ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

News

99 stories in the last 3d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 117Advisory 65AI safety & security 64AI industry 61AI research 57Exploit / PoC 48Industry 39Research 32Policy & legal 28Tools 26Malware 25Data breach 24Threat actor 20AI tools & infra 14
SeverityAllcritical 39high 125medium 121low 41info 323

Oracle September 2026 Critical Security Patch Update addresses 672 CVEsnew

Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).

Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.

Tenable Blog · 21m agoVulnerability

Microsoft Issues Emergency Fixes After Massive Patch Tuesdaynew

Microsoft shipped emergency out-of-band fixes to correct glitches from a record Patch Tuesday covering nearly 1,000 CVEs.

Dark Reading reports that Microsoft issued emergency fixes following a massive Patch Tuesday that addressed nearly 1,000 CVEs. The out-of-band updates correct glitches introduced by the record-sized monthly release. The brief excerpt names no specific CVEs, affected products, or actively exploited flaws.

Dark Reading · 1h agoVulnerability

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.

CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.

oss-security · 1h agoVulnerabilityCVE-2026-86792

CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.

CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.

oss-security · 1h agoVulnerabilityCVE-2026-86465

CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.

CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.

oss-security · 1h agoVulnerability 3 sourcesCVE-2026-86466

CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider 2.0.0-3.8.x lets deactivated users keep unexpired Core API JWTs and mint replacements indefinitely.

CVE-2026-82310 affects apache-airflow-providers-fab versions 2.0.0 before 3.9.0. Deactivating a user account does not stop tokens issued before deactivation. While password authentication correctly rejects the disabled account, the Core API continues to accept an existing unexpired token naming it and lets that token mint a replacement. Severity is rated moderate.

oss-security · 1h agoVulnerabilityCVE-2026-82310

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.

CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.

oss-security · 1h agoVulnerability 2 sourcesCVE-2026-76187

CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

Unauthenticated attackers can forge Apache ZooKeeper operational log lines via newline injection in crafted ensemble authentication requests.

CVE-2026-84501 (moderate severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The forged entries could mislead operators or corrupt log-based monitoring and forensics.

oss-security · 2h agoVulnerabilityCVE-2026-84501

CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

Apache ZooKeeper audit logs are vulnerable to arbitrary field injection by unauthenticated attackers via tab characters in digest auth requests.

CVE-2026-84439 (important severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6 when audit logging is enabled (zookeeper.audit.enable=true). An unauthenticated attacker can inject arbitrary fields into the audit log by sending a digest authentication request with embedded tab characters, undermining audit trail integrity and potentially enabling log-analysis evasion or spoofing.

oss-security · 2h agoVulnerabilityCVE-2026-84439

CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.

CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.

oss-security · 2h agoVulnerabilityCVE-2026-79993

CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.

oss-security · 2h agoVulnerabilityCVE-2026-59969

CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.

oss-security · 3h agoVulnerabilityCVE-2026-59739

We got admin access to Baseten's production GitHub in 25 minutes

Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.

Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.

Hacker News · AI · 3h agoVulnerabilityHN 51↑ · 12 comments1

$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.

Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.

SecurityWeek · 5h agoVulnerability

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security News · 5h agoVulnerabilityCVE-2026-65414CVE-2026-84607CVE-2026-64752+7 CVEs1

Re: Retrospective by 'gpg.fail' authors

Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.

A retrospective by the gpg.fail authors revealed a remote code execution vulnerability in gpgsm 2.4.9, triggered when invoked as "gpgsm --debug all --import" with a malicious certificate file. The researchers did not report the issue to GnuPG, leaving it unpatched as an apparent 0-day. Exposure appears limited since it requires importing untrusted certificates with debug options enabled.

oss-securityupdated · 5h agofirst · 1d agoVulnerability 4 sources

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News · 7h agoVulnerability

LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server

cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.

