Attackers are mass-exploiting the WordPress plugin Super Forms: a critical upload flaw (CVE-2026-14894, CVSS 9.8) lets them plant webshells. Wordfence blocked over 250,000 attempts, and a patch is available.
Google is shipping an emergency Chrome update that closes an already actively exploited type-confusion flaw in the V8 engine. Users should update their browser right away.
An unauthenticated local file inclusion bug in the Divi Ajax Filter WordPress plugin lets remote attackers run PHP code. Divi Engine ships a fix in version 5.1.3.
The CVE-2026-6471 flaw turns a plain replication account into code execution, permanent superuser rights and a persistent database backdoor. Patches are already available.
A critical flaw in the popular AI proxy LiteLLM lets attackers forge a valid MCP session without a real key. CISA reports active exploitation and sets a deadline.
OpenVPN 2.7.7 fixes seven CVE-tracked vulnerabilities, hardens Netlink communication on Linux and adds several networking fixes. Most of the flaws affect Windows components.
Attackers abuse a form-upload flaw in Elementor Pro to plant PHP webshells and take over WordPress sites. Wordfence blocked nearly 190,000 attempts. Updating to 4.2.2 is mandatory.
An authentication bypass in the Kestra workflow tool hands unauthenticated attackers code execution as root. CISA added CVE-2026-49869 to its exploited-vulnerabilities catalog on September 2.
A CVSS 9.8 authentication flaw in self-hosted JFrog Artifactory lets unauthenticated attackers gain admin rights. CISA added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog on September 2, 2026.
SonicWall warns of two flaws in its SMA 1000 appliances that, when chained, allow unauthenticated code execution. The vendor confirms active attacks – patch now.
