A critical RCE vulnerability in the Breeze Cache WordPress plugin (CVE-2026-3844) allows unauthenticated attackers to upload arbitrary files via the fetch_gravatar_from_remote function when the "Host Files Locally - Gravatars" add-on is enabled. Cloudways released version 2.4.5 to patch the flaw after Wordfence observed active exploitation attempts, and site owners should update immediately or disable the add-on to mitigate risk. #BreezeCache #CVE-2026-3844

Varonis Threat Labs found an Azure Cosmos for PostgreSQL flaw that let attackers bypass server-side validation and inject arbitrary PostgreSQL configuration values through the Azure management API, leading to remote code execution. Microsoft confirmed the issue as an important RCE and released a fix in summer 2025, with the report emphasizing...

Google released an Android update to patch a critical remote code execution vulnerability in the System component tracked as CVE-2026-0073. The flaw affects adbd, requires no user interaction to exploit, and there are currently no reports of in-the-wild exploitation; patches for Wear OS, Pixel Watch, Android XR, and Android Automotive were...

Researchers at Vega documented attacks exploiting CVE-2026-22679 in Weaver E-cology 10.0 beginning mid-March that allowed unauthenticated remote command execution via an exposed debug API. Attackers ran discovery commands and attempted PowerShell payloads and a target-aware MSI (fanwei0324.msi), but endpoint defenses blocked execution and the vendor's March 12 fix removes the vulnerable endpoint; users should apply the update immediately. #CVE-2026-22679 #WeaverE-cology

Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js that stems from unsafe dynamic function generation from schemas. Users should upgrade to protobuf.js 8.0.1 or 7.5.5, audit schema sources, and avoid loading untrusted schemas to mitigate the risk. #protobufjs #EndorLabs

Ivanti Endpoint Manager Mobile has a critical, actively exploited code injection vulnerability (CVE-2026-1340) that can allow unauthenticated remote code execution on Internet-exposed, unpatched appliances. CISA added the flaw to its KEV catalog, ordered federal agencies to patch by April 11 under BOD 22-01, and urged all organizations to apply Ivanti’s January 29 fixes as Shadowserver reports nearly 950 exposed EPMM IPs still online. #CVE-2026-1340 #IvantiEPMM

Two actively exploited vulnerabilities in Fortinet’s FortiClientEMS allow unauthenticated remote code execution: a critical SQL Injection (CVE-2026-21643) and an improper access control/API bypass (CVE-2026-35616). Fortinet has issued hotfixes and upgrades (upgrade 7.4.4→7.4.5+ for the SQLi; apply the hotfix and move to 7.4.7+ for the access control issue) while CISA and Singapore’s...

Two vulnerabilities in Progress ShareFile's Storage Zones Controller can be chained to enable unauthenticated file exfiltration and remote code execution on affected systems. The flaws (CVE-2026-2699 and CVE-2026-2701) were reported by watchTowr and fixed in Progress ShareFile 5.12.4 on March 10, but exposed instances should be patched immediately. #ProgressShareFile #StorageZoneController

PTC Inc. disclosed a critical deserialization vulnerability (CVE-2026-4681) in Windchill and FlexPLM that could allow remote code execution. German authorities have issued emergency warnings while PTC develops patches and provides mitigations, IoCs, and detection guidance. #Windchill #CVE-2026-4681

Oracle released an emergency out‑of‑band patch for a critical unauthenticated remote code execution vulnerability tracked as CVE‑2026‑21992 that affects Oracle Identity Manager and Oracle Web Services Manager. Organizations should apply the Security Alert patches immediately for supported versions to mitigate the high‑severity risk posed by remote attackers. #OracleIdentityManager #OracleWebServicesManager...

Oracle has released security updates to fix a critical, remotely exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager that could allow unauthenticated remote code execution. Oracle and the NVD warn the flaw is easily exploitable over HTTP and urge affected users to apply the updates immediately. #CVE-2026-21992...