TL;DR Attackers have begun CVE-2026-21589 exploitation against self-managed Atlassian servers. Researchers at watchTowr published a full technical breakdown and working proof-of-concept for the ar…

TL;DR Attackers are exploiting two unauthenticated stored XSS flaws in Ninja Forms and WPC Product Bundles for WooCommerce, according to Patchstack. The WordPress XSS campaign plants a script that…

Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.

Between October 5 and 11, 2026, CVE Watchtower logged 3,255 new vulnerabilities. This weekly CVE report highlights six exploited flaws that Daily Cybersecurity’s intelligence sources surface…

CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.

The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.

TL;DR Ivanti disclosed CVE-2026-104935 on October 13, 2026, and confirmed the flaw is already exploited in the wild. The Ivanti Connect Secure vulnerability lets a remote, unauthenticated attacker…

CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. 

TL;DR Threat actors are actively exploiting CVE-2026-110447, a critical OS command injection flaw in the Nextcloud Collabora Online Built-in CODE Server app (richdocumentscode). Rated 9.2 on the C…

The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.