The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.

CVE-2026-21589

• Severity: Unknown
• Impacted Products: Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center
• Description: Multiple Atlassian products, including Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center, Jira Software Data Center, Crucible, and Fisheye, are affected by a path traversal vulnerability that permits arbitrary file access. An unauthenticated remote attacker can exploit this flaw to read specific files located within the web application root directory.
• Remediation:
  • CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation
  • [BAM-26567] Arbitrary File Access in Bamboo Data Center - Create and track feature requests for Atlassian products.
  • [BSERV-20604] Arbitrary File Access in Bitbucket Data Center - Create and track feature requests for Atlassian products.
• More Info: NVD - CVE-2026-21589
• PoC:
  • https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit
  • https://github.com/0xBlackash/CVE-2026-21589
  • https://github.com/renzi25031469/CVE-2026-21589

CVE-2026-104935 NEW

• Severity: 8.6 HIGH
• Impacted Products: Ivanti Connect Secure 22.8R1, Ivanti Connect Secure 22.8R2.4, Ivanti Connect Secure release 25.1.1 (builds 0 and 1), Ivanti Connect Secure release 25.1.2 (builds 0 through 2)
• Description: Ivanti Connect Secure versions 22.8R1 through 22.8R2.4, release 25.1.1 (builds 0 and 1), and release 25.1.2 (builds 0 through 2) contain an authentication bypass by spoofing (CWE-290) and a time-of-check time-of-use race condition (CWE-362) in the legacy CGI web request routing and Windows File Share archive upload handler that allow an unauthenticated remote attacker to execute arbitrary code as the unprivileged cgi-server (nr) user.
• Remediation:
  • Security Advisory Ivanti Connect Secure (CVE-2026-104935)
  • Ivanti Connect Secure welcome.cgi and wu.cgi Authentication Bypass and Race Condition Remote Code Execution Vulnerability
• More Info: NVD - CVE-2026-104935
• PoC:
  • https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept
  • https://github.com/0x45dd/ivanti-cve-2026-104935-check

CVE-2026-96940

• Severity: 8.8 HIGH
• Impacted Products: Microsoft Exchange Server
• Description: Microsoft Exchange Server contains an elevation of privilege vulnerability caused by weak authorization enforcement. An authenticated attacker can exploit this flaw over a network to access and read unauthorized mailbox data across the organization.
• Remediation:
  • Microsoft Exchange Server Elevation of Privilege Vulnerability
  • Microsoft KB 5129955
  • Microsoft KB 5129956
• More Info: NVD - CVE-2026-96940
• PoC:
  • https://github.com/HORKimhab/CVE-2026-96940

CVE-2026-19490

• Severity: 10.0 CRITICAL
• Impacted Products: Citrix NetScaler ADC, Citrix NetScaler Gateway
• Description: Citrix NetScaler ADC and NetScaler Gateway contain an authentication bypass vulnerability that allows an unauthenticated remote attacker to gain unauthorized access to protected resources. The issue affects appliances configured as a Gateway or as an AAA virtual server under specific configurations.
• Remediation:
  • CITRIX | Support
• More Info: NVD - CVE-2026-19490
• PoC:
  • https://github.com/BishopFox/CVE-2026-19490-check
  • https://github.com/TarPeg007/CVE-2026-19490

CVE-2026-97229 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: GitLab Community Edition (CE) 19.2.0 prior to 19.2.8, GitLab Enterprise Edition (EE) 19.2.0 prior to 19.2.8, GitLab Community Edition (CE) 19.3.0 prior to 19.3.5, GitLab Enterprise Edition (EE) 19.3.0 prior to 19.3.5, GitLab Community Edition (CE) 19.4.0 prior to 19.4.2
• Description: An integer overflow vulnerability exists in the CI/CD regular expression compiler in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2.0 prior to 19.2.8, 19.3.0 prior to 19.3.5, and 19.4.0 prior to 19.4.2. The flaw occurs due to insufficient validation of regular expression repetition quantifiers and compiled bytecode program sizes when processing CI/CD configuration files.
• Remediation:
  • GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 | GitLab Docs
• More Info: NVD - CVE-2026-97229
• PoC:
  • https://github.com/jburgess-r7/CVE-2026-97229-PoC

