s2Member WordPress Plugin Code Injection Flaw Has Public Exploit Code (CVE-2026-86596)

Scope: s2Member WordPress plugin, all versions through 260927, fixed in 261017

Severity: Red

Read More

“KeyDrift” Malware Stole Cisco SD-WAN Encryption Keys for Years Before Detection (CVE-2026-20127)

Scope: Cisco Catalyst SD-WAN Controller, Manager, and Validator (patched since February 2026)

Severity: Red

Read More

Langflow Unauthenticated Authentication Bypass and Remote Code Execution (CVE-2026-93680 / CVE-2026-110186)

Scope: Langflow, versions 1.0.0 through 1.12.8, fixed in 1.13.0

Severity: Red

Read More

Cisco Patches Actively Exploited ASA and FTD Firewall Crash Vulnerability (CVE-2026-76418)

Scope: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software

Severity: Amber

Read More

Drupal Commerce Core Authorization Bypass Exploited in the Wild, Over 42,000 Stores Exposed (CVE-2026-118539)

Scope: Drupal Commerce Core, versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13

Severity: Red

Read More

Attackers Chain Three Ivanti Connect Secure Flaws to Achieve Unauthenticated Root Access (CVE-2026-111357 / CVE-2026-118527)

Scope: Ivanti Connect Secure (ICS), versions prior to the latest patched release covering all three chained CVEs

Severity: Red

Read More