The most featured CVEs in this week’s security newsletters, with public Proof-of-Concepts, ordered by mention count.

For the most up-to-date and accurate info, visit the NIST links. Always audit PoCs thoroughly before running them. I don’t vouch for any links in this list: follow them with caution.

CVE-2026-97631

• Severity: 8.8 HIGH
• Impacted Products: TianoCore EDK II
• Description: TianoCore EDK II is affected by an out-of-bounds write vulnerability in its PXE Base Code driver during network boot operations over IPv4 and IPv6. An unauthenticated network attacker who sends crafted ICMP error messages can corrupt firmware memory prior to the operating system loading.
• Remediation:
  • ALAS2-2026-4047 (important): edk2
  • [ff & rebase] - Backport CVE-2026-97631 from edk2 by spbrogan · Pull Request #1989 · microsoft/mu_basecore
• More Info: NVD - CVE-2026-97631
• PoC:
  • https://github.com/slabbdev/uefi-pxe-cve-2026-97631
  • https://github.com/RayanZiani/Bootjack
  • https://github.com/Try2Take/CVE-2026-97631-PoC

CVE-2026-97229

• Severity: 10.0 CRITICAL
• Impacted Products: GitLab Community Edition (CE) 19.2.0 prior to 19.2.8, GitLab Enterprise Edition (EE) 19.2.0 prior to 19.2.8, GitLab Community Edition (CE) 19.3.0 prior to 19.3.5, GitLab Enterprise Edition (EE) 19.3.0 prior to 19.3.5, GitLab Community Edition (CE) 19.4.0 prior to 19.4.2
• Description: An integer overflow vulnerability exists in the CI/CD regular expression compiler in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2.0 prior to 19.2.8, 19.3.0 prior to 19.3.5, and 19.4.0 prior to 19.4.2. The flaw occurs due to insufficient validation of regular expression repetition quantifiers and compiled bytecode program sizes when processing CI/CD configuration files.
• Remediation:
  • GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 | GitLab Docs
• More Info: NVD - CVE-2026-97229
• PoC:
  • https://github.com/gandli/cve-2026-97229-lab
  • https://github.com/jburgess-r7/CVE-2026-97229-PoC
  • https://github.com/Noshadi-sec/CVE-2026-97229

CVE-2026-115893 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: Wasmtime
• Description: Wasmtime is affected by an insufficient control flow management vulnerability in its Cranelift compiler backend on aarch64 architectures. When compiling a WebAssembly module containing a ‘br_table’ instruction with more than approximately 256,000 targets, the compiler can generate an incorrect conditional branch target, enabling a user-controlled module to escape the runtime sandbox.
• Remediation:
  • Security Fixes for 48.0.7 by pchickey · Pull Request #14819 · bytecodealliance/wasmtime
  • Cranelift/aarch64: fix br_tables with very large target count. by pchickey · Pull Request #14826 · bytecodealliance/wasmtime
  • Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction · Advisory · bytecodealliance/wasmtime · GitHub
• More Info: NVD - CVE-2026-115893
• PoC:
  • https://github.com/shreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escape

CVE-2026-115889 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: Wasmtime
• Description: Wasmtime is affected by a numeric truncation error in its Cranelift compiler backend that can result in sandbox escape and arbitrary code execution. When compiling a WebAssembly function containing an excessive number of Static Single Assignment (SSA) values, bit-packed value indices can silently overflow in release builds and generate corrupted machine code.
• Remediation:
  • Security fixes for release 36.0.19 by pchickey · Pull Request #14818 · bytecodealliance/wasmtime
  • Bit-packing in Cranelift compiler causes silent overflow and miscompilation · Advisory · bytecodealliance/wasmtime · GitHub
• More Info: NVD - CVE-2026-115889
• PoC:
  • https://github.com/ideator-labs/wasmtime-sweep

