CVE

A new practical guide covers AndroidX Security State 1.1.0, explaining how Android developers can check device security patch levels, surface pending updates to users, and verify CVEs. The walkthrough also covers building security-aware Android apps, with code examples in Kotlin using Jetpack libraries, and is being shared among developers in the Android and security engineering communities.

Atlassian's Data Center products — Bitbucket, Confluence and Jira — are affected by CVE-2026-21589, a critical vulnerability (CVSS 9.3) allowing unauthenticated arbitrary file access. Security researchers report exploitation attempts began within two hours of public proof-of-concept details being released, making rapid patching urgent for organizations running affected software.

A critical vulnerability, CVE-2026-96408, has been disclosed in Movable Type Cloud Edition versions 2.0 through 9.2.1. The flaw is a code injection in the upgrade script, allowing unauthenticated attackers to execute arbitrary Perl and SQL code. No patch is available yet, and administrators are being urged to restrict access to the upgrade script as an interim mitigation while a fix is awaited.

The Document Foundation and Apache have released security updates for LibreOffice and OpenOffice fixing several critical vulnerabilities. Among them is CVE-2026-63277, a remote code execution flaw that lets attackers run malicious Java code through manipulated document files. Users are urged to install the patches promptly, as the flaw could allow full system compromise from simply opening a crafted file.

Surveillance company Flock has been added to the CVE Program as a CVE Numbering Authority, meaning it can now assign official CVE identifiers to security vulnerabilities in its own Flock-branded hardware and software products. The designation, announced by the CVE Program, is drawing attention in the cybersecurity community given debate over Flock's surveillance footprint and how the company will handle disclosure of flaws in its own systems.

Security researchers are flagging CVE-2026-21589, a critical vulnerability in self-hosted Atlassian Data Center products including Jira, Confluence, Bitbucket, Bamboo and Crowd. The flaw allows unauthenticated attackers to access arbitrary files, though they must know the exact file name or path since directory listing is not possible. Atlassian has released patched versions and reports no known exploitation so far. Administrators are urged to update their deployments promptly.

A new vulnerability, CVE-2026-16516, has been catalogued in wolfSSH, the SSH library from wolfSSL Inc. The flaw is classified as CWE-345, insufficient verification of data authenticity, meaning the library may accept data without properly confirming it comes from a trusted source. The listing is circulating among security researchers, who are tracking it as a potential concern for products embedding wolfSSH.

An FBI breach analysis indicates the hacking group ShinyHunters exploited CVE-2026-35273, a vulnerability in Oracle PeopleSoft, which remained unpatched at affected organisations because of a failure in third-party patching processes. Security coverage of the finding is focused on the supply-chain lesson: even when vendors issue fixes, gaps in third-party patch management can leave enterprises exposed to data theft.

A critical vulnerability, CVE-2026-105859 with a severity score of 9.8, has been disclosed in Payload, a free and open source headless content management system. Versions before 3.90.0 and canary versions before 4.0.0-canary.34 are affected: an attacker can submit a request to a specific update endpoint that modifies collection documents. Security teams using Payload are being urged to update to patched versions immediately.

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability affecting self-hosted Data Center versions of Confluence, Jira and Bitbucket. The flaw could let attackers read sensitive files on affected servers. Atlassian is urging administrators to patch immediately. Security commentators are sharing the advisory and warning self-hosted deployments to act quickly.

A critical vulnerability, CVE-2026-61421 with a severity score of 9.8, has been disclosed in Dell Container Storage Modules versions prior to 1.18.0. The flaw involves hard-coded credentials in the CSM Authorization component, meaning an unauthenticated attacker with remote access could potentially exploit it. Users are being urged to update to version 1.18.0 or later.