VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating they are currently being exploited in the wild. These vulnerabilities affect a variety of systems, including Red Hat Libuser, Microsoft SQL Server, and Citrix NetScaler, among others. The identified vulnerabilities range from privilege escalation to remote code execution, posing serious risks to federal agencies and potentially impacting other organizations as well. CISA urges all entities to prioritize fixing these vulnerabilities to protect their systems, especially those that expose critical assets to attackers. The agency encourages reporting any additional exploited vulnerabilities that are not yet in the KEV Catalog for potential inclusion.

Attackers are exploiting two serious vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing unauthorized users to log in as any WordPress user, including those with administrative privileges. These vulnerabilities, identified as CVE-2026-61979, have a CVSS score of 8.1, indicating a high severity level. This situation puts numerous WordPress sites at risk, as it could enable attackers to gain complete control over these sites without needing valid credentials. The vulnerabilities were disclosed by Patchstack, underscoring the need for site administrators to take immediate action. Promptly addressing these flaws is crucial to prevent unauthorized access and potential data breaches.

A recently discovered vulnerability, identified as CVE-2026-54121, poses a serious risk to organizations using Enterprise Certificate Authorities (CAs). This flaw allows a standard domain user to escalate their privileges, effectively turning the Enterprise CA into a Domain Controller. This situation can lead to unauthorized access and control over sensitive resources within the network. Organizations need to treat their Public Key Infrastructure (PKI) as a critical part of their security framework, as it plays a vital role in identity management. The importance of addressing this vulnerability cannot be overstated, as it highlights the need for stringent security measures around privileged accounts and trust relationships within IT environments. Patching is essential to mitigate this risk.

Siemens License Server (SLS) has been found to contain multiple vulnerabilities that could allow attackers to gain elevated privileges and access arbitrary files on affected systems. Specifically, versions prior to 5.1 and 5.3 are vulnerable to local privilege escalation and path traversal, respectively. The first vulnerability, CVE-2026-69108, stems from an insecure sudoers policy, while CVE-2026-69109 results from inadequate input sanitization. Siemens recommends that users update to version 5.1 or later for the privilege escalation issue and to version 5.3 or later for the path traversal vulnerability. This is crucial as the vulnerabilities could lead to significant security breaches, including complete system compromise.

Adobe has released important security updates to address multiple critical vulnerabilities affecting its ColdFusion, Commerce, and Campaign Classic products. Among these, the most serious is a command injection flaw in ColdFusion, identified as CVE-2026-48362, which has a maximum severity score of 10.0 on the CVSS scale. If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, leading to potential privilege escalation. This is particularly concerning for organizations that rely on these Adobe products, as successful exploitation could compromise sensitive data and system integrity. Users are strongly advised to apply the latest patches to mitigate these risks.

cPanel has addressed a serious vulnerability that allowed authenticated users to execute SQL commands with root database privileges. This flaw, tracked as CVE-2026-58048 and rated 9.4 on the CVSS scale, breaks the security boundary between individual cPanel accounts and the server's administrative database identity. The issue was fixed in a recent security update, which also addressed two other privilege escalation paths. Hosting customers who use cPanel should be aware of this vulnerability, as it could have allowed unauthorized access to sensitive data or manipulation of critical database functions. It's crucial for users to ensure they are using the latest version of cPanel to mitigate any potential risks associated with this flaw.

Siemens has issued a warning regarding vulnerabilities in the Mendix Runtime, specifically related to the documentation on access rules for the System.User entity. Developers may unintentionally set overly permissive access rules due to inadequate guidance, which can lead to unauthorized access to sensitive user data or privilege escalation in applications. A notable misconfiguration involves the anonymous user role, which could allow access to all stored records without explicit permissions. Siemens is urging Mendix developers to review their access configurations in light of this issue. This vulnerability affects all versions of Siemens Mendix Runtime and has been assigned the CVE identifier CVE-2026-7891, with a critical severity rating of 9.1 on the CVSS scale.

Siemens has reported a vulnerability in multiple versions of its IAM Client software, which could allow an authenticated local attacker to escalate their privileges. This unquoted search path vulnerability affects various Siemens products, including COMOS, Designcenter NX, and several Simcenter and Solid Edge applications. Siemens has rolled out updates for several affected versions and advises users to upgrade to the latest releases to mitigate the risk. For products that do not currently have fixes available, Siemens is recommending additional countermeasures. Organizations using these products should take immediate action to ensure their systems are secure, as this issue could potentially expose sensitive environments in critical industries such as manufacturing and energy.