What you need to know today.
Progress LoadMaster RCE flaw hits CISA KEV; Microsoft patches critical auth bypasses; WordPress plugins vulnerable.
Progress Kemp LoadMaster products are affected by a critical OS command injection vulnerability, CVE-2026-8037, which has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This flaw allows unauthenticated attackers to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. The vulnerability has seen significant exploitation attempts, with reports indicating hundreds of such attempts. Progress has released patches to address this critical security issue, and users are strongly advised to update their systems immediately to mitigate the risk of compromise. As detailed by The Hacker News, this vulnerability poses a severe threat due to its pre-authentication nature and remote code execution capabilities.
A significant number of critical vulnerabilities have been disclosed affecting Microsoft products, primarily related to authorization and authentication flaws. These include privilege escalation vulnerabilities in Microsoft Teams (CVE-2026-65667), Azure SQL Database (CVE-2026-56162), Azure Key Vault (CVE-2026-62825), Azure DNS (CVE-2026-58275), Microsoft 365 Admin Center (CVE-2026-62873), Azure SRE Agent (CVE-2026-62830), Microsoft Entra Provisioning Service (CVE-2026-59115), and Azure Active Directory (CVE-2026-50481). Additionally, a deserialization of untrusted data vulnerability in Azure Service Bus (CVE-2026-50515) could allow for code execution. Microsoft has released security updates to address these issues, as noted by SecurityWeek.
Several critical vulnerabilities have been identified in WordPress plugins, including an authorization bypass in the AI Copilot – Content Generator plugin (CVE-2026-14526) and a PHP Object Injection vulnerability in the Ajax Search Lite plugin (CVE-2026-16258). The WP Events Manager plugin is also affected by a vulnerability (CVE-2026-14205) that allows authenticated users to create free paid events by manipulating quantity calculations. These flaws highlight the ongoing risks associated with third-party plugins in WordPress environments, emphasizing the need for prompt patching and security audits.
Other notable vulnerabilities include an improper privilege management flaw in Plesk's XML-RPC API (CVE-2026-64637), which could allow a reseller to gain administrative access. Fanwei Weaver E-cology 9.0 (CVE-2022-4995) is susceptible to a file upload vulnerability enabling remote attackers to upload arbitrary files. DataLinkDC's Dinky (CVE-2026-70558) has a handler that passes caller-supplied paths directly to file operations without validation. Flowise through 3.1.4 (CVE-2026-67622) contains an insecure direct object reference in its OpenAI Assistants integration, and OpenReception's appointment booking software (CVE-2026-48087) has an issue in its registration handler. Lastly, WGDashboard (CVE-2026-15734) suffers from a Server-Side Template Injection vulnerability allowing authenticated attackers to execute arbitrary code.