35
60
60
60
60
60
55
55
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
Broadcom issued emergency updates for VMware ESX, vCenter, Workstation and Fusion, fixing five flaws including CVE-2026-59309 (CVSS 9.8 authentication bypass in vCenter) and CVE-2026-59310 (CVSS 9.8 directory traversal allowing code execution). CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the ESX VMXNET3 adapter that permits a virtual machine escape to the host. Broadcom found no evidence of exploitation, but Defused Cyber reported a spike in vCenter scanning on August 11, 2026 consistent with exploitation attempts against CVE-2026-59309 (VMSA-2026-0006). No workarounds are available.
80
60
55
30
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
Oracle released its September 2026 Critical Security Patch Update fixing 672 unique CVEs via 673 security updates across 17 product families, with 104 patches (15.5%) rated critical and 503 rated high. Oracle E-Business Suite received the most patches at 159 (23.6%), followed by Fusion Middleware at 153, of which 78 are remotely exploitable without authentication. The CSPU is a monthly release cycle Oracle introduced in May 2026 between larger quarterly CPUs. Tenable will publish plugins to identify affected systems.
38
Broadcom Patches Critical ESXi Vulnerability Enabling Host Code Execution
60
35
30
30
VMware Warns Customers to Patch Actively Exploited Zero
60
Week in review: Attackers use phishing emails to steal NTLM hashes, Patch Tuesday forecast
60
Week in review: Patched curl and libcurl vulnerability, 15 free M365 security training modules
60
30
55
60
60
60
30
60
60
60
60
60
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.
Wordfence and Patchstack disclosed five critical flaws in WordPress plugins and themes: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The issues include unauthenticated authentication bypass (CVE-2026-76581), arbitrary file write leading to RCE (CVE-2026-18431), administrator account takeover via password-reset URL exposure (CVE-2026-19632), privilege escalation (CVE-2026-19598), and PHP object injection to RCE (CVE-2026-82222, CVSS 10.0). Patchstack says the GiveWP flaw chains an unsafe unserialize helper, attacker-controlled donation data, and a gadget chain in shipped code.
62
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
60
60
60
42
55
60