Current CVEs, vendor advisories, and specific recommendations for addressing critical security vulnerabilities.
Critical vulnerabilities (CVE-2026-28005, CVE-2026-6235, CVSS 9.8) in the WordPress plugins Kadence WooCommerce Email Designer and Sendmachine allow unauthenticated privilege escalation.
Read Article Analysis of the critical vulnerability CVE-2026-66447 (CVSS 9.3) in the WordPress File Upload plugin. Versions <= 5.1.7 are affected. Details and mitigation steps.
Read Article A critical vulnerability (CVE-2026-41452) in Krayin CRM 2.2.4 allows unauthenticated attackers to completely take over the admin account.
Read Article A critical vulnerability (CVE-2026-58066) in Rocket.Chat with a CVSS score of 9.8 allows attackers to take over any account via SAML SSO. Patches are available.
Read Article An advisory for Apache Traffic Server describes seven critical vulnerabilities, including CVE-2026-58150 and CVE-2026-58162 with a CVSS score of 10.0, as well as CVE-2026-58154/58155, with a CVSS score of 9.2. Patches are available.
Read Article Analysis of the critical vulnerability CVE-2026-63227 (CVSS 9.9) in Koollab LMS. An insecure file upload allows remote code execution. A patch is available.
Read Article Critical vulnerabilities (CVE-2026-15014, CVE-2026-8457, CVE-2025-10656, CVSS 9.8; CVE-2026-3141, CVSS 9.1) in WordPress plugins for WooCommerce allow attackers to take over accounts, gain unauthorized access, and delete files.
Read Article Analysis of the critical SQL injection vulnerability CVE-2026-59549 (CVSS 9.3) in the WordPress plugin rtMedia. Versions up to 4.7.10 are affected. Action required for administrators.
Read Article
On July 21, 2026, 15 critical vulnerabilities in SolarWinds Serv-U (CVE-2026-28302) were disclosed. In addition, CVE-2026-16232, CVE-2026-62144, and CVE-2026-62145 (CVSS 9.3) were disclosed. Updates are available.
Read Article Technical Analysis of the Critical Heap Buffer Overflow Vulnerability CVE-2026-42533 in NGINX. Affected Versions, Patches, and Mitigation Measures.
Read Article A critical vulnerability (CVE-2026-63030) in WordPress Core allows unauthenticated remote code execution. Versions up to 7.0.1 are affected. Action is required.
Read Article Analysis of the critical RCE vulnerability CVE-2026-9726 (AlternativeCommerce Basket) and the information leak CVE-2026-10768 (LocalGov Workflows) in Drupal.
Read Article
Microsoft Entra ID is introducing passkeys as the default. At the same time, critical zero-day vulnerabilities were disclosed in SharePoint (CVE-2026-56164), AD FS (CVE-2026-55040, CVSS 9.1), and Exchange (CVE-2026-55008). Updates are available.
Read Article
English 
Deutsch 
Français