A cPanel advisory published September 14 warns that a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 lets a low-privilege website user gain root access on shared-hosting servers, bypassing CageFS account isolation. LiteSpeed released version 6.3.7 on September 11, but auto-update may be delayed so admins should force the update manually. No CVE identifier, severity score, workaround, or exploitation information has been published. This is the third LiteSpeed root flaw since May, following CVE-2026-48172 and CVE-2026-54420 in the cPanel plugin, which were both actively exploited and added to CISA's KEV catalog.

The Hacker Newsupdated · 9h agofirst · 14h agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-54420

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackers · 9h agoVulnerability 2 sourcesCVE-2026-78006CVE-2026-78159

Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases

Apple patched a record 200+ vulnerabilities in iOS 27 and macOS Golden Gate 27, including 20 kernel flaws; none exploited in the wild.

Apple's iOS 27 and iPadOS 27 releases fix roughly 126 security flaws, 20 of them in the kernel, while macOS Golden Gate 27 addresses 210 vulnerabilities, about 100 shared with the mobile release. macOS Tahoe 26.7 patches 153 unique CVEs, including 26 kernel defects that could cause memory corruption, privilege escalation, system termination, and information leaks. Notable fixes include CVE-2026-64752, a CoreMedia memory corruption flaw allowing iPhone compromise via a malicious image, and CVE-2022-3437, a heap buffer overflow in Heimdal Samba enabling denial-of-service. Apple states none of the patched flaws are known to be exploited in the wild.

SecurityWeek · 10h agoVulnerabilityCVE-2022-3437CVE-2026-647521· 1 read

Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories

Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS in Telegram Desktop's HTML chat export pipeline affecting builds before Beta 6.9.4 and Stable 7.0.1. Unsanitized inline keyboard button text becomes executable JavaScript when a user exports a chat and opens the HTML file in a browser, exposing messages, metadata, and local file paths, and enabling phishing overlays. Telegram patched the issue in commit 8457d13a during July 2026; no CVE had been assigned at disclosure time.

GBHackers · 11h agoVulnerability

Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.

ExPatch researchers found that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to plant invisible JavaScript. When a user opened the export in a browser, the script could exfiltrate every message in that 1,000-message file, rewrite the displayed content, or fake a verification form. The flaw (rated CVSS 3.1 8.2) was fixed by commit 8457d13a in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026), but pre-fix exports remain dangerous since updating the app does not fix old files. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild is claimed.

The Hacker Newsupdated · 11h agofirst · 1d agoVulnerability 2 sources1

Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps

ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS flaw (CVSS 8.2) where bot inline keyboard button text was written unescaped into HTML chat exports, executing attacker JavaScript in browsers. The payload can persist in chat history for months, exfiltrate messages, metadata, and local file paths, and rewrite the page, spreading via forwarded messages without bot membership. Telegram fixed it by applying SerializeString(), first stable fixed release 7.0.1 shipped July 14, 2026, but HTML exports created with vulnerable versions remain dangerous.

Security Affairs · 13h agoVulnerability1· 1 read

Nintendo Switch Vulnerability Allows Attackers to Run Unauthorized Code on Your Console

Nintendo patched CVE-2026-82079, a CVSS 7.0 stack buffer overflow in original Switch local wireless allowing nearby code execution via QR-code workflows.

Nintendo patched CVE-2026-82079 (CVSS 4.0 base score 7.0, High), a stack-based buffer overflow in the original Switch's local wireless networking affecting firmware earlier than 23.0.0. An adjacent attacker must scan a QR code displayed by the console, via the Album "Send to Smartphone" feature or Mario Kart Live: Home Circuit, before crafted packets can corrupt memory and enable return-oriented programming for arbitrary code execution. EPSS is approximately 0.16%, Switch 2 is not affected, and Nintendo's advisory was published September 10, 2026.

Cyber Security Newsupdated · 15h agofirst · 1d agoVulnerability 2 sourcesCVE-2026-82079

CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution

Oracle reclassified MySQL Group Replication flaw CVE-2026-60163 from Local to Adjacent Network; researcher says it enables unauthenticated remote arbitrary SQL execution.

