⚡
Critical Unauthenticated RCE in Autel Maxi Charger
Patch or remove internet exposure without delay. Unauthenticated root-level remote code execution is among the highest-risk vulnerability classes.
CVE-2026-8984 is a CRITICAL vulnerability with CVSS 10.0 affecting Autel Maxi Charger Single firmware through V1.03.51. A crafted request to the ‘/test’ endpoint on TCP port 9002 allows unauthenticated attackers to download, extract, and execute attacker-controlled files with root privileges. The result is remote code execution on the device.
🔗 Read more 🔗
Source: NVD
🗑️
WordPress WP Foodbakery File Deletion Flaw Can Lead to RCE
Organizations using the WP Foodbakery plugin should restrict low-privilege accounts, monitor for vendor updates, and apply remediation as soon as it is available. The potential path to remote code execution makes this a high-priority issue.
CVE-2026-15802 is a HIGH vulnerability with CVSS 8.1 affecting the WP Foodbakery plugin for WordPress up to and including version 4.9. Insufficient file path validation in the ‘delete_locations_backup_file_callback’ function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. Deleting critical files such as wp-config.php can lead to remote code execution.
🔗 Read more 🔗
Source: NVD
🔐
Veeam Software Appliance Privilege Escalation to Root
Administrators running the Veeam Software Appliance should prioritize patching, especially on systems with multiple local users or administrative access paths. Root compromise makes this an important internal security issue.
CVE-2026-56844 is a HIGH vulnerability with CVSS 8.4 affecting the Veeam Software Appliance. A flaw in the Veeam Updater component allows a local user to elevate privileges and gain root-level access to the underlying operating system. Successful exploitation can result in full administrative control of the host.
🔗 Read more 🔗
Source: NVD
📜
Netty OCSP Validation Bug Enables Revocation Check Bypass
Developers and platform teams using affected Netty releases should upgrade promptly. Certificate validation weaknesses can undermine TLS trust assumptions.
CVE-2026-56820 is a HIGH vulnerability with CVSS 7.4 affecting Netty versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final. The ‘OcspClient’ fails to verify that the returned CertificateID matches the requested CertificateID, enabling replay attacks that bypass certificate revocation checks. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
🔗 Read more 🔗
Source: NVD
💥
Netty HTTP2 Memory Leak Can Crash JVM
Teams exposing HTTP/2 services with the affected decompression feature enabled should update quickly. Internet-facing deployments are the highest priority.
CVE-2026-56819 is a HIGH vulnerability with CVSS 7.5 affecting Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. A remote unauthenticated peer can trigger a direct ByteBuf memory leak when HTTP/2 content decompression is enabled, eventually exhausting direct memory and crashing the JVM. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
🔗 Read more 🔗
Source: NVD
📄
Netty XML Decoder Exposed to XXE Risk
Developers using Netty XML processing should upgrade and ensure secure XML parser settings are enforced. Systems accepting untrusted XML deserve immediate attention.
CVE-2026-56817 is a HIGH vulnerability with CVSS 8.3 affecting Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. XML containing a DOCTYPE declaration can expose applications using XmlDecoder with default AsyncXMLInputFactory settings to conditional XML external entity risk. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
🔗 Read more 🔗
Source: NVD
🚨
Critical Command Injection in Autel Maxi Charger
Any exposed Autel Maxi Charger devices should be patched or isolated immediately. An unauthenticated CVSS 10.0 command injection vulnerability requires urgent action.
CVE-2026-8985 is a CRITICAL vulnerability with CVSS 10.0 affecting Autel Maxi Charger Single firmware through V1.03.51. An unauthenticated attacker can exploit OS command injection in the ‘/test’ endpoint exposed on TCP port 9002 by supplying crafted input in the url parameter. Successful exploitation allows arbitrary operating system command execution.
🔗 Read more 🔗
Source: NVD
📰
Feedbin Information Disclosure Exposes Private Articles
Feedbin administrators should deploy a fix immediately and review logs for unusual enumeration activity. The flaw directly exposes sensitive user content.
CVE-2026-65319 is a HIGH vulnerability with CVSS 7.5 affecting Feedbin at commit 739884a. The entries text API endpoint skips authorization, allowing unauthenticated attackers to enumerate sequential IDs and retrieve private article content. Exposed data can include private newsletter content, saved pages, and articles from users’ subscriptions.
🔗 Read more 🔗
Source: NVD
🌐
Verba RAG WebSocket SSRF Exposes Internal Services
Anyone running Verba RAG 2.1.3 should patch quickly and restrict access to the affected endpoint. SSRF against internal infrastructure can expose credentials and sensitive services.
CVE-2026-65318 is a HIGH vulnerability with CVSS 8.6 affecting Verba RAG application version 2.1.3. An unauthenticated server-side request forgery vulnerability in the WebSocket import endpoint allows attackers to make arbitrary HTTP GET requests. The flaw can expose internal resources such as cloud metadata services and co-located infrastructure.
🔗 Read more 🔗
Source: NVD
🔄
Verba RAG Origin Check Bypass Enables SSRF
Patch affected Verba RAG deployments promptly and limit access to the API where possible. The same-origin middleware bypass combined with SSRF increases exposure to internal network resources.
CVE-2026-65317 is a HIGH vulnerability with CVSS 8.6 affecting Verba RAG application version 2.1.3. Attackers can bypass the same-origin middleware check with a crafted Origin header and abuse the ‘/api/connect’ endpoint to force arbitrary outbound HTTP requests. This creates a server-side request forgery condition against attacker-selected destinations.
🔗 Read more 🔗
Source: NVD
🧠
Ollama GGUF Parser Bug Can Crash Servers
Operators exposing Ollama upload or model management APIs should update quickly and avoid processing untrusted GGUF files until patched. The issue can reliably disrupt service.
CVE-2026-65315 is a HIGH vulnerability with CVSS 7.5 affecting Ollama at HEAD f0078ae. An uncontrolled memory allocation flaw in the GGUF metadata parser allows crafted model files to trigger out-of-memory failures or runtime panics. Successful exploitation can crash the entire server process.
🔗 Read more 🔗
Source: NVD
☕
Oracle Java and GraalVM Install Component Takeover Risk
Enterprise teams running the listed Oracle Java or GraalVM versions should apply Oracle updates as part of their next urgent maintenance window. Local privilege abuse can lead to full compromise.
CVE-2026-62574 is a HIGH vulnerability with CVSS 7.8 affecting multiple Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition releases. A low-privileged local attacker can exploit the Install component to compromise affected installations. Successful attacks can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, or Oracle GraalVM Enterprise Edition.
🔗 Read more 🔗
Source: NVD