Vulnerability (CVE)
Searchlight Cyber disclosed a pre-authenticated remote code execution flaw in WordPress Core, formed by chaining CVE-2026-63030 (REST API batch-route confusion) with CVE-2026-60137 (SQL injection), exploitable anonymously on a standard install with no...
Defused Cyber reported in-the-wild exploitation of CVE-2026-6875, a sandbox escape vulnerability with a CVSS score of 9.5 in the ServiceNow AI Platform that could let an unauthenticated user run arbitrary code, though Defused later corrected its post to...
ServiceNow released patches for four flaws in its AI Platform, three of them rated 10.0 on CVSS and described as exploitable in certain circumstances by an unauthenticated attacker with no privileges and no user interaction required. ServiceNow deployed...