Security Advisories
150 advisoriesCVE-2026-66665
2026-08-16
Critical Unauthenticated Arbitrary File Upload Vulnerability in Type Hub (CVE-2026-66665)
A critical unauthenticated arbitrary file upload vulnerability in Type Hub versions ≤2.0.6 allows remote attackers to execute malicious code. Immediate patching is required to mitigate severe risks.
Read full advisory →CVE-2026-11976
2026-08-16
Critical Compromise in MonsterInsights Pro S3 Bucket (CVE-2026-11976)
The official MonsterInsights Pro S3 update bucket was compromised, distributing malicious code in versions 10.2.2 and 10.2.0. Attackers maintain access and actively update payloads. Immediate mitigation required.
Read full advisory →CVE-2026-14812
2026-08-16
Critical Vulnerability in Premium SEO WordPress Plugin (CVE-2026-14812)
The Premium SEO WordPress plugin contains a malicious backdoor enabling unauthenticated remote code execution and full site compromise. Immediate removal or updates are required for affected installations.
Read full advisory →CVE-2026-48330
2026-08-16
Critical SQL Injection Vulnerability in Adobe Campaign Classic Allows Arbitrary Code Execution (CVE-2026-48330)
A critical SQL injection vulnerability (CVE-2026-48330) in Adobe Campaign Classic allows remote attackers to execute arbitrary SQL commands, potentially leading to full system compromise. Exploitation requires no user interaction. Immediate patching is strongly recommended.
Read full advisory →CVE-2026-48331
2026-08-16
Critical SSRF Vulnerability in Adobe Campaign Classic Allows Privilege Escalation (CVE-2026-48331)
A critical Server-Side Request Forgery (SSRF) vulnerability in Adobe Campaign Classic (ACC) allows attackers to escalate privileges without user interaction. With a CVSS score of 10.0, this issue requires immediate patching to prevent potential system compromise.
Read full advisory →CVE-2026-69083
2026-08-16
Critical SQL Injection Vulnerability in SiYuan (CVE-2026-69083)
SiYuan versions prior to v3.7.3 contain a critical SQL injection flaw in the fullTextSearchAssetContent endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and manipulate cross-notebook data.
Read full advisory →CVE-2026-69084
2026-08-16
Critical SQL Injection Vulnerability in SiYuan Allows Unauthenticated Data Manipulation (CVE-2026-69084)
SiYuan versions prior to v3.7.3 contain a critical SQL injection flaw in the /api/search/searchEmbedBlock endpoint, allowing unauthenticated attackers to execute arbitrary SQL commands and manipulate cleartext notebooks. Immediate upgrade recommended.
Read full advisory →CVE-2026-69085
2026-08-16
Critical SQL Injection Vulnerability in SiYuan Allows Remote Database Compromise (CVE-2026-69085)
A critical SQL injection vulnerability (CVSS 10.0) in SiYuan versions prior to 3.7.3 allows remote attackers to execute arbitrary SQL commands via the /api/filetree/searchDocs endpoint, potentially leading to full database compromise. Unauthenticated access possible in publish mode.
Read full advisory →CVE-2026-67308
2026-08-16
Critical Shell Injection Vulnerability in Wazuh GitHub Actions Workflows (CVE-2026-67308)
A critical shell injection flaw in Wazuh GitHub Actions workflows allows remote code execution via malicious VERSION.json files, risking secret exfiltration. Immediate patching required.
Read full advisory →CVE-2026-57834
2026-08-16
Critical Request Smuggling Vulnerability in Apache Traffic Server (CVE-2026-57834)
Apache Traffic Server contains a critical request smuggling vulnerability (CVSS 10.0) affecting multiple versions. Attackers could exploit malformed chunked messages to bypass security controls. Users are advised to upgrade immediately.
Read full advisory →CVE-2026-16498
2026-08-14
Critical Cross-Tenant Credential Reuse Vulnerability in Terraform-MCP-Server (CVE-2026-16498)
A critical cross-tenant credential reuse vulnerability in terraform-mcp-server versions prior to 1.1.0 allows unauthorized execution of tool calls via reused Terraform tokens. This high-severity issue is resolved in version 1.1.0.
Read full advisory →CVE-2026-11756
2026-08-14
Critical RCE Vulnerability in 3DEXPERIENCE Platform (CVE-2026-11756)
A critical remote code execution vulnerability in the Station Launcher App of the 3DEXPERIENCE platform allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data. Affects versions R2023x through R2026x. Immediate patching required.
Read full advisory →Get These Delivered to Your Inbox
Subscribe to receive advisories as soon as they are published — filtered to your environment.