Apache Wicket vulnerabilities: a security update fixes 19 flaws, including CVE-2026-84170 upload DoS and XSS bugs. Upgrade to 8.20.0, 9.25.0 or 10.12.0.

Related Posts:

• Critical MediaTek Vulnerabilities Patched in Chipsets
• Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
• Critical FreePBX Vulnerabilities Patched in User Manager

The post Apache Wicket Fixes 19 Vulnerabilities in 8.20.0, 9.25.0 and 10.12.0 appeared first on Daily CyberSecurity.

Two Discourse vulnerabilities, CVE-2026-55674 and CVE-2026-55420, enable cache poisoning XSS and server file reads. Patch to the fixed releases now.

Related Posts:

• SAP Security Patch Day October 2026 Fixes CVSS 10 Cloud SDK Flaw and Three More Critical Bugs
• IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo AI Service
• Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

The post Discourse Vulnerabilities Let Attackers Hijack Pages for Every Visitor and Read Server Files appeared first on Daily CyberSecurity.

An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.

Related Posts:

• Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials
• wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516
• Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027

The post Hackers Exploit Ninja Forms and WPC Product Bundles XSS Flaws to Plant Hidden WordPress Admins appeared first on Daily CyberSecurity.

A JupyterLab Desktop vulnerability, CVE-2026-102530 (CVSS 9.4), turns a malicious server URL into remote code execution. Update to 4.6.2-1 now.

Related Posts:

• Critical Apache PLC4X Flaw Lets Attackers Hijack OPC UA Connections to PLCs
• TeamViewer Fixes Five High-Severity Flaws in Full Client and Host
• Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities

The post JupyterLab Desktop Flaw CVE-2026-102530 Turns a Malicious Server URL Into Code Execution appeared first on Daily CyberSecurity.

A critical Rancher XSS vulnerability tracked as CVE-2026-88804 exposes admin sessions. Update your clusters immediately to prevent system compromise.

Related Posts:

• Ansible Automation Platform Vulnerabilities Allow Exploits
• CVE-2026-48842: Roundcube Webmail Vulnerability Exploited in the Wild
• macOS DesktopServicesHelper LPE Vulnerability Details and PoC Disclosed

The post Critical Rancher XSS Vulnerability Exposes Admin Credentials appeared first on Daily CyberSecurity.

The WordPress 7.1.1 security release fixes 11 flaws, including stored cross-site scripting and path traversal. Update your sites immediately.

Related Posts:

• Linux Kernel Vulnerabilities Exploited in the Wild
• Synology DSM Patches 8 Flaws, Two Critical Unauthenticated
• Critical HCL BigFix Vulnerabilities Expose Admin Accounts

The post WordPress 7.1.1 Fixes 11 Security Flaws, Update Now appeared first on Daily CyberSecurity.