Threat Library

CVE-2026-47646 is a cross-site scripting (XSS) vulnerability in Microsoft Dynamics 365 Customer Voice that allows an unauthorized, unauthenticated attacker to inject malicious scripts and perform spoofing attacks over a network. With a CVSS score of 9.3, this flaw could enable attackers to impersonate legitimate users or interfaces, potentially harvesting credentials or session data submitted through survey forms.

The Blocksy Companion Pro WordPress plugin (versions before 2.1.47) contains a critical unauthenticated arbitrary file upload vulnerability in its Advanced Reviews and Custom Fonts feature, allowing attackers to achieve remote code execution without any authentication. Exploitation involves bypassing a weak extension validation check using double-extension filenames, enabling attackers to upload and execute malicious PHP web shells. Given the CVSS score of 9.8 and ease of exploitation, this vulnerability poses severe risk to any WordPress site running the affected plugin version.

The WPFunnels WordPress plugin (versions up to 3.12.7) contains a critical unauthenticated RCE vulnerability caused by unsanitized handling of the 'postData' parameter, which allows attackers to inject PHP code into a log file that is later executed via include_once. With a CVSS score of 9.8, this flaw enables full server compromise on any WordPress site running the vulnerable plugin with logging enabled.

Traefik reverse proxy versions prior to v2.11.51, v3.6.22, and v3.7.6 fail to strip underscore-variant identity headers when using BasicAuth, DigestAuth, or ForwardAuth middlewares, allowing attackers to inject spoofed identity or authorization headers that backends normalize as legitimate. This enables authentication bypass and identity spoofing on any route protected by these middlewares, with a maximum CVSS score of 10.0 reflecting trivial exploitability and full compromise potential.

A critical vulnerability (CVSS 9.9) in BeyondTrust Remote Support and Privileged Remote Access allows an authenticated, low-privileged attacker to bypass authorization checks and access data or resources outside their permitted scope. Because these platforms are widely used to broker privileged remote sessions, exploitation could enable lateral movement into sensitive infrastructure, including servers hosting automation and AI agent tooling.

A critical pre-authentication vulnerability in BeyondTrust Remote Support allows unauthenticated attackers to bypass access controls and gain unauthorized access, including to privileged accounts, when a specific authentication configuration is enabled. Given the 9.8 CVSS score and lack of authentication requirement, this flaw is highly likely to be weaponized quickly by opportunistic and targeted threat actors. Organizations using this remote support appliance should treat this as an urgent patching priority.

CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion that can lead to arbitrary code execution in the context of the current user. It has been added to CISA's Known Exploited Vulnerabilities catalog with an aggressive three-day remediation window, indicating active exploitation in the wild.

Joomlack Page Builder, a Joomla CMS extension, contains an improper access control flaw that allows unauthenticated attackers to upload arbitrary files and achieve remote code execution. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a remediation due date of July 10, 2026.

CVE-2026-48908 is an unauthenticated arbitrary file upload vulnerability in JoomShaper SP Page Builder, a popular page-building extension for Joomla CMS. Attackers can upload and execute malicious PHP files without authentication, leading to full remote code execution on affected servers. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild.

A contractor for CISA maintained a public GitHub repository that exposed highly privileged AWS GovCloud credentials and internal CISA build, test, and deployment documentation. This exposure represents a severe operational security failure that could grant attackers deep access into sensitive federal cybersecurity infrastructure. The leak went unaddressed for an extended period before remediation this past weekend.

Threat actors are actively probing internet-facing Gitea Docker deployments to exploit CVE-2026-20896, a critical authentication bypass flaw disclosed just 13 days prior. The vulnerability allows unauthenticated attackers to spoof the X-WEBAUTH-USER header and gain elevated privileges, potentially leading to full repository compromise.

A 16-year-old use-after-free vulnerability in the Linux KVM hypervisor's shared shadow MMU code allows a malicious guest VM to corrupt host kernel memory on both Intel and AMD x86 systems. Tracked as CVE-2026-53359 and dubbed 'Januscape,' the flaw currently has a public proof-of-concept that crashes the host, while the researcher claims a working, unreleased exploit exists that could achieve full guest-to-host escape.

StoneFly Storage Concentrator (SC) and its Virtual Machine variant contain five critical/medium vulnerabilities including hardcoded credentials, two unauthenticated OS command injection flaws leading to root-level remote code execution, an unauthenticated SQL injection exposing session tokens and password hashes, and a reflected XSS. Combined, these flaws allow attackers to fully compromise storage infrastructure without authentication, potentially affecting Defense Industrial Base, Energy, Financial Services, Healthcare, and IT sector organizations worldwide.

A critical SQL injection vulnerability has been identified in Destekz, a product from Raera (Ankara Web Design and Digital Advertising Agency), with a CVSS score of 9.8. The vendor has confirmed the product is no longer supported, meaning no patch will be released, leaving all deployments permanently vulnerable to exploitation.

CVE-2026-14544 is an incomplete fix for the previously patched CVE-2026-8631, leaving an integer overflow in HPLIP's hpcups print-processing path exploitable via specially crafted print jobs. A remote attacker able to submit print data can trigger memory corruption leading to privilege escalation or arbitrary code execution on the host. With a CVSS score of 9.8, this represents a critical, low-complexity threat to any Linux system with HPLIP installed.

The Printcart Web to Print Product Designer plugin for WooCommerce (versions up to 2.5.2) contains a critical vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. Combined with a bypassable nonce mechanism, this flaw could enable deletion of critical files such as wp-config.php, potentially leading to remote code execution and full site compromise.

Microsoft released fixes for nearly 200 vulnerabilities in June 2026, its largest Patch Tuesday to date, with roughly 34 rated critical. Public exploit code exists for at least three of the flaws, creating urgent risk of active exploitation against unpatched Windows systems.

OFFIS DCMTK Toolkit versions <=3.7.0 contain five vulnerabilities including a critical path traversal flaw (CVSS 9.8) allowing malicious DICOM servers to write arbitrary files on clients, plus multiple unauthenticated memory-exhaustion and type-confusion bugs that can crash storescp and worklist server processes. These affect healthcare imaging infrastructure worldwide and could enable file write outside intended directories, cross-department data disclosure, or denial of service against clinical DICOM services. No public exploitation has been reported to CISA as of the advisory date.

Gardyn IoT Hub devices (Home and Studio firmware, Cloud API) contain three vulnerabilities including a critical hard-coded Azure IoT Hub owner key that allows unauthenticated attackers to access connection info and execute arbitrary commands on any connected device. Additional flaws expose device logs via a publicly listable Azure Blob Storage container and allow clickjacking/XSS on the admin panel due to missing security headers. No public exploitation has been reported, and Gardyn has patched server-side infrastructure and recommends firmware/app updates.

CVE-2026-45499 is a critical server-side request forgery (SSRF) vulnerability in Azure OpenAI that allows an authorized attacker to escalate privileges remotely over a network. With a CVSS score of 9.9, exploitation could grant attackers access beyond their intended scope within Azure's OpenAI service infrastructure. This poses significant risk to organizations relying on Azure OpenAI for production workloads, including internal tooling and AI-driven applications.