🟠 CVE-2026-17107 - High (8.5)

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17107 - High (8.5)

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-62835: Microsoft Azure Portal Information Disclosure Vulnerability

CVE-2026-62835 involves a flaw in the authorization process of Online Services, enabling attackers to access restricted information. The vulnerability documented by this CVE requires no customer action to resolve.

CVSS: 9.3

More information: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62835

🚨 CVE-2026-62835: Microsoft Azure Portal Information Disclosure Vulnerability

CVE-2026-62835 involves a flaw in the authorization process of Online Services, enabling attackers to access restricted information. The vulnerability documented by this CVE requires no customer action to resolve.

CVSS: 9.3

More information: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62835

‼️ CVE-2026-58630: Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

CVSS: 10

Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58630

🔴 CVE-2026-58630 - Critical (10)

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️ CVE-2026-58630: Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

CVSS: 10

Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58630

🔴 CVE-2026-58630 - Critical (10)

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Oracle drops 1,449 security patches like it's the new normal

Oracle가 분기 보안 업데이트에서 1,449건의 패치를 배포했으며, 이 중 Oracle Fusion Middleware 관련 취약점 10건은 CVSS 10.0이다. 특히 인증 없이 HTTP로 Oracle Data Integrator를 장악할 수 있는 CVE-2026-47056과 TCP를 통해 Oracle Coherence를 장악할 수 있는 CVE-2026-60217은 즉시 패치 우선순위가 높다. Oracle Database Server에도 저권한 원격 코드 실행 가...

https://www.theregister.com/security/2026/07/23/oracle-drops-1449-security-patches-like-its-the-new-normal/5277114

🟠 CVE-2026-66035 - High (7.5)

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66035/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66035 - High (7.5)

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66035/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65709 - High (8.3)

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without pe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65709/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65709 - High (8.3)

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without pe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65709/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54342 - High (8.1)

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnek...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54342 - High (8.1)

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnek...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-48021 - Critical (9.1)

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-48021 - Critical (9.1)

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66027 - High (8.3)

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66027 - High (8.3)

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66034 - High (7.5)

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66034 - High (7.5)

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66032 - High (8.8)

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66032 - High (8.8)

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65708 - High (8.1)

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65708/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65708 - High (8.1)

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65708/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66033 - High (7.5)

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66033/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66033 - High (7.5)

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66033/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8789 - High (8.1)

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8789 - High (8.1)

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-57106 - Critical (10)

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-57106 - Critical (10)

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Discover the RefluXFS Linux vulnerability (CVE-2026-64600) in XFS that allows local users to overwrite protected files and gain root privileges.

#RefluXFS #CVE202664600 #LinuxKernel #Cybersecurity #XFS

https://meterpreter.org/refluxfs-linux-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

got a red hat cve for the bug i found trying out superluminal on linux. this means that i'm a SECURITY RESEARCHER now! https://access.redhat.com/security/cve/cve-2026-16730

🟠 CVE-2026-14172 - High (7.8)

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-15704 - Critical (9.8)

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router.

The shared rou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-24727 (CRITICAL, CVSS 9.3): SUNNET Corporate Training Mgmt System v10.3 allows admins to upload ZIP files with executable code, enabling server command execution. No patch yet — restrict admin access & monitor uploads. https://radar.offseq.com/threat/cve-2026-24727-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-sunnet-technology-co-ltd-fe23deeb060f5b6d #OffSeq #CVE202624727 #infosec 🛡️

🟠 CVE-2026-16870 - High (8.8)

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-54120 (CRITICAL, CVSS 9.9): Improper input validation in Microsoft Surface Management Services lets authorized attackers run code remotely. Patch now: https://radar.offseq.com/threat/cve-2026-54120-cwe-20-improper-input-validation-in-microsoft-surface-management-services-203a5e59f513d748 🖥️ #OffSeq #infosec #Microsoft #CVE202654120

