What you need to know today.
Critical vulnerabilities impact Cisco, Oracle, WordPress plugins, and networking devices, with multiple vendors releasing patches.
A heap-based buffer overflow vulnerability in the rsync daemon, CVE-2024-12084, has been addressed by GitLab in their latest patch release. This flaw arises from improper handling of attacker-controlled checksum lengths, potentially allowing an overflow when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH. The vulnerability was detailed in a GitLab Security Release notice, which also included other patches.
Multiple critical vulnerabilities have been disclosed across various Cisco products, as detailed in recent security advisories. These include CVE-2026-76531, CVE-2026-76302, and CVE-2026-76299, all stemming from a comprehensive internal security review. While specific technical details are limited, these advisories indicate software hardening releases addressing multiple internally discovered issues. SecurityWeek reported on these updates as part of broader security news.
A batch of critical vulnerabilities affecting Apache products, including CVE-2026-105944 in Apache Pulsar Manager, has been disclosed. This specific vulnerability involves improper handling of HTTP authentication credentials, potentially allowing an attacker to bypass security measures when interacting with the Pulsar admin API. Vypr Intelligence noted this coordinated disclosure of 25 vulnerabilities across Apache products, highlighting the potential for significant impact.
Critical vulnerabilities have been identified in several WordPress plugins, including CVE-2026-112241 in SureCart and CVE-2026-111832 in WP Mailster. CVE-2026-112241 allows for authentication abuse due to spoofing, while CVE-2026-111832 involves an unrestricted upload of dangerous file types, enabling the deployment of web shells. Vypr Intelligence reported on these and other WordPress plugin vulnerabilities, emphasizing the critical nature of these flaws.
Oracle has disclosed several critical vulnerabilities in its Fusion Middleware products, including Oracle SOA Suite and Oracle Access Manager. CVE-2026-91231, CVE-2026-91221, CVE-2026-91216, and CVE-2026-87337 all affect versions of Oracle SOA Suite and Oracle Access Manager, with some allowing unauthenticated attackers network access to compromise the systems. Additionally, Oracle Essbase is affected by CVE-2026-91663 and CVE-2026-91658, which allow low-privileged attackers to compromise the product via various network protocols.
Several critical vulnerabilities have been found in Totolink and Comfast devices. CVE-2026-114575, CVE-2026-114383, and CVE-2026-114382 affect Totolink routers and extenders, leading to command injection and stack-based buffer overflows due to improper input validation in various configuration functions. Similarly, CVE-2026-76008 in Comfast devices allows for stack-based buffer overflows through manipulation of URI parameters. Tenda devices are also affected by CVE-2026-114268, a critical buffer overflow vulnerability in the WifiBasicSet function.