Public Exploit Code Raises Urgency Around Critical Atlassian File-Read Flaw
A proof-of-concept exploit is now public for CVE-2026-21589, a critical, unauthenticated file-read flaw affecting Jira, Confluence, Bitbucket, and other self-managed Atlassian Data Center products. In certain Crowd-connected setups...
Apache Struts Updates Close RCE, Memory Exhaustion and Data-Leak Flaws
Apache Struts maintainers have addressed four flaws spanning remote code execution, denial of service and cross-user data exposure. Administrators should move to Struts 7.4.0 or 6.12.0 and verify...
Crafted HEIC Uploads Can Turn WordPress Image Processing Into Server Code Execution
A newly demonstrated exploit chain turns a malicious HEIC upload into code execution through WordPress's server-side image pipeline. Administrators should update libheif, restrict unnecessary modern image formats, and...
AI-Driven Zammad Attack Chained Two Zero-Days to Reach Root in Seconds
An AI-assisted intruder compromised the Dutch Institute for Vulnerability Disclosure by chaining two previously unknown Zammad flaws. The incident moved from session hijacking to root access in seconds...
GitLab AI Gateway Sandbox Escape Opens Door to Remote Command Execution
GitLab has patched a CVSS 9.9 sandbox escape in self-hosted AI Gateway deployments. An authenticated Duo Agent Platform user could abuse crafted flow templates to execute commands on...
Dell Storage Module Flaws Expose Kubernetes Environments to Admin Takeover
Dell has fixed multiple critical flaws in its Container Storage Modules, including two CVSS 10 vulnerabilities reachable without authentication. Attacks could expose array credentials, bypass tenant controls and...
Red Hat Satellite Authorization Flaw Can Expose Root Passwords and Enable Code Execution
Red Hat has patched a CVSS 9.1 authorization flaw in Satellite's Foreman component that lets low-privileged users view protected host data, potentially including root passwords. Unsafe Safemode configurations...
Root-Level cPanel/WHM Flaw Puts Every Hosted Account on a Server at Risk
cPanel has patched a critical flaw (CVE-2026-93698) in the Multilang adminbin component that allows arbitrary command execution as root, alongside two stored XSS bugs in WHM's SSL Hosts...