CVE-2026-111497

• Severity: 8.1 HIGH
• Impacted Products: Google Brotli 1.0.3 through 1.0.9, 1.1.0, 1.2.0, Node.js, Bun
• Description: Google Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0 are affected by an out-of-bounds write vulnerability in the decompression module that can lead to remote code execution. Downstream runtimes, proxies, and applications bundling or linking the library, including Node.js, Bun, Python Brotli packages, Microsoft .NET, Envoy Proxy, Istio, PHP for Windows, and Palo Alto Networks PAN-OS, are exposed to this flaw when decompressing untrusted Brotli data.
• Remediation:
  • CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
  • Important: firefox security update
  • Important: firefox security update
• More Info: NVD - CVE-2026-111497
• PoC:
  • https://github.com/tikarammardi/CVE-2026-111497
  • https://github.com/lesterlam/node2shell
  • https://github.com/dimasma0305/CVE-2026-111497-POC

CVE-2026-110264

• Severity: 10.0 CRITICAL
• Impacted Products: GitLab Community Edition, GitLab Enterprise Edition
• Description: GitLab Community Edition (CE) and Enterprise Edition (EE) contain an integer overflow vulnerability in the bundled Onigmo regular expression engine within Ruby when compiling regular expressions with a large number of range repeat quantifiers. Unauthenticated remote attackers can exploit this flaw by supplying a specially crafted document that triggers excessive range repeat compilation, resulting in an out-of-bounds memory write and arbitrary code execution as the service user.
• Remediation:
  • VuXML: Gitlab – vulnerabilities
  • GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab Docs
• More Info: NVD - CVE-2026-110264
• PoC:
  • https://github.com/googlesky/CVE-2026-110264
  • https://github.com/al4n4n/CVE-2026-110264
  • https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE

CVE-2026-58115 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Siemens SIMATIC IoT2050, Siemens Industrial OS prior to V4.3.4-1
• Description: A missing authentication vulnerability exists in Siemens SIMATIC IoT2050 industrial edge gateways running Siemens Industrial OS prior to V4.3.4-1 when the pre-installed Node-RED runtime is active.
• Remediation:
  • SSA-834709
  • Siemens SIMATIC IoT2050 Advanced
• More Info: NVD - CVE-2026-58115
• PoC:
  • https://github.com/al4n4n/CVE-2026-58115
  • https://github.com/foxcornlab/node-red-scanner

CVE-2026-48356 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Events, Magento Open Source
• Description: Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Events, and Magento Open Source contain an unrestricted upload of file with dangerous type vulnerability in the Guest Cart REST API custom option handler. An unauthenticated remote attacker can upload specially crafted polyglot image-script files without user interaction.
• Remediation:
  • Adobe Security Bulletin
• More Info: NVD - CVE-2026-48356
• PoC:
  • https://github.com/abraxas/CVE-2026-48356
  • https://github.com/Ghost-Bx1/cve-2026-48356-magento-file-upload-rce
  • https://github.com/Cyber-BansalAI/polyshell-2026

CVE-2026-21589

• Severity: Unknown
• Impacted Products: Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center
• Description: Multiple Atlassian products, including Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Jira Service Management Data Center, Jira Software Data Center, Crucible, and Fisheye, are affected by a path traversal vulnerability that permits arbitrary file access. An unauthenticated remote attacker can exploit this flaw to read specific files located within the web application root directory.
• Remediation:
  • CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation
  • [BAM-26567] Arbitrary File Access in Bamboo Data Center - Create and track feature requests for Atlassian products.
  • [BSERV-20604] Arbitrary File Access in Bitbucket Data Center - Create and track feature requests for Atlassian products.
• More Info: NVD - CVE-2026-21589
• PoC:
  • https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit
  • https://github.com/0xBlackash/CVE-2026-21589
  • https://github.com/renzi25031469/CVE-2026-21589

