Kerio Connect vulnerability CVE-2026-112353, a stored XSS flaw via SVG attachments, is exploited in the wild to steal mailboxes. Update to 10.0.8p2.

Related Posts:

• Apache Kafka Fixes 12 Vulnerabilities, Including a JWT Bypass That Grants Full Cluster Access
• FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild to Run Commands
• Details and PoC Exploit Released for Jackson-Databind Flaw CVE-2026-110879 (CVSS 9.8)

The post Kerio Connect Vulnerability CVE-2026-112353 Exploited in the Wild to Steal Mailboxes appeared first on Daily CyberSecurity.

Three LiteSpeed Cache vulnerabilities, including stored XSS flaws CVE-2026-113499 and CVE-2026-113500, affect 7M+ WordPress sites. Update to 7.9.2.

Related Posts:

• Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama
• PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
• Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates

The post LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS appeared first on Daily CyberSecurity.

A Roundcube security update fixes 20 flaws, including IMAP command injection and header injection. Upgrade to 1.6.20 or 1.7.5 now.

Related Posts:

• PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
• CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras
• Six Linux Kernel Flaws Disclosed With Public PoC Exploits for Root Access and Container Escape

The post Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection appeared first on Daily CyberSecurity.

An unpatched Shopware vulnerability, CVE-2026-104937, lets stored XSS steal admin tokens and lead to RCE in Shopware 6.7. Restrict media uploads now.

Related Posts:

• Public PoC Exploit Disclosed for CVSS 10.0 GitLab Remote Code Execution Flaw CVE-2026-97229 Affecting 25,766 Hosts
• Critical Nextcloud Collabora Online Flaw CVE-2026-110447 Actively Exploited in the Wild to Deploy Webshells
• Public PoC Exploit Code and Technical Details Disclosed for CVE-2026-74580 Linux vhost Vulnerability (Vghost)

The post Unpatched Shopware Flaw CVE-2026-104937 Turns Stored XSS Into Admin Takeover and RCE appeared first on Daily CyberSecurity.

The WordPress 7.1.3 security update is a WordPress security release that fixes stored XSS, SQL injection and more. Update your site now.

Related Posts:

• CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
• Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
• ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3

The post WordPress 7.1.3 Security Update Fixes Stored XSS, SQL Injection and Five More Flaws appeared first on Daily CyberSecurity.

Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today.

Related Posts:

• Ansible Automation Platform Vulnerabilities Allow Exploits
• CVE-2026-48842: Roundcube Webmail Vulnerability Exploited in the Wild
• Critical Rancher XSS Vulnerability Exposes Admin Credentials

The post WordPress Stored XSS Details and PoC Publicly Disclosed appeared first on Daily CyberSecurity.