CVE-2026-93674 NEW

• Severity: 8.8 HIGH
• Impacted Products: IBM Langflow OSS, IBM Langflow 1.0.0 through 1.12.2
• Description: An operating system command injection vulnerability exists in IBM Langflow OSS and Langflow versions 1.0.0 through 1.12.2 due to improper neutralization of special elements used in an OS command within the Model Context Protocol (MCP) server configuration workflow.
• Remediation:
  • Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
• More Info: NVD - CVE-2026-93674
• PoC:
  • https://github.com/rmhowe425/POC-CVE-2026-93674

CVE-2026-76460

• Severity: 9.8 CRITICAL
• Impacted Products: Cisco Identity Services Engine, Cisco ISE Passive Identity Connector
• Description: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an authentication bypass vulnerability within their API gateway component. An unauthenticated remote attacker can exploit this flaw by sending crafted HTTP or HTTPS requests to an affected API endpoint to bypass access controls on the web-based management interface.
• Remediation:
  • Cisco Identity Services Engine Authentication Bypass Vulnerability
  • Mitre Corporation
• More Info: NVD - CVE-2026-76460
• PoC:
  • https://github.com/S3v3n-JG/CVE-2026-76460

CVE-2026-76268 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Splunk Enterprise 10.2.0 through 10.2.6, Splunk Enterprise 10.4.0 through 10.4.2
• Description: A missing authentication vulnerability exists in the Patroni cluster management REST API of the embedded PostgreSQL sidecar in Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 on search head cluster members.
• Remediation:
  • SVD-2026-1001: Missing Authentication for Patroni REST API on Search Head Cluster in Splunk Enterprise
• More Info: NVD - CVE-2026-76268
• PoC:
  • https://github.com/murrez/CVE-2026-76268

CVE-2026-63030

• Severity: 9.8 CRITICAL
• Impacted Products: WordPress 6.9.x before 6.9.5, WordPress 7.0.x before 7.0.2
• Description: WordPress is affected by a REST API batch endpoint route confusion vulnerability that, when chained with a SQL injection flaw, allows unauthenticated remote code execution. This issue impacts WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
• Remediation:
  • WordPress 7.0.2 Release – WordPress News
  • REST API batch-route confusion and SQL injection issue leading to Remote Code Execution · Advisory · WordPress/wordpress-develop · GitHub
• More Info: NVD - CVE-2026-63030
• PoC:
  • https://github.com/ebrasha/abdal-cve-2026-63030
  • https://github.com/CybersecSpirit/CVE-2026-63030
  • https://github.com/Lukols-Dev/wp-cve-2026-63030-check

CVE-2026-60137

• Severity: 9.1 CRITICAL
• Impacted Products: WordPress 6.8.x before 6.8.6, WordPress 6.9.x before 6.9.5, WordPress 7.0.x before 7.0.2
• Description: WordPress is affected by an SQL injection vulnerability within the WP_Query class due to insufficient sanitization of the author__not_in parameter. This flaw allows attackers to manipulate database queries when untrusted input is passed to the affected parameter by themes or plugins.
• Remediation:
  • [SECURITY] [DSA 6399-1] wordpress security update
  • WordPress 7.0.2 Release – WordPress News
  • Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query · Advisory · WordPress/wordpress-develop · GitHub
• More Info: NVD - CVE-2026-60137
• PoC:
  • https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress
  • https://github.com/ebrasha/abdal-cve-2026-60137

CVE-2026-59346 NEW

• Severity: 7.5 HIGH
• Impacted Products: VMware Workstation, VMware Fusion
• Description: VMware Workstation and Fusion are affected by an integer overflow vulnerability in the VMXNET3 virtual device component that allows for guest-to-host privilege escalation. This issue occurs due to improper validation of user-supplied input prior to memory allocation.
• Remediation:
  • Support Content Notification - Support Portal - Broadcom support portal
• More Info: NVD - CVE-2026-59346
• PoC:
  • https://github.com/0xCyberstan/CVE-2026-59346-POC

CVE-2026-56290

• Severity: 9.8 CRITICAL
• Impacted Products: Joomla extension Page Builder CK
• Description: The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
• Remediation:
  • https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3
• More Info: NVD - CVE-2026-56290
• PoC:
  • https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit
  • https://www.exploit-db.com/exploits/52626
  • https://github.com/Jenderal92/CVE-2026-56290

CVE-2026-55255 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: Langflow
• Description: Langflow is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the /api/v1/responses endpoint. This flaw allows an authenticated attacker to execute AI workflows belonging to other users by providing a victim’s flow identifier in the request.
• Remediation:
  • https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e
  • fix(security): close IDOR in get_flow_by_id_or_endpoint_name (LE-639) by erichare · Pull Request #12832 · langflow-ai/langflow · GitHub
  • IDOR Vulnerability in /api/v1/responses Endpoint Allows Authenticated Attackers to Access Another User’s Flow · Advisory · langflow-ai/langflow · GitHub
• More Info: NVD - CVE-2026-55255
• PoC:
  • https://github.com/rootdirective-sec/CVE-2026-55255-Lab

