CVE

109 articles · page 5 of 10

Part of Security wire
CVEJfrog

Artifactory anonymous token chain hits CISA KEV

How to fix CVE-2026-42018 / CVE-2026-42016: upgrade self-hosted Artifactory past the anonymous-JWT and token-scope floors (prefer 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20)

Hashgraph Online
CVEHeadroom

CVE-2026-71416: Headroom WebSocket proxy spends your OpenAI key for any reachable browser

How to fix CVE-2026-71416: upgrade headroom-ai to 0.35.0

HOL Guard
CVECompression

CVE-2026-87776: Express compression leaks native memory until the process dies

How to fix CVE-2026-87776: upgrade compression to 1.8.2

HOL Guard
CVEApache artemis

CVE-2026-57967: unauth Artemis CORE session steal and OpenWire queue delete

How to fix CVE-2026-57967: upgrade Apache Artemis / ActiveMQ Artemis to 2.57.0. Unauth CORE SESSION_REATTACH can steal a live session; OpenWire RemoveSubscriptionInfo can delete queues before auth.

HOL Guard
BreakingCVE

CVE-2026-0310 PAN-OS XML overflow gives unauth root on PA-Series

How to fix CVE-2026-0310: upgrade PAN-OS to the fixed hotfix for your train (for example 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, 10.2.18-h10). Unauth XML to management web or dataplane can root PA-Series firewalls.

HOL Guard
CVEAdobe commerce

CVE-2026-77774: Magento still needs APSB26-138 after the StyleSmuggler hotfix

How to fix CVE-2026-77774: apply Adobe APSB26-138 September Isolated patches (or *-2026-sep builds) after the StyleSmuggler hotfix, then verify with php vendor/bin/patch-status

HOL Guard
CVEFastify cli

CVE-2026-75021: fastify-cli debug-host bind can expose Inspector RCE

How to fix CVE-2026-75021: upgrade fastify-cli to 8.0.1

HOL Guard
BreakingCVE

CVE-2026-75650 lets unauth callers run code on Adobe Commerce and Magento

How to fix CVE-2026-75650: apply Adobe hotfix VULN-39341 from repo.magento.com, then rotate the Commerce encryption key and every credential it protected

HOL
BreakingCVE

CVE-2026-75650 is unauthenticated RCE in Adobe Commerce and Magento, already exploited

How to fix CVE-2026-75650: apply Adobe hotfix VULN-39341 for Adobe Commerce / Magento Open Source, then rotate the encryption key and all protected credentials

HOL
BreakingCVE

CVE-2026-76578 lets an unauthenticated LDAP client become a FreeIPA admin

How to fix CVE-2026-76578: apply the RHEL 9/10 errata where available; otherwise restrict LDAP ports 389/636 and disable anonymous binds until your train is patched

HOL Guard
BreakingCVE

CVE-2026-86259 lets unauth OpenMAIC callers pull cloud credentials via SSRF

How to fix CVE-2026-86259: upgrade OpenMAIC to 1.0.1

HOL Guard
BreakingCVE

CVE-2026-67276 and MikroTrick can take over MikroTik RouterOS with SSH exposed

How to fix CVE-2026-67276: upgrade RouterOS to 7.24.2, 7.23.4, or 6.49.21

HOL Guard

Related topics

Keep exploring

The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.

Security research hubPlugin marketplace