CVE-2026-116617 permite a usuarios Suscriptor borrar imágenes ajenas en el plugin Motors de WordPress. CVSS 8.1, sin parche oficial confirmado.

TL;DR Maintainers of the PHP dependency manager disclosed two Composer vulnerabilities on October 29, 2026. These security flaws enable arbitrary local file deletion or overwriting during package installation. Moreover, they expose private repository API tokens inside lock files. Developers and build engineers must upgrade to Composer 2.11.0 or 2.2.31 (LTS) immediately. Why It Matters Composer is the foundational dependency manager for the PHP ecosystem, handling billions of monthly package installations via Packagist and over 29,000 stars on GitHub.

TL;DR Maintainers of the PHP dependency manager disclosed two Composer vulnerabilities on October 29, 2026. These security flaws enable arbitrary local file deletion or overwriting during package installation. Moreover, they expose private repository API tokens inside lock files. Developers and build engineers must upgrade to Composer 2.11.0 or 2.2.31 (LTS) immediately. Why It Matters Composer is the foundational dependency manager for the PHP ecosystem, handling billions of monthly package installations via Packagist and over 29,000 stars on GitHub.

CVE-2026-112311 permite borrar archivos sin autenticación en ACF Extended hasta la versión 0.9.2.7. La actualización 0.9.2.8 corrige la falla.

CVE-2026-115497 afecta al plugin Music Store de CodePeople hasta la versión 1.4.7, permitiendo lectura de archivos del servidor sin autenticación.

Bug Bounty Tips Telegram channel gives you tips about bug bounty. Happy Hacking! linktr.ee/abhinavsingwal

TL;DR Attackers have begun CVE-2026-21589 exploitation against self-managed Atlassian servers. Researchers at watchTowr published a full technical breakdown and working proof-of-concept for the arbitrary file read flaw. Days later, threat intelligence firm Previdian Cyber reported honeypot traffic matching the bug. Admins who have not patched Jira, Confluence, Bitbucket or related products should do so now. Why It Matters This flaw needs no login and no user interaction.

TL;DR Atlassian has patched CVE-2026-21589, a critical Atlassian Data Center vulnerability with a CVSS score of 9.3. The arbitrary file access bug lets an unauthenticated attacker read files from the web application root. It affects every version of eight self-managed products, including Jira, Confluence and Bitbucket. Why It Matters Atlassian's self-managed products sit at the heart of many development and IT teams.

TL;DR On October 1, Dell fixed five flaws in Dell System Update (DSU), led by a 9.6 path traversal bug. That flaw can let a remote, unauthenticated attacker run code as root. Version 2.3.0.0 fixes all five issues. Why It Matters Admins use Dell System Update to push firmware and driver updates to Dell PowerEdge servers. Because the tool runs with high privileges, a flaw in it can hand over the whole machine.

TL;DR Attackers are exploiting CVE-2026-104286, a CVSS 9.8 FortiMail vulnerability that lets unauthenticated users write arbitrary files. CISA added it to its Known Exploited Vulnerabilities catalog on October 1. Fixed builds are not out yet, so admins must apply Fortinet's workaround now. Why It Matters Fortinet confirms the threat in its advisory. It says the flaw "has been reported to be exploited in the wild." Soon after, CISA…

TL;DR Canonical has patched three critical LXD vulnerabilities rated CVSS 9.6 to 9.9. Each one lets a low-privileged user or a rogue migration source write or delete files as root on the host. Fixed releases are 4.0.14, 5.0.10, 5.21.8 and 6.10. Why These LXD Vulnerabilities Matter LXD is Canonical's manager for system containers and virtual machines. It runs everything from a single laptop instance to clustered…

CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure.

Threat actors began exploiting CVE-2026-85706 in GitLab just one day after public disclosure, taking advantage of a critical path traversal flaw that can let unauthenticated users read arbitrary files. WatchTowr also reported that mass exploitation is likely soon, while GitLab’s latest patches additionally fix CVE-2026-87719 and several other serious vulnerabilities. #GitLab...

L'article couvre la divulgation et le correctif de deux vulnérabilités critiques affectant la plateforme GitLab. 🔴 Vulnérabilité principale — CVE-2026-85706 (sévérité maximale) Une faille de path traversal a été identifiée dans l'API repository commits de GitLab. Elle résulte d'un confinement de chemin inapproprié et d'une absence d'enforcement d'authentification.