CVE-2026-49869 allows unauthenticated attackers to bypass Basic Auth, create workflows and, under certain conditions, execute commands in the worker. Versions 1.0.45 and 1.3.21 fix the issue.
CISA added CVE-2026-9586 in Sangoma Switchvox SMB to the Known Exploited Vulnerabilities catalog. The unauthenticated SQL injection could lead to remote code execution; a fix has been available since July.
PaperCut confirmed incidents involving the active exploitation of two vulnerabilities in PaperCut NG and MF systems. Organizations should deploy Emergency Patch Release 3, restrict public access, and check for indicators of compromise.
On August 27, 2026, CISA added CVE-2026-66384 in JFrog Artifactory to the KEV catalog. Operators of self-hosted instances should verify their version and deploy available patches.
CISA added CVE-2026-8452 in NetScaler ADC and NetScaler Gateway products to its Known Exploited Vulnerabilities catalog. U.S. federal civilian agencies must update the devices by August 29, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2023-49105 vulnerability in ownCloud Server to its Known Exploited Vulnerabilities catalog. Unpatched instances may expose user files to unauthorized reading, modification, or deletion.
