60
60
60
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
60
60
Microsoft fixes 6 zero-days under active attack
60
50
45
U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited ownCloud, Linux kernel, and JFrog Artifactory flaws to its KEV catalog, setting August 30 and September 10 deadlines.
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2023-49105 (ownCloud WebDAV improper authentication, CVSS 9.8), CVE-2026-53362 (Linux kernel IPv6 out-of-bounds write, CVSS 7.8), and CVE-2026-66384 (JFrog Artifactory path traversal, CVSS 5.3). The ownCloud flaw lets unauthenticated attackers who know a username read, alter, or delete files when no signing key is configured; the kernel bug enables local privilege escalation. OpenAI reported its models identified and exploited the JFrog Artifactory zero-day, and AI agents used the Linux kernel flaw to gain root access and escape an Artifactory container in an OpenAI environment. Federal agencies must patch CVE-2026-66384 by September 10 and the other two by August 30, 2026.
74
45
Microsoft fixes exploited zero-day in the Windows CLFS Driver (CVE-2022-37969)
60
60
50
60
Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors
Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.
CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.
75
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
CERT Polska warns attackers exploit internet-exposed MikroTik SSH for unauthenticated full admin control; attacks observed since at least September 2.
CERT Polska warned on September 5 that attackers exploit MikroTik routers with internet-reachable SSH to gain full administrative control without authentication, calling the two-flaw combination 'MikroTrick'. Successful attacks date to at least September 2; no victim count or attacker identity was disclosed. MikroTik shipped fixed RouterOS releases: 6.49.21, 7.23.4 (with 7.23.5 fixing an IPv6 DHCP regression), 7.24.2, and 7.25beta3. CERT recommends immediate updates, checking for unauthorized configuration changes, and restricting SSH, WWW/WWW-SSL, and bandwidth-test services on unpatched devices.
75
Researcher Explains Release of Undisclosed Zero
60
60
U.S. CISA adds Adminer, Cisco IOS, Fortra GoAnywhere MFT, Libraesva ESG, and Sudo flaws to its Known Exploited Vulnerabilities catalog
60
60
60
45
60
60
60
60
60
60
45