What you need to know today.
Cisco, Splunk, and OpenEMR disclose critical vulnerabilities, while WordPress plugins face privilege escalation and auth bypass flaws.
Cisco has released patches for a significant number of vulnerabilities across its product lines. Among the critical flaws are multiple issues in Cisco NX-OS (CVE-2026-76455, CVE-2026-76459), Cisco Application Policy Infrastructure Controller (APIC) (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500), and Cisco License On-Prem (CVE-2026-76480, CVE-2026-76482). These vulnerabilities, detailed in advisories from Vypr Intelligence and SecurityWeek, range in severity and impact, with some potentially allowing for remote code execution or privilege escalation. The disclosures highlight Cisco's ongoing efforts in security review and hardening.
Splunk Enterprise is affected by multiple vulnerabilities, including critical ones rated with CVSS 9.8, as reported by Vypr Intelligence. These flaws (CVE-2026-76284, CVE-2026-76285) could lead to remote code execution and privilege escalation, underscoring the need for prompt patching and security updates for Splunk deployments.
OpenEMR, a popular open-source electronic health records system, has several critical vulnerabilities in versions prior to 8.3.0 and 8.4.0. These include an SQL injection flaw in the Fee Sheet drug-inventory lookup (CVE-2026-124469), a broken access control and path traversal vulnerability in the fax/sms module (CVE-2026-124450), and a flaw in the one-time authentication mechanism that fails to properly revoke tokens or enforce usage limits (CVE-2026-124445). These issues could allow authenticated low-privilege users to gain unauthorized access to sensitive data or escalate their privileges.
WordPress sites using the Registration Form for WooCommerce plugin are vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function up to version 1.1.4 (CVE-2026-119075). Additionally, the Naimur Email OTP Verification for WooCommerce plugin has an authentication bypass vulnerability in versions up to 2.1.0 (CVE-2026-104014), and the Radius Booking plugin suffers from a deserialization of untrusted data vulnerability allowing object injection (CVE-2026-119516). These plugin-specific vulnerabilities pose a risk to user accounts and site integrity.
Several other critical vulnerabilities have been disclosed, including a hard-coded credentials flaw in Apeman ID71 firmware (CVE-2025-11126), an SQL injection vulnerability in Tduckcloud v.5.1 (CVE-2025-57631), and a stack overflow vulnerability in Tenda W30E firmware (CVE-2025-57085). These vulnerabilities affect various embedded devices and software, with potential impacts ranging from remote code execution to denial-of-service conditions.