What you need to know today.

IBM's Langflow AI platform is under active exploitation, with a critical vulnerability (CVE-2026-9198) allowing unauthenticated remote code execution. Attackers can chain an authentication bypass with code execution to mint SUPERUSER tokens and gain full control of affected instances. This flaw impacts versions 1.0.0 through 1.10.0 and is particularly concerning given the platform's role in AI development. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, urging immediate patching. The exploitability is further highlighted by its inclusion in breach roundups and active attack warnings from multiple security outlets.

A critical arbitrary file upload vulnerability in the Forminator Forms WordPress plugin (CVE-2026-15748) affects all versions up to and including 1.56.1, potentially exposing over 600,000 sites. The flaw stems from insufficient file type validation within the handle_file_upload function, allowing unauthenticated attackers to upload malicious PHP files. This can lead to unauthenticated remote code execution, as reported by Wordfence, SecurityWeek, and The Hacker News. Immediate updates to version 1.56.2 or higher are recommended.

Multiple critical vulnerabilities have been disclosed across various WordPress plugins and themes, including Masteriyo LMS (CVE-2026-73996), Youzify (CVE-2026-73397), Popup by Supsystic (CVE-2026-73380), Ultimate Maps by Supsystic (CVE-2026-73376), Easy Google Maps (CVE-2026-73366), and Sync Post With Other Site (CVE-2026-32463). These flaws range from unauthenticated arbitrary file uploads to PHP object injection and deserialization vulnerabilities, all carrying a high risk score and CVSS of 9.8. While specific exploitation details are limited, the sheer number and nature of these vulnerabilities underscore the need for diligent plugin and theme management within WordPress environments.

Critical vulnerabilities have been identified in Tenable's Security Center, including an unauthenticated command injection flaw (CVE-2026-19682) and an authenticated command injection vulnerability related to file uploads (CVE-2026-19681). Both allow remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the service account. These vulnerabilities pose a significant risk to organizations using Tenable for security management, potentially enabling attackers to compromise critical infrastructure or exfiltrate sensitive data. Prompt patching or mitigation is advised.

Several other critical vulnerabilities have been reported across diverse software, including Trendnet TEW-WLC100 (CVE-2026-75784), RegularLabs Sourcerer (CVE-2026-74253), EFM ipTIME A3004T (CVE-2026-19977), MindsDB Minds Platform (CVE-2026-73678), Seroval (CVE-2026-59940), ArcadeDB (CVE-2026-75851), Mahara (CVE-2026-42164), PbootCMS (CVE-2026-67960), Systerel S2OPC (CVE-2026-67868), and Q CMS (CVE-2026-67854). These vulnerabilities span various categories, including RCE, improper authentication, SQL injection, and heap-based buffer overflows, highlighting the broad attack surface across different technology stacks. Users of these products should consult vendor advisories for specific remediation steps.