CVE-2026-119977 NEW

• Severity: 8.1 HIGH
• Impacted Products: WordPress Core 4.7, WordPress Core 4.8, WordPress Core 4.9, WordPress Core 5.0, WordPress Core 5.1
• Description: A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability (CWE-367) exists in WordPress Core versions 4.7 through 7.1.3 within the package extraction and upgrade routines in wp-admin/includes/class-wp-upgrader.php (WP_Upgrader::unpack_package()) and wp-admin/includes/update-core.php (update_core()).
• Remediation:
  • WordPress 7.1.4 – WordPress News
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
• More Info: NVD - CVE-2026-119977
• PoC:
  • https://github.com/tc4dy/CVE-2026-119977-Toolkit
  • https://github.com/riabinov/CVE-2026-119977
  • https://github.com/lysophavin18/CVE-2026-119977

CVE-2026-116692 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: LF Projects MLflow
• Description: LF Projects MLflow contains a code injection vulnerability in the Scorer.model_validate() deserialization pipeline that allows attackers to execute arbitrary Python code and operating system commands during scorer object reconstruction.
• Remediation:
  • MLflow v3.17.0 Release Notes
  • Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules · Advisory · mlflow/mlflow · GitHub
• More Info: NVD - CVE-2026-116692
• PoC:
  • https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9
  • https://github.com/foxcornlab/mlflow-scorer-scanner

CVE-2026-114595 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: EPICS Base 7.0.10
• Description: EPICS Base versions through 7.0.10 contain an integer overflow or wraparound vulnerability in the Channel Access server component.
• Remediation:
  • epics-base Pull Request #934: rsrv request bounds validation
  • EPICS Base R7.0.11 Release
  • EPICS 7.0.11 Release Notes
• More Info: NVD - CVE-2026-114595
• PoC:
  • https://github.com/0xredash/CVE-2026-114595
  • https://github.com/ashrafzaryouh/CVE-2026-114595

CVE-2026-110447 NEW

• Severity: 8.1 HIGH
• Impacted Products: Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud < 26.4.303
• Description: Collabora Online - Built-in CODE Server (richdocumentscode) for Nextcloud is affected by an OS command injection vulnerability in versions prior to 26.4.303. An unauthenticated remote attacker can exploit this flaw via crafted HTTP requests to execute arbitrary commands on the host system.
• Remediation:
  • Security issue - Hack · Issue #354 · CollaboraOnline/richdocumentscode
• More Info: NVD - CVE-2026-110447
• PoC:
  • https://github.com/CyRouteWolf/cve-2026-110447-poc
  • https://github.com/Iceman2050/cve-2026-110447-checker
  • https://github.com/maxprog-svg/CVE-2026-110447

CVE-2026-109619

• Severity: 8.1 HIGH
• Impacted Products: PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12, PHP 5.4 through 8.1
• Description: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, as well as legacy unsupported PHP branches from 5.4 through 8.1, contain a cross-request use-after-free vulnerability in worker request lifecycle and global state management across multiple server application programming interfaces (SAPIs), including Apache mod_php and PHP-FPM.
• Remediation:
  • [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 - Security Advisory | Tenable®
  • [R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 - Security Advisory | Tenable®
  • Important: php security update
• More Info: NVD - CVE-2026-109619
• PoC:
  • https://github.com/jeffschafer/Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
  • https://github.com/dev-maple/php2shell-CVE-2026-109619
  • https://github.com/Karasawa2025/php2shell-lab

CVE-2026-109618

• Severity: 8.1 HIGH
• Impacted Products: PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12, PHP 5.4 through 8.1
• Description: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12, as well as legacy unsupported PHP branches from 5.4 through 8.1, contain an Out-of-Memory (OOM) bailout state corruption and Use-After-Free (UAF) / uninitialized pointer dereference vulnerability in the core Zend Engine and extensions.
• Remediation:
  • [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 - Security Advisory | Tenable®
  • [R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 - Security Advisory | Tenable®
  • Important: php security update
• More Info: NVD - CVE-2026-109618
• PoC:
  • https://github.com/delvin-45/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
  • https://github.com/devzyai/CVE-2026-109618-POC
  • https://www.exploit-db.com/exploits/52704

