⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
SonicWall SMA1000 Appliances are affected by a server-side request forgery (SSRF) vulnerability (CVE-2026-15409) that allows remote, unauthenticated attackers to manipulate the appliance into making unauthorized requests to unintended locations. The vulnerability, which has been added to CISA's Known Exploited Vulnerabilities catalog, is reportedly being actively exploited in the wild.
Langflow Langflow: Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
Joomlack Page Builder: Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
Check Point SmartConsole, a network security management tool, contains a critical improper authentication vulnerability (CVE-2026-16232) that allows unauthenticated remote attackers to obtain login tokens and gain full administrative privileges. The flaw, actively exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on July 22, 2026.
Arista's VeloCloud Orchestrator On-Prem contains a critical OS command injection vulnerability (CVE-2026-16812) that allows remote attackers to execute privileged commands on the system. Successful exploitation could compromise the VCO host, enabling unauthorized access to internal functionality and potentially affecting the confidentiality, integrity, and availability of both the orchestrator and its managed data.
WordPress Core has been identified with a critical interpretation conflict vulnerability, tracked as CVE-2026-63030, which could enable attackers to execute SQL Injection and Remote Code Execution (RCE) attacks. This vulnerability can be chained with another known issue, CVE-2026-60137, amplifying its potential impact.