Metabase has issued a warning about a serious security vulnerability in its data visualization software, which is currently being exploited by attackers. This zero-day flaw, rated with a CVSS score of 10.0, allows unauthorized individuals to execute arbitrary SQL commands in the Metabase application database without needing to log in. As a result, attackers can gain administrative access to sensitive data. Since this vulnerability does not have a CVE identifier, it adds another layer of urgency for users to secure their systems. Organizations using Metabase should take immediate action to protect their data, as the exploit is actively being used in the wild.
WordPress has addressed a serious vulnerability in its login screen that affects all versions of the platform. This flaw, known as CVE-2026-64638 and rated with a CVSS score of 8.9, allows for pre-authentication reflected cross-site scripting (XSS). Researchers from pwn.ai have demonstrated that this vulnerability could potentially be exploited to execute PHP code on the server, particularly if an administrator interacts with a malicious page. As this issue impacts every WordPress installation, users and website administrators are strongly encouraged to apply the patch immediately to secure their sites and prevent potential exploitation.
The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability, identified as CVE-2026-8037, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects the Progress LoadMaster and allows for command injection, which can grant attackers total control over the affected system. CISA emphasizes that federal agencies must prioritize the rapid remediation of such high-risk vulnerabilities, especially those that are actively exploited. While this directive specifically targets Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based approaches to managing vulnerabilities. Organizations aware of other exploited vulnerabilities not listed in the KEV Catalog can submit them for consideration through CISA's nomination process.
Recent research has identified several vulnerabilities in the Controller-Pilot Data Link Communications (CPDLC) system that operates over the Aeronautical Telecommunications Network (ATN-B1). These vulnerabilities stem from the use of legacy, unauthenticated radio frequency links, which could allow attackers to inject unauthorized messages, disrupt communications, and reset sessions. Although these issues do not directly compromise aircraft safety, they could create confusion and increase the workload for pilots and air traffic controllers, potentially impacting operational safety. The vulnerabilities affect all versions of CPDLC over ATN-B1, with several specific CVEs (CVE-2025-71409 to CVE-2025-71413) documented. Currently, there are no available mitigations or patches for these vulnerabilities, and while they can be exploited in laboratory settings, there have been no reports of active exploitation in the wild.
A newly discovered vulnerability in the Zapscape Linux kernel, tracked as CVE-2026-64561, poses a significant risk to systems using KVM (Kernel-based Virtual Machine) technology. This flaw allows attackers with kernel privileges in an L1 guest virtual machine to potentially escape the isolation that KVM provides, enabling them to execute arbitrary code on the host system. The issue primarily arises when nested virtualization is deployed with untrusted guests, which increases the likelihood of exploitation. As companies and organizations increasingly rely on virtualized environments, this vulnerability underscores the need for vigilance in managing and securing these systems to prevent unauthorized access and potential breaches.
A recent study by researchers at 1Password reveals that about 75% of AI-generated patches for real vulnerabilities fail to provide a complete fix. The researchers evaluated 6,080 patches for six newly disclosed Common Vulnerabilities and Exposures (CVEs). While the AI-generated patches often resemble human-written fixes and can pass tests, they frequently leave unaddressed issues that could still be exploited. This finding raises concerns about the reliability of AI in cybersecurity, particularly as organizations increasingly rely on automated solutions to address vulnerabilities. The study suggests that companies should exercise caution when implementing AI-generated fixes and ensure thorough manual reviews before deployment.
A vulnerability has been discovered in Medixant's RadiAnt DICOM software that could allow attackers to exploit specially crafted DICOM files. Versions 2025.2 and earlier of the software are affected, which could lead to application crashes or even remote code execution due to an out-of-bounds write triggered by malicious JPEG-compressed pixel data. Users are advised to upgrade to version 2026.1 to mitigate this risk. The vulnerability is particularly concerning for healthcare and public health sectors worldwide, as it could compromise patient data and system integrity. While there are currently no reports of this vulnerability being actively exploited, users should remain cautious and only open DICOM files from trusted sources.
