Cisco published security advisories for Secure Email, IOS XR, and Nexus 9000. Several vulnerabilities have a CVSS score of 9.8; at the time of publication, the vendor had no evidence of malicious exploitation.
The All-in-One WP Migration and Backup WordPress plugin has fixed the CVE-2026-19949 vulnerability. Operators should update to version 7.110 or later.
The CVE-2026-49869 flaw allows attackers to bypass Basic Auth without logging in, create workflows and, under certain conditions, execute commands in the worker. Versions 1.0.45 and 1.3.21 contain fixes.
SonicWall has released fixes for two vulnerabilities in SMA1000 devices, confirming that they are being actively exploited in the wild. Affected organizations should update their systems and check for possible signs of compromise.
Google and Mozilla released Chrome 152 and Firefox 155 updates. They fix critical and high-severity flaws, including memory safety, sandbox, and permission issues.
CVE-2026-82329 in JFrog Artifactory could give an unauthenticated attacker administrator privileges under the default configuration. Patches are now available for self-managed deployments.
SonicWall confirmed the active exploitation of a critical SSRF flaw and an RCE vulnerability in SMA 1000 Series devices. Hotfixes are available for the affected versions.
The critical CVE-2026-0768 vulnerability in Langflow allows unauthenticated remote execution of Python code with root privileges. According to security media, VulnCheck recorded attempts to exploit it.
Microsoft fixed the critical CVE-2026-62911 vulnerability in on-premises versions of Exchange Server. NCSC-NL warns of a publicly available exploit, while Shadowserver recorded 21,899 publicly accessible IP addresses with a fingerprint of a vulnerable Exchange Server.
PaperCut confirmed incidents involving the active exploitation of two vulnerabilities in PaperCut NG and MF systems. Organizations should deploy Emergency Patch Release 3, restrict public access, and check for indicators of compromise.