CRITICAL improper authorization vuln (CVE-2026-56160) in Azure Red Hat OpenShift (ARO): privilege escalation risk for authorized users. No active exploits. Microsoft has released a fix — ensure your ARO instances are updated. Details: https://radar.offseq.com/threat/cve-2026-56160-cwe-285-improper-authorization-in-microsoft-azure-red-hat-openshift-aro-9a561de9f992bb49 #OffSeq #Azure #CVE202656160

Oracle drops 1,449 security patches like it's the new normal

Oracle가 분기 보안 업데이트에서 1,449건의 패치를 배포했으며, 이 중 Oracle Fusion Middleware 관련 취약점 10건은 CVSS 10.0이다. 특히 인증 없이 HTTP로 Oracle Data Integrator를 장악할 수 있는 CVE-2026-47056과 TCP를 통해 Oracle Coherence를 장악할 수 있는 CVE-2026-60217은 즉시 패치 우선순위가 높다. Oracle Database Server에도 저권한 원격 코드 실행 가...

https://www.theregister.com/security/2026/07/23/oracle-drops-1449-security-patches-like-its-the-new-normal/5277114

‼️ CVE-2026-16232: An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

CVSS: 9.1

Scanner: https://github.com/WadesWeaponShed/Check-Point-Trusted-Access-Review

Details and Mitigation: https://support.checkpoint.com/results/sk/sk185169/

📰 Check Point Patches Actively Exploited SmartConsole Auth Bypass Flaw

🚨 CRITICAL PATCH: Check Point fixes an actively exploited auth bypass zero-day (CVE-2026-16232, CVSS 9.3) in SmartConsole. Flaw allows full admin access. CISA added to KEV. Patch NOW. #CyberSecurity #ZeroDay #CheckPoint #Infosec

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/check-point-patches-actively-exploited-smartconsole-authentication-bypass-flaw/?utm_source=mastodon&utm_me…

‼️ CVE-2026-16232: An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

CVSS: 9.1

Scanner: https://github.com/WadesWeaponShed/Check-Point-Trusted-Access-Review

Details and Mitigation: https://support.checkpoint.com/results/sk/sk185169/

Geopolitical tensions escalated as US strikes on Iran continued and Houthi attacks on Saudi tankers raised oil prices. In cybersecurity, a critical Check Point zero-day (CVE-2026-16232) is actively exploited. US agencies warned of Iranian cyber campaigns targeting critical infrastructure PLCs and Russian state-backed phishing on Zimbra Collaboration Suite. AI agents are now a primary attack surface.

#Cybersecurity #Geopolitics #TechNews

(CISA TS-SOC) CVE-2026-50522 – Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Severity: CRITICAL Impact Summary: An unauthorized attacker can execute code over a network via deserialization of untrusted data....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-50522-microsoft-sharepoint-deserialization-of-untrusted-data-vulnerability/

Certighost AD CS Vulnerability Exposes a Dangerous Path to Domain Controller Control, Microsoft Fixes Critical Identity Security Flaw + Video

Introduction: A New Warning for Active Directory Defenders A newly disclosed Active Directory security vulnerability is raising concerns among enterprise defenders because it demonstrates how a seemingly limited user account could become a stepping stone toward full domain compromise. The flaw, tracked as CVE-2026-54121 and known…

https://undercodenews.com/certighost-ad-cs-vulnerability-exposes-a-dangerous-path-to-domain-controller-control-microsoft-fixes-critical-identity-security-flaw-video/?utm_source=mastodon&utm_medium=jetpack_social

‼️ PoC released for CVE-2026-54121 codenamed Certighost

CVE-2026-54121 is a privilege escalation vulnerability in Active Directory Certificate Services that enables authorized attackers to elevate privileges.

GitHub: https://github.com/aniqfakhrul/cve-2026-54121

📰 PoC Exploit 'Certighost' for Critical AD CS Flaw Now Public

PoC exploit 'Certighost' released for critical AD CS flaw CVE-2026-54121 (CVSS 8.8). Exploit allows low-privilege users to impersonate a Domain Controller, leading to full domain compromise. Patching is urgent. #ActiveDirectory #CyberSecurity #BlueTeam

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/certighost-exploit-released-for-critical-active-directory-flaw-cve-2026-54121/?utm_source=ma…

‼️ PoC released for CVE-2026-54121 codenamed Certighost

CVE-2026-54121 is a privilege escalation vulnerability in Active Directory Certificate Services that enables authorized attackers to elevate privileges.