CVE-2026-48908 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: JoomShaper SP Page Builder for Joomla
• Description: JoomShaper SP Page Builder for Joomla is affected by an improper access control vulnerability that allows unauthenticated attackers to upload and execute arbitrary PHP code. This flaw stems from insufficient authorization checks on the extension’s file upload interface.
• Remediation:
  • [URGENT] Potential Security Vulnerability Identified In SP Page Builder (v6.1.1) - Question | JoomShaper
• More Info: NVD - CVE-2026-48908
• PoC:
  • https://github.com/imXur/CVE-2026-48908-Joomla-SP-Page-Builder-RCE
  • https://github.com/gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla
  • https://github.com/bayu06802/CVE-2026-48908

CVE-2026-48282

• Severity: 9.8 CRITICAL
• Impacted Products: Adobe ColdFusion
• Description: Adobe ColdFusion is affected by a path traversal vulnerability in its Remote Development Services (RDS) component that allows for arbitrary file writes and remote code execution. This flaw enables an unauthenticated attacker to bypass directory restrictions and place malicious files on the host system.
• Remediation:
  • Adobe Security Bulletin
• More Info: NVD - CVE-2026-48282
• PoC:
  • https://github.com/imbas007/CVE-2026-48282

CVE-2026-104286

• Severity: 9.8 CRITICAL
• Impacted Products: Fortinet FortiMail
• Description: Fortinet FortiMail contains an improper limitation of a pathname to a restricted directory (path traversal) and null byte injection vulnerability in the webmail Identity-Based Encryption (IBE) service.
• Remediation:
  • PSIRT | FortiGuard Labs
• More Info: NVD - CVE-2026-104286
• PoC:
  • https://github.com/ShadowForge-Cyber/CVE-2026-104286-POC
  • https://github.com/techupdate24/fortimail-zero-day-cve-2026-104286

CVE-2026-102489

• Severity: 9.8 CRITICAL
• Impacted Products: Zammad 6.3.0 through 6.5.4, Zammad 7.0.0 and later
• Description: Zammad contains a session information disclosure and hijacking vulnerability in the standalone WebSocket server that allows an unauthenticated remote attacker to obtain active session identifiers and execute arbitrary code. The flaw is present in default installations of Zammad 6.3.0 through 6.5.4.
• Remediation:
  • Security: Harden WebSocket event handling (d55e1ff2f9d57a8cfa0a0e32c1970ff26370fa79)
  • Security Advisory CVE-2026-102489 & CVE-2026-102490 | Zammad
• More Info: NVD - CVE-2026-102489
• PoC:
  • https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
  • https://github.com/horizon3ai/CVE-2026-102489

CVE-2026-102255 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: SonicWall SMA 1000 Series appliances (SMA 6210, SMA 7210, SMA 8200v)
• Description: A pre-authentication server-side request forgery (SSRF) and unintended proxy vulnerability exists in the Work Place web portal interface of SonicWall SMA 1000 Series appliances (SMA 6210, SMA 7210, and SMA 8200v).
• Remediation:
  • Unauthenticated User Can Send Arbitrary Network Requests Using the Work Place (SNWLID-2026-0017)
• More Info: NVD - CVE-2026-102255
• PoC:
  • https://github.com/techupdate24/sonicwall-sma-1000-cve-2026-102255
  • https://github.com/HORKimhab/CVE-2026-102255

CVE-2026-0257

• Severity: 9.1 CRITICAL
• Impacted Products: Palo Alto Networks PAN-OS, Prisma Access
• Description: Palo Alto Networks PAN-OS and Prisma Access are affected by an authentication bypass vulnerability in the GlobalProtect portal and gateway components. This flaw allows a remote, unauthenticated attacker to forge authentication cookies and establish unauthorized VPN connections.
• Remediation:
  • CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
  • Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
• More Info: NVD - CVE-2026-0257
• PoC:
  • https://github.com/bolubey/CVE-2026-0257

