Vulnerability intelligence

CVE-2025-55182 is a critical unauthenticated remote code execution (RCE) vulnerability found in React Server Components (RSC) versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. This vulnerability affects packages including `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack`. The flaw stems from insecure deserialization in the RSC payload handling logic, allowing attacker-controlled data to influence server-side execution. Exploitation requires only a crafted HTTP request. Patches are available for React and Next.js. It is recommended to upgrade to patched React versions such as 19.0.1, 19.1.2, or 19.2.1, and to update frameworks like Next.js to their corresponding patched versions.

CVE-2026-58115 is a missing authentication vulnerability affecting the Node-RED HTTP interface bundled with Siemens SIMATIC IoT2050 Advanced devices running Industrial OS (versions prior to V4.3.4.1). Because the Node-RED editor and admin API are exposed without access control by default, an unauthenticated remote attacker with network access can reach the programming interface. By deploying malicious flows containing built-in nodes—such as `exec` or `function` nodes—attackers can execute arbitrary system commands on the underlying server. In late October 2026, security researchers observed active exploitation of this vulnerability in the wild. Attackers targeted exposed instances by sending HTTP POST requests to deploy malicious flows, which automatically downloaded Linux bot payloads and established persistent web shells to execute remote commands. Siemens has addressed the issue in Industrial OS version V4.3.4.1 and later. For standalone Node-RED installations, administrators are advised to enable the `adminAuth` setting and restrict the editor from public internet access.

CVE-2026-85956 is an improper privilege management vulnerability (CWE-269) affecting Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0. The flaw allows a remote attacker who already possesses delegated database-administrator privileges to perform backup or restore operations on database forests that lie outside their authorized database scope. This occurs because the server previously authorized backup and restore requests based on the database identified in the request URL rather than validating the actual databases and forests named within the request itself. Exploiting this vulnerability can lead to unauthorized access to or modification of security-critical data. To address the issue, Progress Software released updates in MarkLogic Server versions 11.3.7 and 12.1.0, which enforce authorization checks against the actual databases and forests specified in the backup or restore requests. Organizations are advised to upgrade to these patched versions and review delegated forest and database privilege assignments.

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that affects versions 4.7 through 7.1.3. The issue arises during the core update process when WordPress extracts a full-package upgrade into a predictable, web-accessible staging directory within the `wp-content/upgrade` folder. Because these temporary paths are predictable, an unauthenticated remote attacker can target the staged installer files during the brief extraction window to execute arbitrary PHP code on the underlying server. The vulnerability, discovered by researcher Umut Bayram, was patched with the release of WordPress version 7.1.4 on October 28, 2026, with security fixes backported to all affected branches. Despite the narrow timing window required to successfully exploit the race condition, security firms observed automated scanning and exploitation attempts targeting the staged installer paths almost immediately after disclosure. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026.