What you need to know today.

A critical remote code execution vulnerability in Cisco Secure Email Gateway is being actively exploited in the wild, earning it a spot on the CISA Known Exploited Vulnerabilities (KEV) catalog. The flaw, CVE-2026-76461, allows unauthenticated attackers to execute arbitrary commands with root privileges by exploiting a vulnerability in the email parsing component of Cisco AsyncOS Software. Cisco has released patches for this vulnerability, urging customers to apply them immediately. This critical flaw underscores the importance of timely patching for email security appliances, which are often prime targets for attackers seeking to gain initial access to networks.

Apple has released a significant security update addressing numerous vulnerabilities across its operating system, including CVE-2026-65400, which was found to be actively exploited. This authentication issue in macOS Golden Gate, Sequoia, Sonoma, and Tahoe was fixed with improved state management. While the exact impact of the exploit is not fully detailed, reports suggest it could allow network attackers to gain unauthorized access. The update also addresses a total of 273 vulnerabilities across various Apple devices, highlighting the company's ongoing efforts to secure its ecosystem. Users are strongly advised to update their systems to the latest versions to protect against these threats.

A critical vulnerability in the CryptoPayment Gateway WordPress plugin, identified as CVE-2026-81648, allows unauthenticated users to perform administrative operations, including deleting arbitrary files. This flaw affects versions 1.2.1 to 1.2.2 of the plugin due to a missing authorization check on an AJAX endpoint. The vulnerability poses a significant risk to WordPress sites utilizing this plugin, potentially leading to data loss or complete system compromise. Users are urged to update to version 1.2.2 or later immediately to mitigate this risk.

Dell's SmartFabric OS10 Software is affected by a session fixation vulnerability, CVE-2026-63695, which could allow an unauthenticated remote attacker to steal user sessions. This vulnerability impacts versions prior to 10.6.1.3. Session fixation attacks can lead to unauthorized access to systems by hijacking legitimate user sessions. Dell has released version 10.6.1.3 to address this issue, and users are advised to upgrade to this version or a later one to protect their networks.

Multiple critical vulnerabilities have been disclosed in Apache Syncope, a suite of tools for identity and access management. These flaws, including CVE-2026-82431, CVE-2026-73370, CVE-2026-78330, CVE-2026-77181, CVE-2026-77051, CVE-2026-75030, CVE-2026-73668, CVE-2026-73579, CVE-2026-73470, and CVE-2026-86460, span incorrect authorization, privilege assignment, and SQL injection. These vulnerabilities could allow attackers to gain unauthorized access, execute arbitrary code, or manipulate data within Syncope environments. Users are strongly encouraged to consult the Apache Syncope security advisories for specific version information and mitigation steps.

CVE-2026-91998, a critical authorization bypass vulnerability in Casdoor through version 4.4.0, allows attackers to gain unrestricted access to user administration across all organizations by exploiting the /api/mcp endpoint with any application's client credentials. This flaw poses a severe risk to organizations using Casdoor for identity and access management, potentially leading to widespread account compromise. Users should update to a patched version as soon as possible.

A hard-coded JWT signing secret in Crawlab through version 0.6.3, CVE-2026-90945, allows unauthenticated attackers to forge administrator tokens and gain access to administrative functions. This critical vulnerability undermines the security of Crawlab deployments, enabling unauthorized control over the system. The use of hard-coded secrets is a significant security anti-pattern, and users are urged to update to a version that addresses this issue.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a critical arbitrary file write vulnerability, CVE-2026-16338, due to improper validation of file paths. This allows a remote authenticated attacker to overwrite or create arbitrary files on the system, potentially leading to code execution or denial of service. Users of IBM DataStage should apply the necessary patches or updates provided by IBM to mitigate this risk.

CVE-2026-91001, a security flaw in D-Link DI-8400 devices affecting the DDNS configuration component, allows for manipulation of arguments to potentially compromise the device. While the exact impact is not fully detailed, vulnerabilities in network device configurations can often lead to unauthorized access or control. Users of affected D-Link devices should check for firmware updates from the vendor.