Vulnerability (CVE)
Searchlight Cyber disclosed a pre-authenticated remote code execution flaw in WordPress Core, formed by chaining CVE-2026-63030 (REST API batch-route confusion) with CVE-2026-60137 (SQL injection), exploitable anonymously on a standard install with no...
F5 patched a critical nginx heap buffer overflow, CVE-2026-42533, on July 15 in nginx 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1, with every version from 0.9.6 through 1.31.2 vulnerable. The flaw sits in nginx's two-pass script engine: a regex-based map...
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, including three memory bugs F5 says could crash a worker process or possibly allow code execution, a TLS flaw that could let an attacker forge a session past...