TL;DR: Imperva’s Red Team disclosed a Docker CopyEscape vulnerability that turns the ordinary docker cp command into a host file-write primitive. Tracked as CVE-2026-17106, the flaw carries …

TL;DR CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog. The flaw is a code injection bug in Ray, a popular Python framework for scaling AI and Python workloads. It allows r…

TL;DR A critical flaw in Forminator Forms puts more than 600,000 WordPress sites at risk. Tracked as CVE-2026-15748, it scores a CVSS 9.8. The bug lets unauthenticated attackers upload executable …

TL;DR GitLab shipped an out-of-band critical patch on August 17, 2026. It fixes CVE-2026-19478, a GraphQL code injection flaw rated CVSS 9.4. Under certain conditions, an unauthenticated attacker …

TL;DR BigBlueButton contains a critical path traversal vulnerability within the Etherpad integration. Attackers can perform an unauthenticated arbitrary file read to extract sensitive system files…

TL;DR Microsoft patched CVE-2026-66804, an elevation of privilege flaw in the Windows Cross Device Service. A standard local user can gain SYSTEM privileges through a missing-path DLL planting tri…

TL;DR A billing flaw in New API, a popular open-source AI API gateway, is under active attack. Tracked as CVE-2026-71479, this integer overflow lets a user with a small balance credit themselves a…

TL;DR JetBrains fixed eight security flaws in YouTrack, its issue-tracking platform. The most serious, CVE-2026-75045, is rated Critical. It let an unauthenticated attacker download database backu…

Threat actors began probing SAP Commerce Cloud systems for a critical vulnerability just three days after a patch became available. DefusedCyber reported detecting the first exploitation attempts …

TL;DR A researcher released proof-of-concept exploit code for CVE-2026-68138, a race condition in the Linux kernel traffic-control code. The flaw lets a local user escalate to root on affected sys…