CVE-2026-104935

• Severity: 8.6 HIGH
• Impacted Products: Ivanti Connect Secure 22.8R1, Ivanti Connect Secure 22.8R2.4, Ivanti Connect Secure release 25.1.1 (builds 0 and 1), Ivanti Connect Secure release 25.1.2 (builds 0 through 2)
• Description: Ivanti Connect Secure versions 22.8R1 through 22.8R2.4, release 25.1.1 (builds 0 and 1), and release 25.1.2 (builds 0 through 2) contain an authentication bypass by spoofing (CWE-290) and a time-of-check time-of-use race condition (CWE-362) in the legacy CGI web request routing and Windows File Share archive upload handler that allow an unauthenticated remote attacker to execute arbitrary code as the unprivileged cgi-server (nr) user.
• Remediation:
  • Security Advisory Ivanti Connect Secure (CVE-2026-104935)
  • Ivanti Connect Secure welcome.cgi and wu.cgi Authentication Bypass and Race Condition Remote Code Execution Vulnerability
• More Info: NVD - CVE-2026-104935
• PoC:
  • https://github.com/maxprog-svg/CVE-2026-104935
  • https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept
  • https://github.com/0x45dd/ivanti-cve-2026-104935-check

CVE-2026-104286

• Severity: 9.8 CRITICAL
• Impacted Products: Fortinet FortiMail
• Description: Fortinet FortiMail contains an improper limitation of a pathname to a restricted directory (path traversal) and null byte injection vulnerability in the webmail Identity-Based Encryption (IBE) service.
• Remediation:
  • PSIRT | FortiGuard Labs
• More Info: NVD - CVE-2026-104286
• PoC:
  • https://github.com/kh20134/fortimail-cve-2026-104286-response
  • https://github.com/maxprog-svg/CVE-2026-104286
  • https://github.com/techupdate24/fortimail-zero-day-cve-2026-104286

CVE-2021-44228

• Severity: 10.0 CRITICAL
• Impacted Products: Apache Log4j2 <=2.14.1
• Description: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default.
• Remediation:
  • Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021
  • IBM Planning Analytics 2.0: Apache log4j Vulnerability (CVE-2021-44228)
  • 6525706
• More Info: NVD - CVE-2021-44228
• PoC:
  • https://github.com/kaleth4/CVE-2021-44228
  • https://packetstormsecurity.com/files/167917/mobileiron_core_log4shell.rb.txt
  • https://github.com/Muskann02/cve-2021-44228-lab

CVE-2015-5477

• Severity: 7.5 HIGH
• Impacted Products: BIND 9.9.7, BIND 9.9.8, BIND 9.10.0, BIND 9.10.1, BIND 9.10.2
• Description: ISC Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an open-source reference implementation of the major components of the Domain Name System. A vulnerability exists due to incorrect handling of TKEY queries. This could trigger a REQUIRE assertion failure, resulting named to exit, causing a DoS.
• Remediation:
  • 1966274
  • c04769567
  • Hewlett Packard Enterprise
• More Info: NVD - CVE-2015-5477
• PoC:
  • https://www.exploit-db.com/exploits/37721
  • https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/dos/dns/bind_tkey.rb
  • http://www.rapid7.com/db/modules/auxiliary/dos/dns/bind_tkey