CVE-2023-22894 NEW

• Severity: 7.5 HIGH
• Impacted Products: Strapi 3.2.1 through 4.7.9
• Description: Strapi versions 3.2.1 through 4.7.9 contain an information disclosure vulnerability in the REST and Content Manager API query parameter handling logic. An unauthenticated remote attacker or an authenticated user can infer sensitive attributes on related records, including administrator password hashes and password reset tokens, by supplying crafted relational filter parameters.
• Remediation:
  • Strapi Releases (v4.8.0 Security Patch)
  • Strapi Private Field Information Disclosure Vulnerability (GHSA-7238-8666-743c)
  • Security Disclosure of Vulnerabilities - April 2023
• More Info: NVD - CVE-2023-22894
• PoC:
  • https://www.ghostccamm.com/blog/multi_strapi_vulns
  • https://github.com/maxntv24/CVE-2023-22894-PoC/blob/main/CVE-2023-22894.py
  • https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve

CVE-2021-3199 NEW

• Severity: 8.1 HIGH
• Impacted Products: ONLYOFFICE Document Server 5.1.5, ONLYOFFICE Document Server 5.6.3
• Description: A path traversal vulnerability exists in ONLYOFFICE Document Server versions 5.1.5 prior to 5.6.3 when browser JSON Web Token (JWT) authentication is enabled.
• Remediation:
  • ONLYOFFICE Document Server FileUploaderService Path Traversal Vulnerability
  • ONLYOFFICE Document Server Changelog
  • Change log
• More Info: NVD - CVE-2021-3199
• PoC:
  • https://github.com/moehw/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py

CVE-2016-3081 NEW

• Severity: 8.1 HIGH
• Impacted Products: Apache Struts 2 versions 2.3.20 through 2.3.28, 2.3.20 through 2.3.20.2, 2.3.21 through 2.3.24.1, 2.3.25 through 2.3.28
• Description: An input validation and Object-Graph Navigation Language (OGNL) expression injection vulnerability exists in Apache Struts 2 versions 2.3.20 through 2.3.28 (specifically affecting 2.3.20 through 2.3.20.2, 2.3.21 through 2.3.24.1, and 2.3.25 through 2.3.28) when Dynamic Method Invocation (DMI) is enabled.
• Remediation:
  • Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)
  • Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)
  • S2-032: Remote Code Execution can be performed via method: prefix when Dynamic Method Invocation is enabled
• More Info: NVD - CVE-2016-3081
• PoC:
  • https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/struts_dmi_exec.rb
  • https://dl.packetstormsecurity.net/1604-exploits/struts_dmi_exec.rb.txt
  • http://blog.nsfocus.net/tech/%E6%8A%80%E6%9C%AF%E5%88%86%E4%BA%AB/2016/04/26/Struts2%E6%96%B9%E6%B3%95%E8%B0%83%E7%94%A8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2016-3081-%E5%88%86%E6%9E%90.html

CVE-2015-5477 NEW

• Severity: 7.5 HIGH
• Impacted Products: BIND 9.9.7, BIND 9.9.8, BIND 9.10.0, BIND 9.10.1, BIND 9.10.2
• Description: ISC Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an open-source reference implementation of the major components of the Domain Name System. A vulnerability exists due to incorrect handling of TKEY queries. This could trigger a REQUIRE assertion failure, resulting named to exit, causing a DoS.
• Remediation:
  • 1966274
  • c04769567
  • Hewlett Packard Enterprise
• More Info: NVD - CVE-2015-5477
• PoC:
  • https://www.exploit-db.com/exploits/37721
  • https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/dns/bind_tkey.rb
  • http://www.rapid7.com/db/modules/auxiliary/dos/dns/bind_tkey

CVE-2015-3306 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: ProFTP
• Description: ProFTP is an open-source FTP server. A vulnerability exists within ProFTP. Specifically, it fails to properly restrict access to the SITE CPFR/CPTO commands implemented in the mod_copy.c code, allowing arbitrary use to invoke such commands without authentication. The commands can be leveraged to copy files to arbitrary locations on the filesystem, potentially allowing user controlled binary to be executed under the context of “nobody.”
• Remediation:
  • FEDORA-2015-7086
  • DSA-3263
• More Info: NVD - CVE-2015-3306
• PoC:
  • https://www.exploit-db.com/exploits/36803
  • https://github.com/cdedmondson/Modified-CVE-2015-3306-Exploit
  • https://github.com/t0kx/exploit-CVE-2015-3306

References

This list was scraped from the quite amazing and highly recommended newsletters below:

• ~this week in security~
• Unsupervised Learning
• @RISK
• Hive Five
• Vulnerable U
• tl;dr sec

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.