a default authentication client and send specially crafted input to certain exposed functions. Successful exploitation can result in arbitrary code execution within the affected service context and compromise internal application components. Public reporting also characterizes the flaw as remotely reachable over the network with low attack complexity and no user interaction.

CVE-2026-65400 is an improper authentication vulnerability in Apple macOS Screen Sharing affecting supported releases of macOS Tahoe, Sequoia, and Sonoma prior to macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Apple described the issue as an authentication flaw fixed through improved state management. Independent technical analysis associates the bug with the Screen Sharing daemon’s authentication state handling, including the Secure Remote Password authentication path, where malformed or out-of-sequence authentication data could leave the service in an incorrectly authenticated state. As a result, a network attacker could authenticate to Screen Sharing without valid credentials. Because the vulnerable Screen Sharing service runs with high privileges and can invoke privileged file-transfer helpers, successful exploitation may extend beyond simple session access to privileged filesystem operations on the target host.

CVE-2026-15826 is a critical authentication bypass vulnerability in the User Profile Builder plugin for WordPress affecting versions up to and including 3.16.4. The flaw is caused by incorrect type handling in the plugin's autologin flow. Specifically, the wppb_log_in_user() function applies absint() to the return value of wp_insert_user() before verifying whether that return value is a WP_Error via is_wp_error(). When registration is attempted with a username length that passes the plugin's frontend validation but is rejected by WordPress core, wp_insert_user() returns a WP_Error object. Because absint() coerces that object to the integer value 1, the subsequent error check does not halt execution. The plugin then proceeds as though a valid user with ID 1 had been created, generates an autologin nonce bound to that account, and allows authentication as that user. On typical WordPress installations, user ID 1 is the original administrator account, making the flaw an unauthenticated path to administrator access.

CVE-2026-8452 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Vendor guidance describes the issue as causing unpredictable or erroneous behavior and denial of service when the appliance is configured as a Gateway or AAA virtual server. Public technical analysis indicates the vulnerable code resides in the nsppe packet-processing engine during SAML processing, specifically XML signature canonicalization of the ds:SignedInfo element. In vulnerable builds, attacker-controlled data associated with the ec:InclusiveNamespaces PrefixList can be copied into a fixed-size buffer without adequate bounds checking, resulting in a heap-based buffer overflow. Independent research further indicates that, in SAML-enabled deployments acting as a Service Provider or Identity Provider, the overflow can corrupt adjacent heap metadata and be developed into an arbitrary write primitive, enabling pre-authentication remote code execution in the root-privileged nsppe process.

CVE-2026-55040 is a critical authentication bypass vulnerability in on-premises Microsoft SharePoint that stems from multiple weaknesses in the JWT token validation pipeline. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Research describing the issue attributes the vulnerable logic to SharePoint identity-model token handling code, including the SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes, where token validation permits an attacker-controlled nested JWT to be accepted as authentic. Reported weaknesses include acceptance of an outer token with unsigned semantics, resolution of a signing key from attacker-controlled token metadata, issuer acceptance for an untrusted certificate context, and a signature check that only requires a non-empty value rather than cryptographic verification. An unauthenticated remote attacker can exploit these conditions to forge a JWT that impersonates a chosen SharePoint user, including a site administrator, and then perform authenticated operations on the target SharePoint environment.

CVE-2026-73683 is an authentication bypass vulnerability in the Facebook provider of Laravel Socialite affecting versions earlier than 5.29.0. The flaw is caused by missing validation of the OpenID Connect nonce claim in the getUserByOIDCToken() function within FacebookProvider.php. Because the implementation validates token signature, audience, and issuer but does not perform a session-bound nonce comparison, a previously captured valid and unexpired OIDC id_token issued for the same Facebook App ID can be replayed to the backend userFromToken() flow. This enables an unauthenticated attacker to impersonate the token’s subject and bypass intended authentication controls.

CVE-2026-72898 is a critical unauthenticated SQL injection vulnerability in Metabase affecting the password reset flow exposed through the session reset-password API. A remote attacker can send crafted HTTP requests to the password reset endpoint and inject arbitrary SQL into Metabase’s internal application database before authentication is completed. Reported technical details indicate the flaw stems from the reset flow accepting undeclared request-body fields and allowing attacker-controlled structured input to reach the query-building layer as a database condition rather than a validated scalar identifier. Successful exploitation can bypass normal security controls and result in takeover of a Metabase administrator context. Affected self-hosted releases include Metabase branches 58 through 63 prior to the fixed versions 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5.

CVE-2026-18500 is an authentication and authorization flaw in the @fastify/jwt JSON Web Token plugin for Fastify affecting versions prior to 10.2.2. When an application calls request.jwtVerify({ key }) to enforce verification with a route-specific or domain-specific key, the explicitly supplied per-request verification key can be silently overridden by the plugin’s globally configured secret because the option-merging logic applies the global key last. As a result, routes intended to validate tokens against a distinct verification key may instead accept tokens signed with the global secret. This breaks key separation between authorization domains, such as user and admin token realms, and can allow a token valid for one trust domain to be accepted in another.

CVE-2026-16142 is an account takeover vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress affecting all versions up to and including 1.2.6. The flaw is caused by the add_front_user_update() AJAX handler being exposed to unauthenticated users while accepting an arbitrary user identifier parameter. That identifier is passed directly to WordPress user-update functionality without validating that the requester is authenticated or authorized to modify the targeted account. As a result, an unauthenticated attacker can update the email address associated with any WordPress user account, including administrator accounts. After changing the victim account’s email address to one controlled by the attacker, the attacker can invoke the standard WordPress password reset workflow and receive the reset link, enabling full takeover of the targeted account.

CVE-2026-15965 is an arbitrary file upload vulnerability in the MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress affecting all versions up to and including 1.4.0. The flaw is located in the plugin's handle_upload function and is caused by a filename-validation mismatch during chunked upload processing. Extension and MIME-type validation are performed on the uploaded chunk filename, but those checks are not consistently enforced on the final reassembled filename derived from the resumableFilename parameter. As a result, an unauthenticated attacker can cause the plugin to assemble and store a file with a dangerous or executable type despite the intended validation logic. In environments where uploaded files can be executed by the server, this can lead to remote code execution.

CVE-2026-14279 is a privilege-escalation vulnerability in the CedCommerce Wholesale Market plugin for WordPress affecting versions up to and including 2.2.2. The flaw is present in the AJAX action handler ced_wholesale_request_send_callback(), which processes the ced_wholesale_request_send action. The handler validates only a nonce and that the requester has a positive user ID, then passes a client-controlled role_required POST parameter directly to WP_User::add_role() without restricting the requested role to an approved allowlist of wholesale-specific roles. Because the nonce is exposed to authenticated users on the frontend, an authenticated attacker can supply an arbitrary role value and cause the application to assign elevated privileges. When the plugin option for directly assigning the requested role is enabled, this logic flaw allows low-privileged users to obtain administrative privileges.

CVE-2026-15341 is a critical authentication bypass vulnerability in the User Session Synchronizer plugin for WordPress affecting all versions through 1.4.0. The flaw resides in the `synchronize_session()` function, which is hooked to `init` and therefore processes attacker-controlled input on every request. The function accepts `ussync-key`, `ussync-token`, and `ussync-ref` parameters without enforcing nonce validation, capability checks, or shared-secret verification. When the supplied synchronization slot does not exist, option lookups return false values that cause the plugin to fall back to predictable cryptographic material, including an AES-256-CBC key derived from an empty value and a fixed initialization vector. In the same code path, the referer allowlist check degrades in a way that no longer provides meaningful protection. An unauthenticated attacker can therefore craft a valid-looking synchronization request containing a known or guessable user email address and trigger the plugin to invoke WordPress authentication logic for that account, resulting in unauthorized login as the targeted user.

CVE-2026-18549 is a resource management flaw in @fastify/multipart, a multipart form-data parser for Fastify. Affected versions are 5.3.0 through 10.1.0. When a multipart upload hits the busboy fileSize limit and the file part is truncated, the plugin clears its internal reference to the current file even though the underlying stream remains open. If the client then aborts the connection before the terminating multipart boundary is sent, the abort-handling cleanup path cannot find and destroy the still-open stream. As a result, saveRequestFiles() does not settle, the associated request handler remains hung, and the temporary file already created on disk is not removed. Repeated exploitation can accumulate orphaned temporary files and suspended request executions.

CVE-2026-19474 is a denial-of-service vulnerability in @fastify/multipart, the multipart form-data parser for Fastify. In versions 3.0.0 through 10.1.0, the request.saveRequestFiles() code path can fail to remove temporary files when a client disconnects while multipart parsing is advancing between parts. The rejection raised by the iterator in this inter-part state falls outside the normal per-file cleanup logic, allowing a previously completed temporary file to remain on disk. This results in persistent accumulation of orphaned temporary files and represents an incomplete-fix variant of CVE-2025-24033.

RoguePlanet is a local elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. The flaw affects the engine component identified as mpengine.dll and is described as arising from improper link resolution before file access, with reporting also attributing exploitation to a race condition in the engine’s file-handling logic. A local low-privilege user can abuse this behavior to influence privileged Defender operations and obtain execution in the NT AUTHORITY\SYSTEM security context. Public reporting further states that a later exploit chain dubbed ShieldBreak bypassed Microsoft’s initial July 2026 remediation for this issue.

