Skip to main content

Drupal Commerce Core Authorization Bypass Exploited in the Wild, Over 42,000 Stores Exposed (CVE-2026-118539)

Scope: Drupal Commerce Core, versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13

16-Year-Old EDK II UEFI Firmware Flaw Allows Code Execution Before Secure Boot on Network-Booting Servers

Scope: EDK II (TianoCore) UEFI firmware implementations supporting PXE network boot, acros

Attackers Already Scanning for Recently Patched Oracle E-Business Suite Flaw (CVE-2026-101767)

Scope: Oracle E-Business Suite, Application Object Library component (patched in Oracle’s

Veeam Patches Critical Unauthenticated Authorization Bypass in Backup & Replication 13 (CVE-2026-108142)

Scope: Veeam Backup & Replication 13.1.1.18 and earlier (13.1 branch), 13.0.2.29 and e

Apple Backports CoreGraphics Zero-Day Patch to Older iPhones Following Targeted Spyware Attacks

Scope: Older iPhones and iPads that did not receive last month’s CoreGraphics fix

Microsoft Pushes Out-of-Band Windows Update to Distrust Compromised eMudhra Certificate Authority Keys

Scope: Windows systems not receiving automatic certificate trust list updates

Tailscale Officially Confirms Nearly a Dozen SSH and Networking Vulnerabilities, Patches in Progress

Scope: Tailscale SSH, serve, app connector, DERP relay client, and headscale self-hosted s

Subscribe to Advisories