What you need to know today.

A critical vulnerability in Lantronix EDS5000 (CVE-2025-67038) is being actively exploited, according to CISA alerts and reporting from The Hacker News and SecurityWeek. The flaw lies within the HTTP RPC module, where a failure to sanitize usernames during log writing allows for shell command execution. This vulnerability poses a significant risk to industrial control systems and network infrastructure managed by Lantronix devices. Patches or specific mitigation strategies should be prioritized for affected systems.

Google Chrome users are urged to update immediately to patch a zero-day vulnerability in the V8 JavaScript engine (CVE-2026-85046), which is actively exploited in the wild. As reported by Help Net Security and The Hacker News, this type confusion flaw allows remote attackers to execute arbitrary code within the browser's sandbox via a crafted HTML page. This marks the sixth Chrome zero-day exploited this year, highlighting the ongoing threat posed by sophisticated attacks targeting widely used browsers.

Microsoft has disclosed several critical vulnerabilities across Azure and Windows products, with CVE-2026-83711 and CVE-2026-70352 enabling privilege escalation through authorization bypass and missing authentication respectively. Additionally, CVE-2026-69502 in Azure SQL Database allows SSRF attacks that can lead to privilege escalation. These flaws, detailed by Vypr Intelligence and SecurityWeek, underscore the critical need for prompt patching of Microsoft services to prevent unauthorized access and potential system compromise.

A batch of 25 vulnerabilities has been disclosed in various WordPress plugins, including critical flaws like CVE-2026-15354 in the ACPT (Premium) plugin, which allows for privilege escalation due to missing authorization checks. Vypr Intelligence also highlights issues in other plugins, such as the Mstore Api plugin (CVE-2026-13447) with an authentication bypass vulnerability. Administrators of WordPress sites should review and apply updates for all installed plugins to mitigate these risks.

Several critical vulnerabilities have been identified in XING CPTrans-ME-X devices, including CVE-2026-70403 (Use of Hard-coded Password), CVE-2026-69657 (Use of Default Password), and CVE-2026-62928 (OS Command Injection). These flaws allow unauthenticated attackers to gain access and execute arbitrary commands, posing a severe risk to the security of networks utilizing these devices. Immediate attention and patching are recommended.

FreeIPMI versions prior to 1.6.19 contain multiple critical stack-based buffer overflow vulnerabilities (CVE-2026-85509, CVE-2026-85508, CVE-2026-85504). These flaws can be triggered by malformed responses from a Baseboard Management Controller (BMC), potentially leading to remote code execution. Users of FreeIPMI should update to version 1.6.19 or later to address these critical security weaknesses.