SUSE-SU-2026:2838-1 Security update for libexif

This update for libexif fixes the following issues - CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote handling bsc1262000 - CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote decoding bsc1262001 -...

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026)

Last week, there were 201 vulnerabilities disclosed in 171 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 112 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-56227 Capgo - Server-Side Request Forgery via Webhook URL Validation

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these...

CVE-2026-46394

creationtimestamp| type| source ---|---|--- 2026-06-09 19:00:13+00:00| published-proof-of-concept| Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8 2026-06-09 23:00:05+00:00| published-proof-of-concept| Telegram/avQcqITCN0CdPqbuzPd1c2U29MoQRxNSjCudrYTZic4II 2026-07-12 10:00:03+00:00|...

CVE-2026-00000

creationtimestamp| type| source ---|---|--- 2026-06-09 15:00:12+00:00| published-proof-of-concept| Telegram/TPZhP3a04vI9AManDnxQiLM92frB40hJI3gtpEixtxo5IZo 2026-06-09 23:00:05+00:00| published-proof-of-concept| Telegram/avQcqITCN0CdPqbuzPd1c2U29MoQRxNSjCudrYTZic4II...

PT-2026-47173

$1,000 of compute found 21 zero-days in FFmpeg. An autonomous agent called depthfirst scanned roughly 1.5 million lines of C, then wrote a reproducible proof-of-concept for every bug it reported. The shift is that second half. Not a list of suspicious lines for a human to chase, but 21 crashing...

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

PT-2026-46328

Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...

PT-2026-46351

Unauthenticated Local File Inclusion in Abelle = 1.22 versions...

PT-2026-46368

Unauthenticated Local File Inclusion in Skyward = 1.10 versions...

PT-2026-46374

Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...

PT-2026-46340

Unauthenticated Local File Inclusion in Especio = 1.0 versions...

PT-2026-46324

Unauthenticated Local File Inclusion in Rosaleen = 2.8 versions...

PT-2026-46332

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme = 1.2.2 versions...

PT-2026-46362

Unauthenticated Local File Inclusion in Granola = 1.13 versions...

PT-2026-45932

BREAKING: Samsung discloses critical CVE-2026-23786 and CVE-2024-53922 in semiconductor products, enabling potential unauthorized access with patches pending. https://t.co/As20ekaylO...

USN-8371-1: Linux kernel vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...

Wordfence Bug Bounty Program Monthly Report – March 2026

In March 2026, the Wordfence Bug Bounty Program received 1718 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure CVD, urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed. The development comes after a...

PT-2026-43621

Name of the Vulnerable Software and Affected Versions python-engineio versions prior to 4.13.2 Description An attacker can trigger the creation of unnecessary background threads in the server by exploiting the heartbeat mechanism. This occurs when a new connection is received or when a client sen...