CVE

The EU's upcoming cybersecurity reporting requirements are set to expose long-standing weaknesses in how Linux vulnerabilities are tracked and patched. The number of published CVEs has grown sharply, and sprawling deployments make it harder for organisations to prove which systems are affected. Under the new rules, patching alone may not suffice: teams will need documented evidence of their vulnerability handling, turning compliance into a pressing operational challenge for Linux users across Europe.

A critical vulnerability, tracked as CVE-2026-59265, has been found in Apache OpenOffice's Java integration. Opening a crafted untrusted document can allow arbitrary code execution on the affected machine. Versions 4.1.16 and earlier are affected, and no exploitation has been confirmed so far. A fix is expected in version 4.1.17; users are advised to disable the Java runtime as an interim measure.

GitLab has patched a critical vulnerability, CVE-2026-90970, rated CVSS 9.9, in its AI Gateway. The flaw allows an authenticated attacker to escape the prompt-template sandbox and execute arbitrary commands on self-hosted deployments. Security professionals are urging administrators to apply the update quickly and check whether their installations are affected.

GitLab has released emergency security patches addressing two critical vulnerabilities: a remote code execution flaw in its AI Gateway, tracked as CVE-2026-90970, and a maximum-severity path traversal issue. Both flaws are reportedly being actively exploited, prompting the unusually urgent rollout. Security teams are being urged to apply the updates immediately, with the disclosures fueling renewed discussion about securing AI infrastructure.

Nine security vulnerabilities have been disclosed in YesWiki, a French open-source wiki platform. The most severe, CVE-2026-104457 with a CVSS score of 8.6, is an unauthenticated SQL injection that can dump administrator password hashes without any login. Other reported flaws include three SSRF issues, blind and second-order SQL injection, CSRF and page overwrite. Fixes are available in YesWiki 4.6.7, and users are urged to patch immediately.

A critical vulnerability tracked as CVE-2026-103922, with a CVSS score of 9.3, has been disclosed in Capacitor, the Ionic framework package with around 5.5 million weekly downloads used to build Android and iOS apps. Security researchers urge developers to update to a patched release immediately, warning that affected apps could be at serious risk until remediated.

A security vulnerability in SourceHut, tracked as CVE-2026-92973, reportedly allowed account takeover through malicious build logs. The flaw involved cross-site scripting in the ansi2html.py script used to render logs, letting attackers inject code that could hijack sessions. Developers and security researchers are discussing the disclosure and how the issue was handled.

A new vulnerability, CVE-2026-71887, has been disclosed affecting the Legion of the Bouncy Castle cryptography library for Java. The flaw is classed as CWE-347, improper verification of cryptographic signature, meaning the library may accept signatures it should reject. Security researchers are sharing the advisory and tracking potential impact on Java applications relying on the widely used library.

GitLab has released fixes for CVE-2026-90970, a critical vulnerability (CVSS 9.9) in its AI Gateway. An authenticated user with access to the Duo Agent Platform can run commands on the gateway. Only self-hosted gateway deployments are affected. Patches are available in versions 19.2.4, 19.3.2 and 19.4.1, and administrators are urged to update immediately.

Jeg Kit for Elementor, a WordPress add-on installed on more than 300,000 sites, contains an unauthenticated stored cross-site scripting vulnerability, tracked as CVE-2026-100180. An attacker can inject JavaScript through a blog comment, which then runs in visitors' browsers. All versions up to 3.2.19 are affected, and site owners are urged to update to version 3.2.20 immediately.

Microsoft is tracking CVE-2026-73570, a newly disclosed vulnerability that allows unauthenticated command injection on internet-facing mail servers. Because the flaw can be exploited without credentials and targets exposed systems, security teams are watching for signs of exploitation and awaiting patch guidance. Admins of mail infrastructure are being urged to assess exposure while details and fixes are confirmed.

A critical remote code execution vulnerability in Stirling PDF, tracked as CVE-2026-85714 and rated 9.1, has full technical details and a proof-of-concept exploit publicly available. The flaw stems from a crafted SQL import affecting the bundled H2 database. Administrators are urged to upgrade to version 2.13.2 immediately, as the public exploit makes attacks likely.

A security vulnerability tracked as CVE-2026-90970 has been disclosed in GitLab's AI Gateway, reportedly allowing remote code execution on affected systems. GitLab's AI Gateway sits in front of the company's AI-powered features, so a flaw there could expose organizations using the platform's AI tooling. Administrators are being urged to check their deployments and apply patches. Details on affected versions and exploitation are still limited.

