cms-security - CyberDilmeth

THREAT WATCH

High Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD): CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability High Microsoft Windows Ancillary Function Driver for WinSock: CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability Critical Metabase CVE-2026-72898 — Metabase SQL Injection Vulnerability Critical Progress LoadMaster: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability Critical JetBrains TeamCity: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Critical IBM Langflow: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability High Apache Tomcat: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability High N-able N-central: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability High Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD): CVE-2026-20349 — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability High Microsoft Windows Ancillary Function Driver for WinSock: CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability Critical Metabase CVE-2026-72898 — Metabase SQL Injection Vulnerability Critical Progress LoadMaster: CVE-2026-8037 — Progress LoadMaster Command Injection Vulnerability Critical JetBrains TeamCity: CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Critical IBM Langflow: CVE-2026-9198 — IBM Langflow Code Injection Vulnerability High Apache Tomcat: CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability High N-able N-central: CVE-2026-18556 — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

14 Aug
2026

WordPress patches a login-screen flaw, and eleven others nobody mentioned

Vulnerability Management

Key takeaways WordPress shipped an emergency security release, 7.0.3, on 6 August. The headline flaw is a scripting vulnerability on the login screen that needs no account to trigger. Researchers demonstrated a chain from that flaw to code execution on the server, but the chain needs a logged-in administrator to interact with an attacker-controlled page. […]