Topic
CVSSv3.1
Cisco Patches 29 Vulnerabilities in Secure Firewall ASA, FTD and FMC Products
Vulnerabilities & Exploits
Cisco Releases Critical Patches for Exploited SQL Injection Flaw in Secure Email Gateway
Vulnerabilities & Exploits
Adobe Issues Critical Security Updates for ColdFusion Fixing Nine CVEs Including Eval Injection Flaws
Vulnerabilities & ExploitsCritical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.
CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.
Adobe Releases Third Emergency Patch for Campaign Classic in Two Weeks, Fixing Critical RCE Vulnerabilities
Adobe has issued another urgent security update for Adobe Campaign Classic after discovering multiple critical vulnerabilities that affect the previous patches released on July 29 and August 3. The new advisory, published on August 11, 2026, addresses three CVEs rated Critical, including two remote code execution flaws with CVSSv3.1 base scores of 10.0. These authorization bypass issues allow unauthenticated attackers to execute arbitrary code remotely. The affected versions include 7.4.3 build 9398 and build 9399, which were themselves emergency fixes issued only days earlier. Adobe urges all customers to apply the latest update immediately due to the high risk of exploitation. This marks the third high-severity patch for the product within a two-week period.
Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities
Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.
Adobe Releases Emergency Update for Campaign Classic Fixing Multiple Critical Vulnerabilities
Adobe has issued an urgent security update for Adobe Campaign Classic to address seven critical vulnerabilities, including several with a maximum CVSSv3.1 base score of 10.0. The flaws affect on-premises deployments on Windows and Linux as well as the on-premises components of hybrid setups. Notably, the newly released fixes also impact the previous emergency update from July 29, version 7.4.3 build 9398, requiring users to apply the latest patch immediately. Among the most severe issues are a server-side request forgery vulnerability tracked as CVE-2026-48331, an input handling flaw in the template engine identified as CVE-2026-48323, and an SQL injection vulnerability labeled CVE-2026-48330. Adobe published the corresponding security advisory on August 3, 2026, urging rapid remediation despite the short interval since the prior update.
MongoDB Server Patches 24 Vulnerabilities Including Critical Flaw in mongod Compute Mode
MongoDB has released updates addressing 24 vulnerabilities in MongoDB Server, with one rated critical. The patches cover multiple branches and include fixes for CVE-2026-13072, which carries a CVSSv3.1 base score of 9.2. The critical issue affects standalone mongod instances with compute mode enabled and stems from insufficient validation of external input that can lead to memory corruption. Additional fixes resolve 16 high-severity issues, seven medium, and one low, including CVE-2026-13059 that could allow unauthorized read-write actions by low-privileged authenticated users. Updated versions MongoDB 8.3.7, 8.2.12, 8.0.28, and 7.0.39 are now available. The company published the updates on July 22, 2026, and urges immediate application to maintain system integrity.