A high-severity vulnerability, tracked as CVE-2026-104460 with a score of 7.5, has been identified in YesWiki versions before 4.6.7. The blind SQL injection flaw sits in the newtextsearch action, where Bazar list option ids are concatenated into SQL REGEXP and LIKE clauses without escaping. Anonymous attackers can exploit it remotely, and users are being urged to update.

A high-severity vulnerability, CVE-2026-104467, has been disclosed in YesWiki, a French open-source wiki software. Versions before 4.6.7 contain an authorization bypass in the ApiService::isAuthorized() function, allowing unauthenticated attackers to call admin-only API routes when public API mode is enabled. Administrators are urged to update to 4.6.7.

A vulnerability tracked as EUVD-2026-91330 has been catalogued affecting the Lua component of Apache Thrift, the open-source RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.7 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling and improper handling of length parameter inconsistency, which could enable denial-of-service conditions.

A high-severity vulnerability, CVE-2026-15897, has been disclosed in the Super Forms Drag & Drop Form Builder plugin for WordPress. The privilege escalation flaw affects all versions up to and including 6.3.316 and stems from the Register & Login add-on's before_email_success_msg() function. Site administrators are being urged to update the plugin to a patched version to avoid potential account takeover risks.

A high-severity vulnerability, CVE-2026-92174 scored 7.5, has been disclosed in the SiteOrigin Widgets Bundle plugin for WordPress. All versions up to and including 1.73.2 are affected by a local file inclusion flaw via the 'theme' parameter, which could let authenticated attackers with contributor-level access include sensitive files. Site owners are being urged to update the plugin promptly.

A critical vulnerability tracked as CVE-2026-104480, rated 9.4 on the CVSS scale, has been reported in Discord's libdave library, affecting version 1.1.0. The flaw is classified as CWE-390, detection of an error condition without action, meaning errors can occur without proper handling. Security researchers are circulating details of the issue and urging users and developers to watch for patches or updated releases.

A critical vulnerability, CVE-2026-86345 with a CVSS score of 9, has been disclosed in Red Hat Directory Server 11. It allows on-path attackers to inject LDAP messages after StartTLS negotiation, potentially leading to authentication bypass. Security teams are being urged to restrict access to affected servers and follow Red Hat's advisory for remediation guidance.

Cisco has released security updates for Catalyst SD-WAN Manager to fix a zero-day vulnerability, tracked as CVE-2026-76504, that attackers are actively exploiting in the wild. The flaw allows unauthenticated remote attackers to gain administrator privileges on affected systems. Administrators are urged to apply the patches promptly, as exploitation is already underway and unpatched SD-WAN management consoles could give attackers broad control over enterprise networks.

A newly published CVE, CVE-2026-78847, describes a critical remote code execution vulnerability in the gray-matter JavaScript front-matter parser. All versions are affected: code parsing JavaScript front matter uses eval() in lib/engines.js, letting attackers run arbitrary code. The flaw carries a CVSS score of 9.8 and no patch exists yet. Security commentators urge developers to avoid processing untrusted JavaScript front matter and to update as soon as a fix is released.

Security researchers have flagged two newly published vulnerabilities in Google Android 16 and 16-qpr2. CVE-2026-0016 is a CredentialManager permissions bypass that can expose local information, while CVE-2026-0017 is a BiometricService logic flaw allowing local privilege escalation. No exploitation in the wild has been reported so far. Users and administrators are advised to follow Google's security bulletins for patches.

Dell has released patches for critical vulnerabilities in its Dell Terraform Provider, including CVE-2026-91881, which could let attackers intercept or expose BMC (baseboard management controller) traffic. Security researchers urge administrators using the provider in infrastructure-as-code environments to upgrade to the fixed versions as soon as possible to avoid potential credential or management-plane exposure.

A new security advisory warns that CVE-2026-76570 affects multiple systems, potentially allowing remote code execution or complete system compromise. Attackers could gain full control of vulnerable machines, and administrators are urged to patch immediately or isolate affected systems until fixes are applied. Details of the affected software and full technical breakdown are circulating among security professionals.

A newly published vulnerability, CVE-2026-13313, affects ASUS routers and is rated high severity with a CVSS score of 8.9. Authenticated attackers can exploit a debug code path to enable Telnet on the device, obtaining root command execution. Security researchers advise administrators to restrict management access and monitor for Telnet activity until ASUS releases patch details.