What you need to know today.
GitLab patched critical RCE, Adobe ColdFusion faces multiple critical flaws, and NetApp systems impacted by kernel and OpenSSL bugs.
A critical vulnerability in GitLab CE/EE, patched in versions 19.2.8, 19.3.5, and 19.4.2, could allow unauthenticated users to execute arbitrary code. This flaw, identified as CVE-2026-97229, arises from an issue in the regular expression compiler under specific conditions. Exploitation could lead to significant system compromise, and multiple security outlets, including Rapid7 and The Hacker News, have highlighted the urgency for administrators to apply the patches. The vulnerability has been a significant focus for security teams due to its potential for widespread impact.
Multiple critical vulnerabilities have been disclosed in Adobe ColdFusion, with CVE-2026-106624 detailing a code injection flaw leading to arbitrary code execution. CVE-2026-106622 presents a server-side request forgery (SSRF) that could escalate privileges, while CVE-2026-105899 allows arbitrary code execution through unrestricted file uploads of dangerous types. These issues affect the ColdFusion platform and could be exploited by attackers to gain control over affected systems.
NetApp systems are impacted by several high-severity vulnerabilities. CVE-2021-22555, a heap out-of-bounds write in the Linux kernel's netfilter component, allows for privilege escalation or denial-of-service attacks. Additionally, a critical bug in OpenSSL 3.0.4, CVE-2022-2274, affects RSA implementations on specific x86_64 CPUs with AVX512IFMA instructions, potentially leading to incorrect private key handling. Python 3.x through 3.9.1 also has a buffer overflow vulnerability, CVE-2021-3177, in _ctypes/callproc.c, which could lead to remote code execution when processing untrusted floating-point numbers.
Several critical vulnerabilities have been identified across various embedded devices and software. CVE-2026-107594 affects the File Upload to Order WordPress plugin, allowing unauthenticated attackers to delete arbitrary files. CVE-2026-90532 in Adobe Experience Manager could lead to arbitrary code execution due to an authorization flaw. Furthermore, CVE-2026-109109 in Wavlink WL-WN530BE1-A and CVE-2026-108917 in Edimax BR-6208AC present command injection risks through their respective CGI components. CVE-2026-108576 in TOZED X300 also allows OS command injection via its IPPingDiagnostics Handler.
SQLite versions 3.6.0 through 3.27.2 are vulnerable to a heap out-of-bound read in the rtreenode() function, identified as CVE-2019-8457. This flaw can be triggered by handling invalid rtree tables and could lead to data corruption or system instability. CISA has flagged this vulnerability in advisories related to ABB B&R Automation Studio, indicating potential impact in industrial control systems.
A critical SQL injection vulnerability, CVE-2026-108065, has been found in Channel Software WebAlliance eCommerce. This flaw in the SOAP GetUser method allows unauthenticated remote attackers to access, modify, or potentially execute commands on the system. The vulnerability resides in the /preapproval.asmx endpoint and poses a significant risk to data integrity and system security.