CVE-2026-98432

• Severity: 9.8 CRITICAL
• Impacted Products: Linux kernel
• Description: The Linux kernel is affected by a use-after-free vulnerability in its IPv4 networking subsystem. A race condition during the concurrent handling of TCP connection requests or request socket migration allows socket options to be deallocated while still referenced by another processing thread.
• Remediation:
  • Important: kernel security, bug fix, and enhancement update
  • Important: kernel security, bug fix, and enhancement update
  • Critical: kernel security update
• More Info: NVD - CVE-2026-98432
• PoC:
  • https://github.com/antonyantony/cve-2026-98432-nft
  • https://github.com/c4dt/ubuntu-cve-2026
  • https://github.com/AronWang001/linux-cve-2026-98432-fix

CVE-2026-83844 NEW

• Severity: 8.1 HIGH
• Impacted Products: Microsoft Paint
• Description: Microsoft Paint is affected by an out-of-bounds read vulnerability that allows a remote attacker to achieve arbitrary code execution. The flaw exists due to improper boundary validation when handling input data.
• Remediation:
  • Windows Paint Remote Code Execution Vulnerability
• More Info: NVD - CVE-2026-83844
• PoC:
  • https://github.com/LACHHAB-Anas/CVE-2026-83844
  • https://github.com/LilPoule/CVE-2026-83844
  • https://github.com/0xBlackash/CVE-2026-83844

CVE-2026-93680 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: IBM Langflow OSS 1.0.0 through 1.12.8
• Description: IBM Langflow OSS 1.0.0 through 1.12.8 contains an improper authentication vulnerability (CWE-287) in its automatic login configuration and Model Context Protocol (MCP) server authentication handling that allows an unauthenticated remote attacker to bypass authentication and execute arbitrary operations or MCP tools with superuser privileges.
• Remediation:
  • Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
  • fix: mcp auth and project auth handling (#14643)
  • fix: disable LANGFLOW_AUTO_LOGIN by default (#14993)
• More Info: NVD - CVE-2026-93680
• PoC:
  • https://github.com/rmhowe425/POC-CVE-2026-93680

CVE-2026-84295 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: Progress Software WS_FTP Server prior to 2024.0.6, Progress Software WS_FTP Server 2025.0.x prior to 2025.0.3
• Description: Progress Software WS_FTP Server prior to 2024.0.6 and 2025.0.x prior to 2025.0.3 on Windows contains an improper authentication vulnerability (CWE-287). The flaw occurs due to improper authentication validation in the server management and authentication handling components, which fails to properly restrict unauthenticated network requests from accessing protected credential data.
• Remediation:
  • Progress WS_FTP Server Security Advisory (CVE-2026-84295)
• More Info: NVD - CVE-2026-84295
• PoC:
  • https://github.com/foxcornlab/wsftp-server-scanner

CVE-2026-113263 NEW

• Severity: 9.6 CRITICAL
• Impacted Products: Google Chrome on Android
• Description: Google Chrome on Android is affected by a use-after-free vulnerability within its Core component that allows for arbitrary code execution. A remote attacker can trigger this condition by enticing a user to visit a specially crafted HTML page.
• Remediation:
  • [SECURITY] [DSA 6577-1] chromium security update
  • Chrome Releases: Stable Channel Update for Desktop
• More Info: NVD - CVE-2026-113263
• PoC:
  • https://issues.chromium.org/issues/497026542

CVE-2026-110186 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: IBM Langflow OSS 1.0.0 through 1.12.8, IBM Langflow OSS 1.13.0
• Description: A code injection vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.12.8. The flaw resides in the flow input schema derivation helper (_get_flow_input_nodes and json_schema_from_flow in src/backend/base/langflow/helpers/flow.py), which constructs flow graphs via Graph.from_payload with component instantiation enabled by default when handling Model Context Protocol (MCP) tool enumeration (tools/list) and Agent-to-Agent (A2A) discovery requests.
• Remediation:
  • Security Bulletin: IBM Langflow OSS is vulnerable to arbitrary code execution (CVE-2026-110186)
  • fix(mcp): derive flow input schemas without running stored component code (#15660)
• More Info: NVD - CVE-2026-110186
• PoC:
  • https://github.com/al4n4n/CVE-2026-110186