GitHub: https://github.com/aniqfakhrul/cve-2026-54121

New.

GitHub/H0j3n: Certighost (CVE-2026-54121) https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26

More:

The Hacker News: Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html @thehackernews #infosec #vulnerability #Microsoft #Windows

A Konnectivity vulnerability (CVE-2026-16242, CVSS 9.4) lets unauthenticated attackers proxy and modify control-plane traffic. See the fix and mitigation.

#Konnectivity #Kubernetes #CVE202616242 #CloudSecurity #ControlPlane #AuthBypass #InfoSec #PatchNow

http://securityonline.info/konnectivity-vulnerability-cve-2026-16242/?utm_source=mastodon&utm_medium=jetpack_social

15-Year-Old Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533 – cyberstan #devopsish https://cyberstan.co.uk/nginx-rce/

A public proof-of-concept details the Windows AppResolver LPE (CVE-2026-50454), a UAC bypass that chains an admin token to a SYSTEM shell.

#Windows #CVE202650454 #PrivilegeEscalation #UACBypass #InfoSec

https://securityonline.info/windows-appresolver-lpe-cve-2026-50454/?utm_source=mastodon&utm_medium=jetpack_social

📰 Russian APT 'Laundry Bear' Targets West with Zero-Click Zimbra Exploit

International advisory warns of Russian APT 'Laundry Bear' using a zero-click Zimbra exploit (CVE-2025-66376) in a widespread espionage campaign against Western targets. Actors steal emails & credentials. #ThreatIntel #Zimbra #CyberSecurity

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/russian-laundry-bear-apt-targets-west-with-zero-click-zimbra-exploit/?utm_source=mastodon&utm…

📰 Russian Hackers Use Zero-Click Zimbra Exploit in Global Spy Campaign

Russian state actors (Void Blizzard) are exploiting a zero-click Zimbra vulnerability (CVE-2025-66376) to steal credentials and emails. The campaign uses JavaScript injection via phishing emails. Patching is critical. #CyberEspionage #Zimbra #ThreatI...

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/russian-webmail-espionage-targets-zimbra/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CVE-2025-0679 named them. NVD and MITRE still can't agree on whether you had a fighting chance. You did not.

Update your Zimbra webmail client to the patched version immediately, or TA488 keeps the loot.

Reward: You've received a hollow Authenticator Token — pre-drained.

#ZeroDay #Zimbra #Espionage #CyberSecurity #2FA #AchievementUnlocked (2/2)

(CISA TS-SOC) CVE-2026-0770 – Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Severity: UNKNOWN Impact Summary: Remote attackers can execute arbitrary code on affected installations. Timestamp: 2026-07-24T01:31:37.336Z ATT&CK Mapping…...

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-0770-langflow-inclusion-of-functionality-from-untrusted-control-sphere-vulnerability/

Tycon Power Monitor Authentication Bypass CVE-2026-61884 Rated CVSS 9.8

https://securityonline.info/tycon-authentication-bypass-cve-2026-61884/?utm_source=mastodon&utm_medium=jetpack_social

(CISA TS-SOC) CVE-2026-60137 – WordPress Core SQL Injection Vulnerability

Severity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-60137-wordpress-core-sql-injection-vulnerability/

(CISA TS-SOC) CVE-2026-63030 – WordPress Core Interpretation Conflict Vulnerability

Severity: CRITICAL Impact Summary: An attacker can exploit an interpretation conflict in WordPress Core to perform SQL Injection, which may be chained to achieve Remote Code Execution....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-63030-wordpress-core-interpretation-conflict-vulnerability/

(CISA TS-SOC) CVE-2026-60137 – WordPress Core SQL Injection Vulnerability

Severity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....

https://thecybermind.co/2026/07/24/cisa-ts-soc-cve-2026-60137-wordpress-core-sql-injection-vulnerability/