Latest Vulnerability digest news

WordPress vulnerability digest for April 8–9: 17 new CVEs, with one CVSS 9.8 critical that turns a GDPR compliance helper into an unauthenticated RCE primitive. The DSGVO Google Web Fonts GDPR plugin has no patched version and should be removed …

The quietest day of the month still delivered a pattern worth tracking. MLflow picked up its fourth authentication or input validation flaw in six weeks. pymetasploit3 got a CVSS 9.3 command injection in its core module execution function.

165 new CVEs on April 2 include a pre-auth RCE chain in Progress ShareFile with 30,000 exposed instances and a CVSS 10.0 SSRF in FastMCP. TP-Link Tapo camera, Convoy KVM, and WordPress plugin flaws round out the batch.

88 new CVEs on March 31 include a CVSS 10.0 NocoBase sandbox escape to root RCE, a WordPress Everest Forms Pro RCE, five baserCMS command injections, and SQL injections in Umami and SciTokens. Eleven vulnerabilities scored 9.0 or above.

A CVSS 10.0 path traversal in ORY Oathkeeper bypasses all three layers of access control at once. Squid 7.5 patches a heap use-after-free in ICP handling, and a 12-year-old Perl session middleware RCE finally receives a CVE number. Full vulnerability …

Twenty-one Apple CVEs across every platform in active support, including two macOS sandbox escapes and a Stolen Device Protection bypass. Cisco's semiannual IOS XE bundle adds three unauthenticated DoS flaws. Two npm packages score CVSS 9.8 for command injection via …

Forty-two CVEs in a single Firefox release. Six are sandbox escapes. Six were found by researchers using Anthropic's Claude. Chrome patched 8 more the same day. Both browsers closed attack paths triggered by visiting a single malicious page.

Oracle's emergency patch fixes a CVSS 9.8 pre-auth RCE in Identity Manager. PTC Windchill carries a CVSS 10.0 zero-day with webshell IOCs but no patch. Langflow AI pipelines were exploited within 20 hours of disclosure. Two Chrome zero-days hit CISA …

A weekend batch of 198 CVEs includes a BACnet plaintext flaw (CVSS 9.1) exposing building automation to traffic interception. WordPress gets hit with five privilege escalation bugs, cookie-based SQL injection bypassing WAFs, and a strpos() admin takeover.

Oracle broke its quarterly cycle with an emergency patch for Identity Manager RCE (CVSS 9.8), likely a bypass of an actively exploited October 2025 flaw. Spring patched two actuator auth bypasses. FastGPT's GitHub Actions let anyone push malicious Docker images.

Three critical WordPress plugin flaws, all unpatched. A WooCommerce privilege escalation, a BuilderPress file inclusion, and a Profile Builder Pro SQL injection. Plus five OpenClaw command injections and a PX4 drone autopilot crash via MAVLink.

SQL injection meets RAG pipelines. Spring AI flaws turn chatbot queries into database commands. An unpatched ONNX bypass silences model trust checks. A CVSS 9.8 WordPress healthcare plugin leaks patient records with just an email address.

Twin CVSS 9.1 Wazuh RCEs, a ScreenConnect crypto exposure, and Eclypsium KVM research headline the March 17 digest. Budget IP-KVM exposure grew from 404 to 1,611 internet-facing units in seven months.

Two Chrome Mojo sandbox escapes (CVSS 9.6 and 8.3), a chainable Unraid NAS auth bypass + root RCE, and an AnythingLLM SQL injection lead 87 notable CVEs from March 16. One Unraid flaw targets the same file patched in 2020.

Five critical vulnerabilities lead the March 14-15 batch of 215 new CVEs. A CVSS 9.8 unauthenticated WordPress RCE, OneUptime's fourth CVSS 9.9 in six weeks, and three unpatched D-Link buffer overflows top the list.