CVE-2026-60163 in MySQL Group Replication permits an unauthenticated remote attacker to execute arbitrary SQL on the destination server. Following discussion after the July disclosure, Oracle revised the CVSS attack vector rating from 'Local' to 'Adjacent Network'. The researcher posting to oss-security clarifies that, in the extreme, the attack surface is reachable fully remotely.

oss-security · 19h agoVulnerabilityCVE-2026-601631

Maximum Severity GitLab Flaw Puts Supply Chains at Risk

GitLab CVE-2026-85706 is a maximum-severity CVSS 10.0 path traversal flaw affecting Community and Enterprise Editions, risking supply chain compromise.

CVE-2026-85706 is a path traversal vulnerability with a CVSS score of 10.0 affecting GitLab Community Edition and Enterprise Edition instances. Exploitation could enable attackers to tamper with repositories, posing software supply chain risks. The report does not mention active exploitation.

Dark Readingupdated · 20h agofirst · 1d agoVulnerability 17 sourcesCVE-2026-857061

Homebrew 7.0.0 is out, here’s what changed for security

Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.

Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.

Help Net Security · 20h agoVulnerability

The GNU C Library security advisories update for 2026-09-14

glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.

The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.

oss-security · 1d agoVulnerability 2 sources

rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.

oss-securityupdated · 1d agofirst · 1d agoVulnerability 3 sources1

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm Center · 1d agoVulnerabilityCVE-2022-3437CVE-2026-20683CVE-2026-28899+27 CVEs

Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink

Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.

Stan Ulbrych disclosed CVE-2026-82049 on the Python security-announce list, forwarded to oss-security by Alan Coopersmith. The flaw affects CPython's tarfile extraction filters, which can allow file modification and content disclosure when archives contain a hard link to a symlink. Extraction-filter misuse can therefore bypass intended protections during archive unpacking.

oss-security · 1d agoVulnerabilityCVE-2026-82049

graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule

Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.

Evgenios Gkritsis publicly disclosed an algorithmic-complexity denial-of-service flaw in github.com/graphql-go/graphql affecting all released versions up to and including v0.8.1. The defect is triggered via the OverlappingFieldsCanBeMergedRule validation, is unauthenticated and network-reachable, and causes quadratic CPU exhaustion. No fixed version exists; the disclosure was public because the project has no private security-reporting channel or SECURITY.md.

oss-security · 1d agoVulnerability

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

Wordfence · 1d agoVulnerability

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security · 1d agoVulnerabilityCVE-2026-87802

Cisco Secure Email Gateway SQL Injection Vulnerability

Unauthenticated SQL injection in Cisco Secure Email Gateway email parsing enables root command execution via crafted messages; patches released.

A vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Insufficient validation in the email parsing logic lets a crafted email containing malicious SQL statements achieve arbitrary SQL execution and root command execution. Cisco has released software updates, and the companion September 2026 hardening advisory states this flaw is actively exploited.

Cisco Security Advisories · 1d agoVulnerability in the wild

CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.

CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-87785

CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output

Apache Syncope's CVE-2026-87779 exposes AES secret keys in log output when keys use non-standard lengths, rated important.

CVE-2026-87779 is an important-severity insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16, 24 or 32 bytes) is used, the secret key can be disclosed via log output. Affected versions are syncope-core-spring 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-877791

CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Apache Syncope's Neo4j persistence layer permits Cypher injection via certain FIQL search expressions, affecting versions through 3.0.16, 4.0.7, and 4.1.2.

CVE-2026-86460 is a moderate-severity Cypher injection in Apache Syncope's syncope-core-persistence-neo4j module, triggered when processing some FIQL search strings. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation is reported; upgrade to fixed releases is advised.

oss-security · 1d agoVulnerabilityCVE-2026-864601

CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.

CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.

oss-security · 1d agoVulnerability 2 sourcesCVE-2026-82232

CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.

CVE-2026-78336 is a moderate-severity insertion-of-sensitive-information-into-sent-data flaw in Apache Syncope's syncope-ext-oidcc4ui-logic module. The OIDCC4UI provider list discloses client secrets to any authenticated user. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 1d agoVulnerabilityCVE-2026-783361