Trending now

CVE-2026-124194 is a spoofing vulnerability in Microsoft Outlook that stems from the application failing to warn users before performing a potentially unsafe action. To exploit this flaw, an unauthenticated attacker must convince a target to open a specially crafted message file in an affected version of Outlook. The vulnerability cannot be triggered through the Preview Pane alone. Once the malicious file is opened, Outlook is forced to connect to an attacker-controlled network location without displaying the standard external-content warning. This unauthorized connection exposes the victim's NTLMv2 authentication hash to the remote server, allowing the attacker to capture the hash and potentially use it to impersonate the user in subsequent attacks. Discovered by researchers "nono" and Benoît Sevens, the vulnerability was addressed in Microsoft's November 2026 Patch Tuesday updates. Because the flaw has been actively exploited in the wild as a zero-day, the Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) Catalog.

CVE-2025-62861 is a vulnerability in Bitcoin Core affecting versions 28.0 through 28.2 and 29.0 through 29.1. Discovered by security researcher Niklas Goegge, the flaw stems from the software's Transaction Policy for Requesting Unconfirmed Transactions (TRUC / v3 transaction rules) "sibling transaction eviction" logic during a blockchain reorganization. When a chain reorganization occurs, a node drops blocks and attempts to re-add those transactions back into its mempool with the `bypass_limits` parameter enabled. However, because the sibling-eviction logic was not properly gated by this parameter, TRUC enforcement continued to run during the re-addition process. This could result in a parent transaction being evicted from the mempool while its dependent child transactions remained. This discrepancy led to an inconsistent mempool state where child transactions attempted to spend missing outputs, causing block template creation to fail and preventing affected mining nodes from producing valid blocks. The issue did not allow for the theft of funds or the creation of unauthorized coins, and affected nodes could temporarily resolve the block-production halt by restarting. A fix proposed by developer Greg Sanders was released in October 2025 with Bitcoin Core version 30.0 and backported to the 28.x and 29.x branches. The vulnerability details were publicly disclosed on November 10, 2026, following the end-of-life of the 29.x software branch.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-121653 is a SQL injection vulnerability affecting the Core component of Ivanti Endpoint Manager (EPM). The flaw stems from the improper neutralization of special elements within SQL commands, which allows user-controlled inputs to modify database queries. By exploiting this vulnerability, a remote, unauthenticated attacker can achieve remote code execution (RCE) on the affected system. The vulnerability impacts Ivanti EPM versions prior to 2024 SU8. Disclosed by Ivanti on November 10, 2026, through their responsible disclosure program, the company reported no evidence of active exploitation in the wild at the time of public release. Organizations can resolve the issue by upgrading to Ivanti EPM 2024 SU8, which is available through the Ivanti License System.

CVE-2026-119948 is a stack-based buffer overflow vulnerability affecting Windows Active Directory. Disclosed in November 2026, the flaw impacts a wide range of operating systems, including multiple versions of Windows 10, Windows 11, and Windows Server (from 2016 to 2025). The vulnerability allows an authorized attacker with low privileges to execute arbitrary code over a network without requiring any user interaction. Exploiting the vulnerability involves high attack complexity, indicating that specific environmental conditions, such as particular protocol settings or configurations, must be present. Microsoft has not publicly disclosed the specific vulnerable function, the exact network request needed, or a working proof-of-concept attack method. To address the flaw, administrators are advised to deploy the official security updates provided by Microsoft across all affected systems.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2025-3248 is a code injection vulnerability that affects Langflow versions prior to 1.3.0. It exists in the `/api/v1/validate/code` endpoint, where a remote, unauthenticated attacker can send crafted HTTP requests to execute arbitrary code on the server. This vulnerability allows attackers to gain control of vulnerable Langflow servers without needing authentication. To remediate this vulnerability, users are advised to upgrade to Langflow version 1.3.0 or restrict network access to the application.

CVE-2026-63030 is an unauthenticated remote code execution (RCE) vulnerability affecting WordPress versions 6.9 and later. This flaw allows an attacker to execute arbitrary code through the batch endpoint of the REST API. Exploitation of CVE-2026-63030 does not require any user interaction or authentication, and it is specifically possible when a persistent object cache is not in use. The vulnerability is related to a REST API batch-route confusion and SQL injection issue. Fixes for this vulnerability have been released in WordPress 7.0.2 and 6.9.5.

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that affects versions 4.7 through 7.1.3. The issue arises during the core update process when WordPress extracts a full-package upgrade into a predictable, web-accessible staging directory within the `wp-content/upgrade` folder. Because these temporary paths are predictable, an unauthenticated remote attacker can target the staged installer files during the brief extraction window to execute arbitrary PHP code on the underlying server. The vulnerability, discovered by researcher Umut Bayram, was patched with the release of WordPress version 7.1.4 on October 28, 2026, with security fixes backported to all affected branches. Despite the narrow timing window required to successfully exploit the race condition, security firms observed automated scanning and exploitation attempts targeting the staged installer paths almost immediately after disclosure. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026.