What you need to know today.
Actively exploited critical vulnerabilities impact IBM Aspera Faspex, SignalWire FreeSWITCH, Siemens IoT2050, and Ivanti Endpoint Manager, among others.
IBM Aspera Faspex versions 5.0.0 through 5.0.19 are affected by CVE-2026-123218, a critical vulnerability that allows authorized users to bypass authorization controls and gain full administrative privileges through crafted messages. This flaw has been actively exploited, as reported by Cyber Security News and The Hacker News.
SignalWire FreeSWITCH versions prior to 1.11.3 contain a critical vulnerability (CVE-2026-116779) in the sofia_presence_handle_sip_i_message() function. This flaw, also actively exploited according to SecurityWeek and The Hacker News, could lead to security compromises. Additionally, CVE-2026-102895 in GPUStack versions prior to 2.2.0, which allows loopback requests to be treated as administrator actions, is also being exploited, as noted by The Hacker News and CISA.
A critical vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced, particularly when running Industrial OS with Node-RED, has been actively exploited to deploy Linux bots and backdoors. This flaw affects all versions prior to V4.3.4-1. News outlets including The Hacker News and The Register Security have reported on the exploitation of this vulnerability, which is also detailed in a CISA ICS Advisory.
Ivanti Endpoint Manager and related products are impacted by several vulnerabilities, including CVE-2026-121653, a critical SQL injection flaw that can lead to remote code execution. This vulnerability, along with others in Ivanti products, has been patched, as reported by Cyber Security News.
Several critical vulnerabilities have been disclosed in D-Link M60 (CVE-2026-125086), Geovision GV-Face (CVE-2026-124600), WidzialniCMS (CVE-2026-110469 and CVE-2026-110468), WordPress Confection plugin (CVE-2026-115252), FoundTL CF-WR632AX (CVE-2026-122013), and various Linksys devices (CVE-2026-121933, CVE-2026-121932, CVE-2026-121615), Qihoo 360 routers (CVE-2026-121609, CVE-2026-121607), and Oracle Platform Security for Java (CVE-2026-83020). These vulnerabilities range from hard-coded credentials and unencrypted data transmission to OS command injection and authentication bypass.