KEV Additions, WordPress Vulns Dominate Security Brief

CISA has added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in JFrog Artifactory, ConnectWise ScreenConnect, and GitLab. The JFrog Artifactory vulnerability (CVE-2026-42016) allows privilege escalation due to improper token scope validation, with attackers chaining multiple flaws to gain administrative control and install backdoors, as reported by The Hacker News. ConnectWise ScreenConnect (CVE-2026-84869) is vulnerable to unauthorized file transfers and execution through active remote sessions. GitLab has addressed a critical path traversal vulnerability (CVE-2026-85706) that allows unauthenticated users to read arbitrary files, which has been observed in the wild since disclosure, as detailed by Cyber Security News. Another GitLab vulnerability (CVE-2026-87719) allows authenticated users with Duo Chat access to obtain Advanced Settings. The catalog also includes a critical vulnerability in Linksys RE7000 (CVE-2026-86299) affecting its PingTest handler.

A wave of critical vulnerabilities has been disclosed across multiple WordPress plugins, with several allowing unauthenticated arbitrary file uploads and remote code execution. The teddy-bear-customize-addon plugin (CVE-2026-14560) and WP images upload on piclect plugin (CVE-2026-84171) fail to properly validate uploaded files, enabling attackers to upload arbitrary files. The Events Calendar plugin (CVE-2026-78006) has a remote code execution flaw via the is_safe_widget_instance function. Additionally, the Masteriyo LMS plugin (CVE-2026-82845) is susceptible to PHP object injection due to deserialization of user-supplied metadata, and the DS Ad Rotator plugin (CVE-2026-81402) lacks proper validation for its image upload handler, allowing PHP file uploads. The Frontegg SAML SSO plugin (CVE-2026-75800) has a critical flaw where it fails to verify SAML authentication response signatures, enabling attackers to log in as any user.

Critical vulnerabilities have been identified in Mistral Vibe, enabling arbitrary file access and code execution. These flaws stem from insufficient path validation for unconditionally allowed commands (CVE-2026-87988), bypasses of command permission checks using environment variable assignments (CVE-2026-87987), unparsed shell constructs (CVE-2026-87986), and improperly inspected ANSI-C quoted arguments (CVE-2026-87985). Separately, Apache's OpenNLP tools contain ambiguous nested quantifiers in their default email and URL name-finder patterns (CVE-2026-82617), which could impact applications using these patterns. Adobe Campaign Classic (ACC) is affected by an OS command injection vulnerability (CVE-2026-82004) that could lead to arbitrary code execution. Flowiseai's Flowise product has an unauthenticated API endpoint (CVE-2026-70478) that could be exploited for credential refresh. GetSimple CMS and its community edition have a logic flaw (CVE-2026-53952) allowing unauthenticated attackers to create new users. Lastly, the WP Component plugin (CVE-2026-85681) allows unauthenticated users to modify options without proper checks.