Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild Source: The Hacker News The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versi Read original
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws Source: The Hacker News Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Dr Read original
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day Source: The Hacker News Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome’s JavaScript and WebAss Read original
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root Source: The Hacker News Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8, with no workaround Read original
Critical Elementor Pro flaw exploited to take over WordPress sites Source: BleepingComputer A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. […] Read original
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers’ crosshairs. The vulnerabilities are as follows - CVE-2026-83548 (CVSS score: 10.0) - A server-side reques Read original
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities (KEV) catalog after they landed in attackers’ crosshairs. The vulnerabilities are as follows - CVE-2026-83548 (CVSS score: 10.0) - A server-side reques Read original
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells Source: BleepingComputer Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. […] Read original
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells Source: BleepingComputer Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. […] Read original
Hackers exploit critical JFrog Artifactory flaw to forge admin tokens Source: BleepingComputer A critical authentication bypass vulnerability (CVE-2026-82329) in JFrog Artifactory is being exploited in attacks to create tokens that provide administrative access. […] Read original