What you need to know today.

The Linux kernel's handling of zero-length TLS records in the rx_list has been fixed, addressing CVE-2025-39682. This vulnerability, rated Critical with a CVSS score of 9.8, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The flaw could allow for privilege escalation, and its inclusion in the KEV catalog indicates active exploitation in the wild. The fix ensures that each recvmsg() call correctly processes either contiguous DATA records or a single non-DATA record, preventing potential security issues. As reported by Cyber Security News and The Hacker News, this addresses a critical security concern for Linux systems.

A critical buffer overflow vulnerability (CVE-2026-93741, CVSS 10.0) has been identified in Totolink A3002MU routers. The flaw resides in the formWlWds function and can be triggered by manipulating the 'submit-url' argument, potentially leading to remote code execution. This vulnerability, along with two others in the same product family (CVE-2026-93740 and CVE-2026-93739), highlights a significant risk for users of Totolink devices. The affected file is /boafrm/formWlWds.

IBM MQ Appliance is affected by a critical heap buffer overflow vulnerability (CVE-2026-10747, CVSS 10.0) in its protocol message processing before authentication. This flaw could allow an unauthenticated remote attacker to cause a denial of service or potentially execute arbitrary code on the appliance. The vulnerability poses a significant risk to the confidentiality and integrity of data processed by IBM MQ Appliance.

Microsoft is addressing multiple critical vulnerabilities across its Azure services. CVE-2026-69843 in Microsoft Fabric allows for authentication bypass and privilege escalation. In Azure Billing, CVE-2026-62874 enables privilege escalation due to insufficient data authenticity verification. Furthermore, Azure AI Foundry has a critical vulnerability (CVE-2026-85889, CVSS 10.0) in its authentication for critical functions, also leading to privilege escalation, as detailed by Cyber Security News and The Hacker News. Azure Logic Apps is impacted by improper access control (CVE-2026-83944) and path traversal vulnerabilities (CVE-2026-70200), both allowing for privilege escalation.

WordPress sites are facing multiple critical vulnerabilities. The Migratico Lite plugin, versions up to 2.6.8, suffers from an unauthenticated remote code execution flaw (CVE-2026-62104). Additionally, the Botiga Pro plugin (before 1.6.5) has a REST route vulnerability (CVE-2026-86591) that allows unauthenticated users to update arbitrary WordPress options, potentially leading to privilege escalation. The Gravity Forms plugin, in all versions up to 3.1.0.4, is vulnerable to arbitrary file uploads via its upload_file function (CVE-2026-84434).

Several other critical vulnerabilities have been disclosed, including a server-side request forgery (SSRF) in Altium Enterprise Server's UnifiedLogin service (CVE-2026-92808), an easily exploitable vulnerability in Oracle Hyperion Financial Management (CVE-2026-87230), and a Chef Automate API gateway vulnerability (CVE-2026-80462) that could allow unauthenticated actors elevated access. Openpanel Dev's js-runtime has a sandbox escape vulnerability (CVE-2026-93985) in its webhook template validator.