Vulnerabilities
Orgs Urged to Patch SonicWall SMA1000 as Wild SSRF Exploits Hit Critical CVE-2026-102255
Attackers are targeting a maximum-severity flaw in SonicWall SMA1000 appliances within days of the vendor releasing a security update.
Cipher Insider Advisory Desk
The Cipher Insider Advisory Desk is the part of the Cipher Insider newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 17 articles so far. See the editorial policy or report an error.
Vulnerabilities
SAP S/4HANA flaw enables full system compromise via ABAP code execution
A critical vulnerability in SAP S/4HANA rule processing allows authenticated attackers with specific privileges to execute arbitrary ABAP code.
Vulnerabilities
Organisations face critical SAP NetWeaver risk as CVE-2026-89110 enables remote system compromise
A critical vulnerability in SAP NetWeaver Visual Composer allows attackers to invoke internal operations on connected systems, risking full compromise.
Vulnerabilities
SAP Python SDK OAuth2 Flaw Risks Credential Theft for Cloud App Developers
A critical vulnerability in the SAP Cloud SDK for Python allows attackers to hijack token requests and steal client credentials via server-side request forgery.
Vulnerabilities
Flock Security’s new CVE role raises trust questions for public safety agencies
The surveillance firm can now assign vulnerability IDs to its own cameras, sparking debate over transparency and conflict of interest.
Vulnerabilities
OTRS Bug Lets Attackers Keep Access for 16 Hours After Password Reset or Account Disable
A critical flaw in OTRS allows attackers to use stolen authentication tokens even after the associated user accounts are disabled or passwords are reset.
Vulnerabilities
Organisations Shift Security Liability to Vendors via Hosted Platforms in 2027
Hosted platforms absorb server hardening and update tasks, shifting security responsibility from the user to the vendor, according to a 2027 analysis.
Vulnerabilities
Organisations Urged to Patch Smart Casa v1.0.12 Amid Critical CVE-2026-93932 Deserialization Risk
A critical vulnerability in ThemeREX Smart Casa versions up to 1.0.12 allows attackers to inject objects via untrusted data deserialization.
Vulnerabilities
Org Integrity at Risk: Critical Privilege Escalation Flaw Hits Sergey AIWU Up to v1.5.9
A severe flaw in Sergey AIWU versions up to 1.5.9 allows subscribers to gain excessive system privileges, posing a significant risk to organisational integrity.
Vulnerabilities
Organisations at Risk: Tickera Plugin Critical Blind SQL Injection Flaw Exposes Data in Versions Up to 3.6.0.6
A critical vulnerability in the Tickera event ticketing plugin allows blind SQL injection, risking data exposure for sites using versions up to 3.6.0.6.
Vulnerabilities
WordPress Sites Face Critical Risk: Unauthenticated Code Execution in Avala Plugin
A critical vulnerability in the Avala plugin allows attackers to execute code without credentials on WordPress sites.
Vulnerabilities
Orgs Urged to Patch TinaCMS CVE-2026-108261 to Block Unauthenticated GraphQL Code Execution
A critical flaw in TinaCMS allowed unauthenticated attackers to execute GraphQL commands as logged-in editors through crafted preview links.
Vulnerabilities
Sites using WooCommerce 3D Configurator Face Critical No-Auth RCE Risk via Single POST Request
A critical flaw in the 3D Product Configurator for WooCommerce allows remote code execution without authentication, affecting versions up to 2.16.2.
Vulnerabilities
Organisations Urged to Patch ThemeREX IPharm Plugin Amid Critical CVE-2026-93936 Object Injection Risk
A severe vulnerability in the IPharm plugin allows object injection, affecting versions up to 1.2.4 and requiring immediate attention from administrators.
Vulnerabilities
WordPress Sites Exposed to Critical Deserialization Risk in Hogwords Plugin
The ThemeREX Hogwords plugin contains a severe flaw allowing object injection, affecting all versions up to 1.2.7 with a maximum severity score.
Vulnerabilities
CISA mandates immediate action for critical ONLYOFFDocs path traversal flaw
US agency adds CVE-2021-3199 to KEV, requiring federal compliance or discontinuation of affected ONLYOFFICE Docs versions.
Vulnerabilities
IBM Gateways Face Critical Breach Risk as Empty LDAP Passwords Grant Full Admin Control
A critical vulnerability in multiple IBM DataPower Gateway versions allows attackers to gain full administrative control using empty LDAP passwords.