60
60
60
Vulnerability Spotlight: Multiple vulnerabilities in OpenClinic’s GA web portal
60
60
60
60
60
60
Cisco Secure Email Gateway SQL Injection Vulnerability
Unauthenticated SQL injection in Cisco Secure Email Gateway email parsing enables root command execution via crafted messages; patches released.
A vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Insufficient validation in the email parsing logic lets a crafted email containing malicious SQL statements achieve arbitrary SQL execution and root command execution. Cisco has released software updates, and the companion September 2026 hardening advisory states this flaw is actively exploited.
82
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross
60
60
Vulnerability Spotlight: Vulnerabilities in Lansweeper could lead to JavaScript, SQL injections
60
60
60
Sophos fixed critical vulnerabilities in its Firewall product
60
Ivanti fixed a maximum severity vulnerability in its CSA solution
60
60
60
60
60
60
Vulnerability Spotlight: Multiple vulnerabilities in phpGACL class
60
Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL
ServiceNow patched four AI Platform flaws, including three pre-authentication CVSS 10.0 issues enabling unauthenticated code execution, SQL injection, and privilege escalation.
ServiceNow released patches on August 27, 2026 for four AI Platform flaws: CVE-2026-18885 (code injection in the GraphQL Composite Data API), CVE-2026-18886 (improper access control enabling privilege escalation), and CVE-2026-74820 (SQL injection), all self-rated CVSS 10.0 and exploitable without authentication, plus CVE-2026-6876, an 8.7 sandbox escape. Updates were deployed to hosted instances, but self-hosted customers must patch affected Xanadu, Yokohama, Zurich, and Australia release lines themselves. ServiceNow says it is not aware of exploitation of the new flaws, and no public exploit code existed as of August 28, 2026; separately, Defused reported in-the-wild exploitation of the earlier CVE-2026-6875 (CVSS 9.5), later noting the captured payload matched Searchlight Cyber's PoC.
70
Fortinet Patches Critical Bug in FortiClient EMS
60
60
60
60
60
60
60
Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager
60
60
60
Ivanti fixed a critical EPM flaw that can result in RCE
60
Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution
60
60
60
Ivanti Issues Critical Security Updates for CSA and Connect Secure Vulnerabilities
60
Critical Palo Alto Networks Expedition bug exploited (CVE-2024-5910)
60