Critical vulnerability intelligence.

Critical· 9.8<1% likelyfix available

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login incorrectly disabled signature verification for ID tokens, allowing an attacker to present a forged or unsigned token and authenticate as any user, including administrators. This flaw affects apache-airflow-providers-fab versions prior to 3.7.3. Upgrading to version 3.7.3 or later restores proper signature verification and mitigates the issue.

published 1d agodeletes in 30d

CVE-2026-58179

A stack overflow in Apache Traffic Server’s regex_remap plugin can be triggered by malformed substitution input, allowing attackers to run arbitrary code. The flaw exists in several major releases and can be fixed by upgrading to the latest patched versions.

CVE-2026-58161

Apache Traffic Server is vulnerable to crashes caused by null dereferences and dangling references in TLS and SNI handling. The flaw can cause the server to crash, potentially leading to denial of service. Affected versions include 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

CVE-2025-10656

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress has a critical flaw that lets anyone create administrator accounts without logging in. This could give attackers full control over the WordPress site. The vulnerability exists in all versions up to 2.4.37.

Critical· 9.8<1% likely

CVE-2026-58155

Apache Traffic Server can truncate very long header names, which lets attackers create duplicate headers, smuggle requests, and bypass security policies. This flaw exists in versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Upgrading to 9.2.15 or 10.1.4 removes the vulnerability.

CVE-2026-58154

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers, which can cause serious problems. The issue affects several major releases of the software. Users should upgrade to a fixed version.

CVE-2026-18191

The VIN‑DS783E‑E6 device from Vacron contains a hidden function that can be triggered by anyone on the network. An attacker can use this to retrieve the administrator password without needing any credentials. This gives the attacker full control over the device.

Critical· 9.3<1% likely

CVE-2026-63234

A vulnerability in Koollab LMS lets an authenticated user inject SQL and unsafe data into the system, enabling them to write a webshell to a public folder and run arbitrary code on the server.

CVE-2026-63233

A critical flaw in Koollab LMS lets an authenticated user run arbitrary code on the server. The bug combines SQL injection with unsafe deserialization, allowing the attacker to write a webshell to a public directory. This can give full control over the affected system.

CVE-2026-63232

A critical vulnerability in Koollab LMS lets an authenticated user inject SQL and exploit unsafe deserialization to write a webshell and run arbitrary code on the server. The flaw is in the assessment reinforcement endpoint and can be triggered by a legitimate user account. It poses a severe risk to any site running the affected LMS.

CVE-2026-63230

A critical vulnerability in Koollab LMS lets anyone on the network read sensitive data from the database without authentication. The flaw is an error‑based SQL injection that can expose personal information, login credentials, and JWT tokens. It can be exploited simply by sending a crafted request to the SCORM report endpoint.

Critical· 9.1<1% likely

CVE-2026-63229

A blind SQL injection flaw in Koollab LMS lets anyone on the internet read sensitive data through the SSO OAuth endpoint. The flaw can expose personal information, passwords, and tokens that could be used to hijack accounts.

Critical· 9.1<1% likely

CVE-2026-63227

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server. This means attackers can run any code on the server.

published 1d agodeletes in 45d

CVE-2026-13423

A flaw in the Streamit WordPress theme up to version 4.5.0 lets anyone call any PHP function through an AJAX route that lacks authentication. This can create admin accounts or run arbitrary code, giving attackers full control of the site.

Critical· 9.8<1% likely

CVE-2026-18072

The Advanced Responsive Video Embedder plugin for WordPress contains a hardcoded backdoor that lets anyone log in as an administrator without a password. The flaw is in version 10.8.7 and allows attackers to gain full control of the site. It is a critical vulnerability that can be exploited by simply supplying a known token.

Critical· 9.8<1% likely