Cisco published security advisories for Secure Email, IOS XR and Nexus 9000. Several vulnerabilities reach a CVSS score of 9.8; at the time of publication, the manufacturer had no evidence of malicious exploitation.
The All-in-One WP Migration and Backup WordPress plugin has fixed vulnerability CVE-2026-19949. Operators should update to version 7.110 or later.
CVE-2026-49869 allows unauthenticated attackers to bypass Basic Auth, create workflows and, under certain conditions, execute commands in the worker. Versions 1.0.45 and 1.3.21 fix the issue.
SonicWall has released fixes for two vulnerabilities in SMA1000 devices and confirmed that they are being actively exploited in the wild. Affected organizations should update their systems and check for possible signs of compromise.
Google and Mozilla released Chrome 152 and Firefox 155 updates. They fix critical and high-severity flaws, including issues involving memory safety, the sandbox and permissions.
CVE-2026-82329 in JFrog Artifactory could grant an unauthenticated attacker administrator privileges under the default configuration. Fixes are now available for self-managed deployments.
SonicWall has confirmed the active exploitation of a critical SSRF flaw and an RCE vulnerability in SMA 1000 Series devices. Hotfixes are available for the affected versions.
The critical CVE-2026-0768 vulnerability in Langflow enables unauthenticated remote execution of Python code with root privileges. According to security media, VulnCheck detected attempts to exploit it.
Microsoft fixed the critical CVE-2026-62911 vulnerability in on-premises versions of Exchange Server. NCSC-NL warns of a publicly available exploit, while Shadowserver recorded 21,899 publicly accessible IP addresses with a fingerprint of vulnerable Exchange Server.
PaperCut confirmed incidents involving the active exploitation of two vulnerabilities in PaperCut NG and MF systems. Organizations should deploy Emergency Patch Release 3, restrict public access, and check for indicators of compromise.