CVE-2026-107329 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: IBM Langflow OSS 1.0.0, IBM Langflow OSS 1.12.4
• Description: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
• Remediation:
  • Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
• More Info: NVD - CVE-2026-107329
• PoC:
  • https://github.com/rmhowe425/POC-CVE-2026-107329

CVE-2026-107328 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: IBM Langflow OSS 1.0.0, IBM Langflow OSS 1.12.4
• Description: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.
• Remediation:
  • Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
• More Info: NVD - CVE-2026-107328
• PoC:
  • https://github.com/rmhowe425/POC-CVE-2026-107328

CVE-2026-107327 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: IBM Langflow OSS 1.0.0, IBM Langflow OSS 1.12.4
• Description: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
• Remediation:
  • Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
• More Info: NVD - CVE-2026-107327
• PoC:
  • https://github.com/rmhowe425/POC-CVE-2026-107327

Wildcards

Not featured in this week’s newsletters: recently disclosed high/critical CVEs that already have a public Proof-of-Concept.

CVE-2026-118423 NEW

• Severity: 10.0 CRITICAL
• Impacted Products: WP Libre Form WordPress plugin 1.5.0.1
• Description: The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-118423
• PoC:
  • https://github.com/im0xfay/CVE-2026-118423
  • https://github.com/thiscitze/cve-2026-118423-poc
  • https://github.com/Sable-Research/CVE-2026-118423-WP-Libre-Form

CVE-2026-114612 NEW

• Severity: 9.9 CRITICAL
• Impacted Products: LiteLLM 1.87.0-1.90.x, LiteLLM 1.100.4, LiteLLM 1.101.3, LiteLLM 1.102.2, LiteLLM 1.103.1
• Description: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-114612
• PoC:
  • https://github.com/FORTBRIDGE-UK/CVEs

CVE-2026-83542 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Apache OFBiz prior to 24.09.08
• Description: Apache OFBiz prior to 24.09.08 contains a code injection vulnerability in its request attribute binding and screen widget rendering subsystem. An unauthenticated remote attacker can override the application decorator location via a JSON request body and load crafted widget XML from a live multipart upload file descriptor to execute arbitrary Groovy expressions on the server.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-83542
• PoC:
  • https://github.com/Crypto-Cat/apache-ofbiz-2026-pocs
  • https://github.com/foxcornlab/ofbiz-scanner

CVE-2026-6023 NEW

• Severity: 8.1 HIGH
• Impacted Products: In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421
• Description: In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.
• Remediation:
  • Telerik Web Forms Deserialization of Untrusted Data Vulnerability (CVE-2026-6023) - Telerik UI for ASP.NET AJAX
• More Info: NVD - CVE-2026-6023
• PoC:
  • https://github.com/kjry8sb/CVE-2026-6023

CVE-2026-120209 NEW

• Severity: 9.8 CRITICAL
• Impacted Products: Anji-Plus AJ-Report 1.7.1
• Description: An authentication bypass and code injection vulnerability exists in Anji-Plus AJ-Report through version 1.7.1. The flaw stems from the use of a hard-coded HS256 signing secret (JWT_SECRET = "aj-report") in JwtUtil.java combined with permissive substring matching of the JWT reportCode claim against the request URI inside TokenFilter.java when validating the Share-Token HTTP request header.
• Remediation: Follow vendor security advisories and apply the latest patches. Review affected systems and prioritize patching based on exploitability and business impact.
• More Info: NVD - CVE-2026-120209
• PoC:
  • https://github.com/Nxploited/CVE-2026-120209

References

This list was scraped from the quite amazing and highly recommended newsletters below:

• ~this week in security~
• Unsupervised Learning
• @RISK
• Hive Five
• Vulnerable U
• tl;dr sec

Thanks for reading! For corrections, omissions (e.g. newsletter recs) feel free to get in touch.