MikroTik RouterOS "MikroTrick" Chain Confirmed to Enable Full Administrative Takeover (CVE-2026-67279)

Scope: MikroTik RouterOS Version 7.x

Severity: Amber

Read More

WordPress Core Path Traversal Flaw Moves From Patch to Active Payload Delivery Within Hours (CVE-2026-87902)

Scope: WordPress Core, All Versions Prior to 7.1.2 (Fix Backported to 4.7.37)

Severity: Red

Read More

Microsoft SharePoint Code Injection Flaw Exploited After Being Mislabeled as Low Risk for 45 Days (CVE-2026-65660)

Scope: Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (On-Premises Deployments)

Severity: Red

Read More

F5 BIG-IP APM Unauthenticated Remote Code Execution Actively Exploited on OAuth-Configured Systems (CVE-2026-94127)

Scope: F5 BIG-IP Access Policy Manager, Virtual Servers Configured with Both an APM Access Policy and an OAuth Authorization Server Profile

Severity: Red

Read More

Arista VeloCloud Orchestrator Maximum Severity Flaw Exploited With No Available Workaround (CVE-2026-93952)

Scope: Arista VeloCloud Orchestrator (VCO) On-Prem Deployments

Severity: Red

Read More

WordPress Core Unauthenticated Path Traversal Affects Every Version Since 2016, Can Enable Code Execution (CVE-2026-87902)

Scope: WordPress Core, All Versions 4.7.0 Through 7.1.1

Severity: Red

Read More