CryptoPayment Gateway WordPress Plugin Has No Fix for Maximum Severity Flaw Exposing Wallet Credentials (CVE-2026-81648)

Scope: CryptoPayment Gateway WordPress plugin, versions 1.2.1 through 1.2.2 (no patched version exists)

Severity: Red

Read More

WordPress Core Fix for CVE-2026-119977 Can Itself Briefly Expose Sites During Installation

Scope: WordPress Core, versions 4.7 through 7.1.3, including sites in the process of applying the official fix

Severity: Amber

Read More

“SSHole” OpenSSH Flaw Gains Root on Alpine Linux Honeypot Hours After Disclosure (CVE-2026-123158)

Scope: Linux systems running OpenSSH on the musl C library with PAM disabled, including Alpine Linux’s default OpenSSH configuration

Severity: Red

Read More

WordPress Core Flaw Exploited During the Software Upgrade Process Itself (CVE-2026-119977)

Scope: WordPress Core, patched versions released late October 2026

Severity: Red

Read More

Years-Old Apple Pointer Authentication Bypass Back in Active Use for Espionage-Linked Malware Delivery (CVE-2024-27834)

Scope: Older Apple devices and browsers on builds predating the May 2024 security updates (iOS/iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, Safari 17.5)

Severity: Amber

Read More

Ruby on Rails Active Storage Flaw Lets Attackers Write Files and Leak Server Secrets via Image Uploads

Scope: Ruby on Rails, fixed in versions 8.1.4.1 and 8.0.5.2

Severity: Red

Read More