60
60
60
Trend Micro fixes critical bugs in Apex Central and TMEE PolicyServer
60
60
60
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.
Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.
65
Vulnerability Spotlight: Apple Safari SVG marker element baseVal remote code execution vulnerability
60
Microsoft December 2020 Patch Tuesday fixes 58 bugs, 9 are critical
60
60
Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
60
60
60
60
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.
80
60
60
60
60
60
60
60
Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root
Two critical ArangoDB flaws (CVSS 9.8 and 9.9) enable unauthenticated API access and root code execution; fixes shipped in version 3.12.11
Remedio researchers found two ArangoDB flaws: GHSA-rrgq-978q-36mq (CVSS 9.8), an authentication bypass caused by the server inconsistently interpreting URL-encoded '/_api' paths, and GHSA-rvhw-4hpw-9vrx (CVSS 9.9), which lets users with database write access run JavaScript tasks with root privileges via the isSystem flag. Chained, they allow administrative database access without credentials, theft of the root password hash, and root code execution, exposing files such as /etc/shadow, TLS keys and cluster signing material on the official container image. ArangoDB shipped fixes in version 3.12.11 on August 31, 2026, with advisories published September 6; CVE identifiers were still pending. Users on 3.12.10.1 or earlier should upgrade, restrict exposure and rotate potentially exposed credentials.
60
60
60
60
60
60
Microsoft releases 12 Security Updates; Including 6 Critical Patches
60
60
60
Microsoft Issues Software Updates for 17 Critical Vulnerabilities
60
60
60
60
Microsoft Issues Patches For Severe Flaws, Including Office Zero
60
Six critical vulnerabilities included in August’s Microsoft security update
60
Microsoft Releases Patches for 74 New Vulnerabilities in August Update
60
60
60