Software engineering, open source and computer security

CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure.

TL;DR A high-severity decompress npm vulnerability lets crafted archives write files outside the extraction folder. Tracked as CVE-2026-53486, the flaw carries a CVSS score of 9.1. It sits in a library that npm serves more than 2.8 million times each week. So far, no public proof-of-concept or in-the-wild attack has been confirmed. Why This decompress Flaw Matters Archive tools run almost everywhere, from CI pipelines to install scripts.

TL;DR TeamViewer has patched two TeamViewer vulnerabilities in its Desktop Clients. The more severe, CVE-2026-19042, is a command injection flaw in the Linux client that enables remote code execution. A second bug, CVE-2026-16444, allows path traversal and arbitrary file writes. Both are fixed in version 15.81.5. Why It Matters TeamViewer runs on millions of endpoints for remote support and access. These TeamViewer vulnerabilities let a remote attacker run code or write files as the current user.

SolarWinds Serv-U has given us a really good dataset for which files attackers are searching for - let’s see what we can learn!

TL;DR Apache has patched a critical OpenMeetings vulnerability tracked as CVE-2026-49488. The path traversal flaw grants arbitrary file read to any user with moderator rights in a room. Version 9.1.0 fixes the issue, and no exploitation or public proof-of-concept has been confirmed. Why It Matters OpenMeetings powers video conferencing, whiteboards, and document collaboration for many self-hosted deployments. Moderator rights are not a high bar, since organizations often hand them to ordinary staff.

Threat actors began exploiting CVE-2026-85706 in GitLab just one day after public disclosure, taking advantage of a critical path traversal flaw that can let unauthenticated users read arbitrary files. WatchTowr also reported that mass exploitation is likely soon, while GitLab’s latest patches additionally fix CVE-2026-87719 and several other serious vulnerabilities. #GitLab...

L'article couvre la divulgation et le correctif de deux vulnérabilités critiques affectant la plateforme GitLab. 🔴 Vulnérabilité principale — CVE-2026-85706 (sévérité maximale) Une faille de path traversal a été identifiée dans l'API repository commits de GitLab. Elle résulte d'un confinement de chemin inapproprié et d'une absence d'enforcement d'authentification.

TL;DR A critical W3 Total Cache vulnerability lets unauthenticated attackers write files anywhere on the server. Tracked as CVE-2026-18051, it earns the top CVSS score of 10. The plugin runs on more than 900,000 WordPress sites. Why it matters W3 Total Cache is one of WordPress's most popular caching plugins. It improves site speed, SEO, and Core Web Vitals. This flaw needs no login and no user interaction.

TL;DR IBM patched five IBM Aspera vulnerabilities across two products on July 20, 2026. They affect Aspera Faspex 5 and the Aspera Desktop App. The worst flaws reach a CVSS score of 9.3 and allow code execution. Why it matters These IBM Aspera vulnerabilities span two different products. Aspera moves large files for media, research, and enterprise teams. Therefore a server compromise can expose sensitive transfers and stored data.

TL;DR Notepad++ v8.9.7 fixes five security flaws in the popular Windows editor. Technical details and proof-of-concept exploit code for all five Notepad++ vulnerabilities are public in the project's GitHub security advisories. Three carry CVE IDs: CVE-2026-52886, CVE-2026-54758, and CVE-2026-57233. No in-the-wild exploitation has been confirmed so far. Why It Matters Notepad++ ships on millions of developer and admin desktops. Public exploit code removes the research effort attackers would otherwise need.

TL;DR Apache IoTDB has patched three flaws in its time-series database. The worst is a critical path traversal bug, CVE-2026-24014, scored 9.8. A second flaw allows an authentication bypass, and a third causes denial of service. Version 2.0.8 fixes all three. Why it matters Apache IoTDB stores sensor data for many industrial and IoT setups. Many plants run it at the edge and in the cloud.

The Apache project patched three Apache Lucene.NET vulnerability issues in the 4.8.0-beta00018 release. Two of the flaws carry a high CVSS score of 8.9. Both live inside the Lucene.Net.Replicator library. Why This Apache Lucene.NET Vulnerability Set Matters Lucene.Net gives many .NET applications their full-text search features. As a result, one library flaw can reach a wide install base. Two of these bugs also need no authentication, so the risk climbs fast.