New that day
- highpatchedexploited WordPress Core SQL Injection Vulnerability WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Can be chained with CVE-2026-63030. Added to CISA KEV on 2026-07-21 (federal deadline 2026-08-04).
- highpatchedexploited Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Langflow Langflow Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21 (federal deadline 2026-07-24).
- highpatchedexploited DD-WRT Stack-Based Buffer Overflow Vulnerability DD-WRT DD-WRT DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. Added to CISA KEV on 2026-07-21 (federal deadline 2026-07-24).