New that day
- criticalpatched FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider fof/oauth (composer) ### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth`…
- highpatchedexploited Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28).
- highpatchedexploited Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28).
- highpatchedexploited WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28).