What you need to know today.

A critical out-of-bounds write vulnerability in Fortinet FortiOS, affecting versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, and all versions of 6.0, has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This flaw, identified as CVE-2024-21762, carries a CVSS score of 9.8 and has an exploit prediction score of 0.83, indicating a high likelihood of exploitation. Reports suggest this vulnerability has been actively exploited in attacks against broadband providers, with threat actors leveraging it for initial access and to deploy malware like MeshCentral for further network compromise. As detailed by Cyber Security News and SecurityWeek, this vulnerability allows for remote code execution, posing a significant risk to organizations relying on these Fortinet products.

GitLab has released critical patches for a long-standing vulnerability (CVE-2026-110264) that allows unauthenticated remote code execution. This flaw, present in versions from 7.0 up to the latest releases across multiple 18.x and 19.x branches, has a CVSS score of 10.0 and was reportedly present for over 12 years. The vulnerability stems from issues within Ruby's regular expression engine, which could be triggered under specific conditions to achieve code execution. As highlighted by The Hacker News and The Register, the widespread impact and extended period of exposure make this a high-priority update for all GitLab users. GitLab has provided specific patch versions, including 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, to address this critical vulnerability.

A batch of five critical vulnerabilities (CVE-2026-111812, CVE-2026-111813, CVE-2026-111814, CVE-2026-111815) has been disclosed in Apache Traffic Server, a popular caching proxy. These flaws, all carrying a CVSS score of 10.0, impact versions from 8.0.0 through 8.1.11 and 9.0.0 onwards. The vulnerabilities include issues with TLS session resumption across SNI hosts without proper client certificate re-verification (CVE-2026-111815), reuse of pooled TLS sessions authenticated with one certificate for transactions requiring a different one (CVE-2026-111814), and the origin_server_auth plugin allowing clients to force signing of AWS request headers with the proxy's credentials (CVE-2026-111812). Additionally, an experimental magick plugin (CVE-2026-111813) allows unauthenticated clients to control ImageMagick convert arguments. Vypr Intelligence reported on these disclosures, emphasizing the potential for remote code execution and unauthorized access.

Oracle has addressed a significant number of vulnerabilities across its product lines, with a particular focus on JD Edwards EnterpriseOne (CVE-2026-91299), E-Business Suite (CVE-2026-101809), Hyperion Financial Management (CVE-2026-70921), Hyperion Data Relationship Management (CVE-2026-70880), and Fusion Middleware's OID LDAP Server (CVE-2026-61241). Many of these are critical, easily exploitable vulnerabilities allowing unauthenticated attackers network access. For instance, CVE-2026-101809 in the Workflow Notification Mailer component of E-Business Suite (versions 12.2.3-12.2.15) and CVE-2026-61241 in the OID LDAP Server (versions 12.2.1.4.0 and 14.1.2.1.0) are rated with CVSS 10.0. Cyber Security News noted the sheer volume of patches, including a critical vulnerability in WebLogic.

Several critical vulnerabilities have been identified in WordPress plugins and themes, including unauthenticated RCE in WP Compress (CVE-2026-73343) and Regular Labs Sourcerer (CVE-2026-74253), as well as deserialization vulnerabilities leading to object injection in ThemeREX Group Little Birdies (CVE-2026-112859), axiomthemes Rhodos (CVE-2026-112858), and axiomthemes Reprizo (CVE-2026-112857). These flaws, with CVSS scores up to 10.0 and 9.8, pose a significant risk to WordPress sites. The Wordfence Blog (https://www.wordfence.com/blog/2026/08/wordfence-intelligence-weekly-wordpress-vulnerability-report-august-17-2026-to-august-23-2026/) highlighted some of these issues, emphasizing the need for prompt updates to affected plugins and themes to prevent exploitation.

YOOtheme Pro, a Joomla extension, has a critical unauthenticated remote code execution vulnerability (CVE-2026-102785) in its image transformation handler, affecting versions 5.0.0 through 5.0.52. This flaw arises from incomplete binding of normalized image operations and output destinations, allowing attackers to execute arbitrary code. Additionally, critical vulnerabilities have been found in TRENDnet TEW-WLC100 (CVE-2026-75784) related to HTTP header handling and Seetong devices (CVE-2026-100886) due to improper authentication in their debug service. DrayTek Vigor2960 (CVE-2026-113390) also faces a critical CGI interface flaw. These vulnerabilities, with CVSS scores up to 10.0, highlight widespread risks in web-facing applications and embedded devices.