A recently discovered vulnerability in Johnson Controls Inc.'s TL280 device could allow attackers to access sensitive information. Specifically, versions of the TL280 prior to 5.63 are impacted due to the use of hardcoded credentials in the device's firmware. This presents a significant risk, particularly for sectors such as critical manufacturing, government services, and energy. To mitigate the threat, Johnson Controls recommends updating to firmware version 5.63 and implementing several network security measures, such as restricting access to trusted VLANs and monitoring device access logs for unusual activity. Although no active exploitation of this vulnerability has been reported, organizations should take proactive steps to protect their systems.
ABB Ability Zenon is facing significant vulnerabilities that could allow attackers to bypass security measures, crash systems, and compromise data. The issues primarily affect the IIoT services bundled with MongoDB version 4.2 across all versions of ABB Ability Zenon. Notably, vulnerabilities such as improper handling of length parameters and exploitation of uninitialized memory could lead to unauthorized actions. ABB has recommended urgent remediation steps, including replacing the bundled MongoDB with a supported version and uninstalling IIoT services if they are not needed. Given that these vulnerabilities impact critical infrastructure sectors like energy and healthcare, organizations using ABB Ability Zenon must act quickly to secure their systems.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a serious security flaw in JetBrains TeamCity, specifically affecting on-premise versions. The vulnerability, identified as CVE-2026-63077, has a high severity score of 9.8 and involves deserialization of untrusted data. This flaw allows unauthenticated attackers to potentially gain access to a TeamCity server, making it a significant risk for organizations using this software. As the vulnerability is currently being exploited in the wild, it is crucial for users to take immediate action to protect their systems. The timely patching of affected versions is paramount to mitigate this risk and ensure the security of sensitive data and operations.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that these issues are actively being targeted by attackers. The vulnerabilities include a critical flaw in IBM's Langflow, an issue in Apache Tomcat, and a flaw in N-able N-central. These vulnerabilities could allow unauthorized access or remote code execution, putting various organizations at risk. Companies using these platforms should take immediate action to address these vulnerabilities to avoid potential breaches and data loss. Being listed in CISA's catalog emphasizes the urgency for affected users to implement the necessary security measures.
The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability, identified as CVE-2026-63077, related to JetBrains TeamCity to its Known Exploited Vulnerabilities Catalog. This vulnerability involves the deserialization of untrusted data, which has been a common method for cybercriminals to exploit systems. The risk is particularly significant for federal agencies, as CISA's guidance emphasizes the need for rapid remediation of such vulnerabilities. While this directive primarily targets Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based strategies for managing vulnerabilities. The agency will continue to update the catalog with new vulnerabilities that show evidence of active exploitation, and organizations are invited to report any known exploited vulnerabilities that are not yet listed.
A newly discovered vulnerability in the Linux kernel's Open vSwitch datapath allows local users to gain root access on several default-configured distributions. This memory corruption flaw, identified as CVE-2026-64531 and given the codename OVSwrap, has a CVSS score of 7.8, indicating a high severity. Security researcher Asim disclosed this issue, which comes with a public exploit that has pre-built records for about 800 different kernel builds. This broad impact means that many users could be affected if they have systems running these vulnerable kernel versions. Companies and system administrators should take immediate action to assess their environments and apply necessary patches to mitigate this risk.
A serious vulnerability has been discovered in Gitea, the self-hosted Git service, that allows unauthenticated attackers to read any file that the service account can access. This flaw affects versions 1.22.1 through 1.27.0, requiring only a public repository and some specially crafted Org-mode markup to exploit. The vulnerability, tracked as CVE-2026-59774, has been rated Critical with a CVSS score of 9.8, indicating a severe risk. Users of affected Gitea versions should update to version 1.27.1 or later to secure their systems against this issue, as the flaw poses a significant risk of data exposure without needing any login credentials.
On August 5, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that they are being actively exploited. The most severe of these is CVE-2026-9198, a code injection flaw in Langflow that allows attackers to execute remote code without authentication, scoring 9.8 on the CVSS scale. Additionally, vulnerabilities in Tomcat and N-central were also flagged. These flaws pose significant risks to users and organizations relying on these platforms, as they could lead to unauthorized access and control over systems. Companies using these products should take immediate action to mitigate the risks associated with these vulnerabilities.