Latest CVE news

WordPress vulnerability digest for April 8–9: 17 new CVEs, with one CVSS 9.8 critical that turns a GDPR compliance helper into an unauthenticated RCE primitive. The DSGVO Google Web Fonts GDPR plugin has no patched version and should be removed …

The quietest day of the month still delivered a pattern worth tracking. MLflow picked up its fourth authentication or input validation flaw in six weeks. pymetasploit3 got a CVSS 9.3 command injection in its core module execution function.

165 new CVEs on April 2 include a pre-auth RCE chain in Progress ShareFile with 30,000 exposed instances and a CVSS 10.0 SSRF in FastMCP. TP-Link Tapo camera, Convoy KVM, and WordPress plugin flaws round out the batch.

A CVSS 10.0 path traversal in ORY Oathkeeper bypasses all three layers of access control at once. Squid 7.5 patches a heap use-after-free in ICP handling, and a 12-year-old Perl session middleware RCE finally receives a CVE number. Full vulnerability …

Twenty-one Apple CVEs across every platform in active support, including two macOS sandbox escapes and a Stolen Device Protection bypass. Cisco's semiannual IOS XE bundle adds three unauthenticated DoS flaws. Two npm packages score CVSS 9.8 for command injection via …

Forty-two CVEs in a single Firefox release. Six are sandbox escapes. Six were found by researchers using Anthropic's Claude. Chrome patched 8 more the same day. Both browsers closed attack paths triggered by visiting a single malicious page.

Oracle's emergency patch fixes a CVSS 9.8 pre-auth RCE in Identity Manager. PTC Windchill carries a CVSS 10.0 zero-day with webshell IOCs but no patch. Langflow AI pipelines were exploited within 20 hours of disclosure. Two Chrome zero-days hit CISA …

Two Chrome Mojo sandbox escapes (CVSS 9.6 and 8.3), a chainable Unraid NAS auth bypass + root RCE, and an AnythingLLM SQL injection lead 87 notable CVEs from March 16. One Unraid flaw targets the same file patched in 2020.

Five critical vulnerabilities lead the March 14-15 batch of 215 new CVEs. A CVSS 9.8 unauthenticated WordPress RCE, OneUptime's fourth CVSS 9.9 in six weeks, and three unpatched D-Link buffer overflows top the list.

Six critical RustDesk Client vulnerabilities (CVSS 9.1–9.3) affect all platforms. Nginx UI CVE-2026-27944 (CVSS 9.8) leaks full server backups without authentication. No RustDesk patch yet.