CVE-2026-14484 is an arbitrary file deletion vulnerability in the WordPress plugin RapiSafe – Secure Multi File Upload for Contact Form 7 affecting all versions up to and including 1.0.4. The flaw is caused by insufficient file path validation in the handleAjaxRemoveUpload function, allowing attacker-controlled path input to reach file removal logic without adequate restriction to intended upload locations. The vulnerable removal handler is protected by a nonce, but that nonce is exposed in public-facing JavaScript on Contact Form 7 pages that render a RapiSafe upload field, making it obtainable by unauthenticated visitors. As a result, an unauthenticated attacker can invoke the handler and delete arbitrary files on the server. Deletion of security-critical application files can destabilize the site and may create conditions that lead to remote code execution.

CVE-2026-15303 is a critical authentication bypass vulnerability in the 6Storage Rentals plugin for WordPress affecting versions up to and including 2.27.0. The flaw is caused by the six_storage_create_wp_user() AJAX handler being exposed through the unauthenticated wp_ajax_nopriv_six_storage_create_wp_user action without nonce validation, capability checks, credential verification, or ownership validation. The vulnerable code resolves a WordPress account from an attacker-supplied email address and then invokes wp_set_current_user() and wp_set_auth_cookie() for that account. As a result, a remote unauthenticated attacker can establish an authenticated session as any existing WordPress user, including an administrator, by supplying that user’s email address.

CVE-2026-18855 is an arbitrary file deletion vulnerability in the Link Library plugin for WordPress affecting all versions up to and including 7.9.4. The flaw is caused by insufficient file path validation in the ll_delete_link_fields function. An attacker can submit a crafted link that causes the plugin to reference unintended filesystem locations, and when that link is later permanently deleted, the plugin may delete an arbitrary file on the server. The issue is exploitable by unauthenticated attackers, but only when the plugin's option to delete a local file upon link deletion is enabled. Successful exploitation can directly remove security-critical application files and may create conditions for subsequent remote code execution, such as by deleting configuration files required for normal application security and initialization.

CVE-2026-19598 is an authorization bypass vulnerability in the Pods – Custom Content Types and Fields plugin for WordPress affecting all versions through 3.3.9. The flaw is present in the pods_admin AJAX router, where multiple security controls—including the method allowlist, nonce validation, authentication enforcement, and capability checks—are routed through pods_error(). Under the JSON meta-box-loader compatibility path, pods_error() logs the failure and returns false instead of terminating request processing. As a result, failed security checks do not stop execution, allowing protected administrative actions to continue despite missing authorization. This condition can be abused by an unauthenticated attacker to escalate privileges, reset or overwrite passwords for arbitrary accounts, including administrator accounts, and invoke other administrator-level actions, resulting in full compromise of the affected WordPress site.

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), the kernel-mode driver underlying the Windows Sockets API. The flaw allows an authorized local attacker to trigger a race-condition-dependent memory corruption condition and elevate privileges on an affected Windows system. Public reporting indicates exploitation can result in SYSTEM-level code execution, making the issue a post-compromise local privilege escalation vulnerability rather than an initial access vector. Microsoft disclosed and patched the vulnerability in its August 2026 security updates, and multiple reports indicate it was exploited in the wild prior to patch availability.

CVE-2026-71362 is a critical incorrect authorization vulnerability in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw stems from improper handling of customer identity within account sessions, allowing a remote attacker to switch a customer session to another customer account. As a result, an unauthenticated attacker can access resources associated with a different customer context and effectively escalate privileges without requiring administrator access or user interaction. Public reporting indicates the issue was observed being targeted shortly after disclosure. Affected releases include supported product versions up to the July 2026 patch level, and Adobe corrected the issue in the August 2026 security updates and isolated patch set APSB26-92.

CVE-2026-18438 is a remote code execution vulnerability in the Templately – Elementor & Gutenberg Template Library plugin for WordPress affecting all versions up to and including 3.7.1. The flaw is in the fetch_remote_file function, which performs file type validation against an attacker-controlled filename supplied via the Content-Disposition header, while the actual file write destination is derived separately from the URL path. This validation-to-destination mismatch allows an authenticated attacker to supply a polyglot payload that is accepted as an image during validation but ultimately written to disk with a server-executable extension. The issue bypasses the intended unfiltered_upload capability restriction because the validation decision is made on the wrong filename. Exploitation is further enabled by overly permissive authorization on Templately REST API endpoints used for cloud import operations, where state-changing routes are gated only by current_user_can('delete_posts'). As a result, contributor-level users and above can reach the affected functionality and achieve server-side code execution.

ShieldBreak is an elevation of privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender. Publicly available information identifies the affected component and the vulnerability class, but technical details about the root cause, vulnerable code path, triggering conditions, and exploitation mechanism have not yet been disclosed. Microsoft has stated that a security update is in development.

CVE-2026-19900 is a hard-coded credentials vulnerability affecting LB-LINK X-PRO version 1.0.22-20231206. The issue is described as involving an unknown function associated with the /etc/shadow file, resulting in the presence or use of embedded credentials within the product. The vulnerability can be reached remotely and does not require prior authentication, although exploitation is assessed as high complexity. The weakness aligns with the use of hard-coded credentials, and available reporting also associates it with hard-coded passwords specifically.