Expert articles on web security, vulnerabilities, and best practices
NewsCVE-2026-15013 is a critical authentication bypass in the SAML Single Sign On - SSO Login plugin for WordPress through version 5.4.3. The plugin can be tricked into validating an attacker-controlled SAML response with the wrong signature algorithm, allowing unauthenticated attackers to impersonate existing users, including administrators.
NewsCVE-2026-46579 is an OpenShift Router authentication flaw that can allow crafted X-SSL-Client-* headers sent over plain HTTP to reach a backend when insecureEdgeTerminationPolicy is set to Allow. Backends that trust those headers as proof of a client certificate can be tricked into accepting an attacker-controlled identity.
NewsCVE-2026-1801 is an HTTP request smuggling vulnerability in libsoup caused by non-compliant parsing of malformed chunk headers. Remote attackers may be able to create request-boundary confusion in applications using the affected server-side parsing path, and Ubuntu has released security updates across supported releases.
NewsTwo critical vulnerability chains in The Events Calendar WordPress plugin can lead to unauthenticated remote code execution when comments are enabled on event pages. CVE-2026-78006 and CVE-2026-78159 both carry CVSS scores of 9.8 and affect vulnerable releases used across hundreds of thousands of sites.
NewsCVE-2026-5430 is a critical authentication bypass affecting multiple WSO2 API management products. Improper handling of JWTs signed with unsupported algorithms can allow unauthorized access and administrative account takeover, and researchers have observed active exploitation attempts using forged administrator tokens.
NewsCISA has added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The Linux kernel flaws affect kernel TLS, ebtables bridge networking, and the AF_ALG cryptographic interface, creating risks ranging from memory corruption and denial of service to privilege escalation.
NewsA new multi-agency advisory warns that North Korean WaterPlum actors are targeting developers through fake recruitment, malicious coding assignments, NPM packages and VS Code projects. Here is what web teams should know and how to reduce the risk.
NewsCVE-2026-27540 is a critical unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture through version 2.0.3.1. Attackers are actively exploiting the flaw to upload PHP web shells and execute code on vulnerable WordPress servers, with more than 100,000 exploit attempts blocked by Wordfence.
NewsCVE-2025-13146 is a medium-severity vulnerability in DTX – Dynamic Text Extension for Contact Form 7 that allows unauthenticated attackers to trigger arbitrary WordPress shortcodes. Wordfence updated the affected range in September 2026 to include versions through 5.0.7 and currently lists no known patch.
NewsCVE-2026-19949 is a high-severity second-order SQL injection vulnerability affecting All-in-One WP Migration and Backup through version 7.109. An unauthenticated attacker can plant malicious database content that is triggered during a later backup restoration, potentially exposing the plugin's secret import key and creating a path to remote code execution and complete WordPress site takeover.