DeepSeek Harness Sandbox: CVE-2026-82533 Bypassed Sandbox Restrictions
CVE-2026-82533 in DeepSeek Harness allowed an AI agent to disable file sandbox restrictions through a local API. Fixed versions are available.
Tag vulnerabilities
CISA Adds Critical N-able N-central Flaw to KEV; Hotfix 4 Available
CISA added CVE-2026-86218 in the N-able N-central platform to its catalog of actively exploited vulnerabilities. Hotfix 4 is available for on-premises deployments.
Flaws in FreeIPA and 389 Directory Server Enable Anonymous LDAP Attack
Chaining two vulnerabilities may allow an anonymous attacker on default FreeIPA deployments to create a Kerberos principal of their choice and gain a path to privileged credentials.
Calif Demonstrates WeWorm, a Zero-Click Attack on WeChat Accounts via an Incoming Call
Researchers at Calif demonstrated the WeWorm laboratory attack, which took over a WeChat account through an incoming call without victim interaction. Tencent said it fixed the vulnerability.
CERT Polska Warns of Active Exploitation of MikroTik RouterOS Flaws
CERT Polska has confirmed active attacks against unpatched MikroTik routers with publicly accessible SSH. A chain of flaws allows attackers to gain administrator privileges without standard authentication.
StyleSmuggler in Magento Commerce: Sansec Adds Backdoor Details, Adobe Patch Still Missing
Sansec has published additional technical details about the actively exploited StyleSmuggler vulnerability in Magento Open Source and Adobe Commerce. According to the analysis, the attack can lead to PHP code execution and the deployment of a persistent process on the server.
Broadcom Fixes Critical VMware Workstation and Fusion Flaw
Broadcom released the 26H1u1 update for VMware Workstation and Fusion. It addresses the critical vulnerability CVE-2026-59346, which under specific conditions could allow code execution from a virtual machine on the host.
Google Fixes Actively Exploited V8 Bug in Chrome
Google released a Chrome update fixing the high-severity CVE-2026-85046 vulnerability in V8. CISA has added it to its Known Exploited Vulnerabilities catalog.
Elementor Pro vulnerability is actively exploited—update the WordPress plugin
CVE-2026-32475 in Elementor Pro allows unauthenticated users to upload arbitrary files through a publicly accessible form with a File Upload field. A fix is available in version 4.2.2.
PostGREShell PostgreSQL Vulnerability Analysis: Patches Available
A public analysis of CVE-2026-6471 describes privilege escalation through PostgreSQL logical decoding. Exploitation requires an account with the REPLICATION privilege, and patched versions are available.