NVIDIA has released critical security updates addressing two significant vulnerabilities in its Container Toolkit and GPU Operator.

A critical flaw in the n8n automation platform could allow attackers to execute arbitrary code if exploited under specific conditions.

TL;DR Adobe shipped fixes for 11 Adobe ColdFusion vulnerabilities on 30 June 2026. Six earn a perfect CVSS score of 10.0 and allow arbitrary code execution. Adobe rates the update priority 1, its most urgent tier. The company reports no exploits in the wild. Why It Matters ColdFusion servers often sit on the public internet. So attackers scan them for fresh bugs fast.

 A maximum-severity vulnerability in SAP Commerce Cloud is reportedly facing exploitation attempts only days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and affects the platform’s Data Hub Adapter component. Its rapid targeting highlights the risks organizations face when internet-facing enterprise software remains unpatched.  The vulnerability stems from insufficient authorization checks and inadequate input validation. According to the vulnerability description, an unauthenticated attacker can abuse a default authentication client and submit specially crafted input to functions that do not properly validate requests. Successful exploitation could allow arbitrary code execution and enable attackers to compromise internal components, potentially affecting the confidentiality, integrity, and availability of affected Commerce Cloud environments.  Threat intelligence company Defused Cyber reportedly observed exploitation attempts against its honeypot systems approximately three days after the patch was released. However, the company stated that the activity did not include a publicly available proof-of-concept and that confirmed exploitation in customer environments had not been established at the time of reporting. Even so, the short gap between patch availability and attack activity demonstrates how quickly threat actors can reverse-engineer or operationalize information about critical enterprise vulnerabilities.  SAP security specialists have urged customers to treat the issue as an emergency. Organizations using the affected Commerce Cloud release should apply the fixed version identified in SAP’s security guidance, rebuild the updated application, and redeploy it. Simply installing a component update may not be sufficient if the deployment process requires rebuilding and publishing a refreshed Commerce Cloud version. Administrators should also review logs, authentication activity, unusual requests, and unexpected changes to internal services for possible indicators of compromise.  If immediate patching is not possible, organizations can temporarily reduce exposure by configuring an IP Filter Set to restrict access to the vulnerable endpoint. Network controls should be considered only as a short-term mitigation, not a replacement for the official update. Security teams should identify all internet-facing SAP Commerce Cloud instances, confirm their versions, limit unnecessary access, and increase monitoring around the Data Hub Adapter. Previous attacks against critical SAP products, including NetWeaver, show that criminal and espionage groups have targeted SAP flaws for code execution, persistence, and data theft.

TL;DR Adobe published a Priority 1 security update for Adobe Campaign Classic. The patch resolves seven severe flaws, including three bugs with a CVSS score of 10.0. Consequently, attackers can exploit these issues to achieve arbitrary code execution on vulnerable servers. Why It Matters Marketing departments rely heavily on automation platforms to manage customer data. Therefore, these arbitrary code execution vulnerabilities place enterprise networks at extreme risk.

TL;DR Palo Alto Networks disclosed a PAN-OS buffer overflow tracked as CVE-2026-0288. It sits in the User-ID Terminal Server Agent. An unauthenticated attacker on the network could crash the firewall or run code. The vendor rates it CVSS 7.2 and reports no known exploitation. Why it matters PAN-OS firewalls guard the edge of many enterprise networks. So a bug that allows arbitrary code execution there is serious.

TL;DR Foxit shipped Foxit PDF Reader 2026.1.2 and PDF Editor 2026.1.2 for Windows. The release fixes 28 security flaws. Twenty of them can lead to arbitrary code execution when someone opens a crafted PDF. So far, no vendor or researcher has confirmed active exploitation or a public proof-of-concept. Why it matters Foxit PDF Reader sits on millions of Windows desktops. Therefore, a single document-parsing bug can reach a wide audience.

TL;DR Researchers disclosed two UltraVNC repeater vulnerabilities in the tool's HTTP admin server. One allows arbitrary code execution without any login. The other exposes a hardcoded admin password. Both flaws affect the repeater through version 1.8.2.2. Why It Matters The UltraVNC repeater relays remote desktop sessions across networks. So it often sits at a network edge. A remote attacker who reaches its web port gains a foothold.

  A severe security flaw has been identified in the n8n workflow automation platform that could allow attackers to run arbitrary code in specific scenarios. The vulnerability, assigned CVE-2025-68613, has been rated 9.9 on the CVSS scale, highlighting its critical severity.  The issue was discovered and responsibly disclosed by security researcher Fatih Çelik. According to npm data, the affected package sees approximately 57,000 downloads each week. "Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime," the maintainers of the npm package said.  "An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations." The vulnerability impacts all n8n versions starting from 0.211.0 up to, but not including, 1.120.4. The issue has been resolved in releases 1.120.4, 1.121.1, and 1.122.0. Data from attack surface management firm Censys indicates that as of December 22, 2025, around 103,476 n8n instances could still be exposed. Most of these potentially vulnerable deployments are based in the United States, Germany, France, Brazil, and Singapore. Given the seriousness of the flaw, users are strongly urged to update their installations immediately. For environments where patching cannot be carried out right away, security experts recommend restricting workflow creation and editing rights to trusted users only. Additionally, deploying n8n within a hardened setup with limited operating system privileges and controlled network access can help reduce the risk of exploitation.

A severe security vulnerability in the Insomnia API Client, a widely used tool by developers and security testers for interacting with APIs.

A threat actor posted about the zero-day exploit on the same day that Fortinet published a warning about known vulnerabilities under active exploitation.

Security researchers have discovered vulnerabilities in Windows 11's core security features that could allow attackers to bypass multiple protection mechanisms and achieve arbitrary code execution at ...

execution of system-level actions read more about Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances