Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

If you run a security team, a large part of the job is responding to change. Something in the environment moves, and you have to work out whether risk moved with it, and how quickly you need to act. Those changes arrive from two different directions, external and internal. Of course, we’re all familiar with the external ones. A new CVE drops, a proof of concept goes public, a ransomware group starts naming your sector. The internal ones start inside your own organization.

CVE-2026-21580 is a stored cross-site scripting vulnerability in Atlassian Confluence Data Center and Server, which the vendor advisory groups together with a privilege escalation component and a security misconfiguration weakness. An attacker persists crafted HTML or JavaScript on a vulnerable instance, and that payload executes later in the browser of whichever user views the affected content. The vulnerability carries a CVSS 4.0 base score of 8.6.

CVE-2026-60702 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, that allows a low-privileged attacker with network access over the T3 or IIOP protocols to compromise the server. Oracle published the issue on August 18, 2026, as part of its August 2026 Critical Security Patch Update. The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical).

CVE-2026-19478 is a code injection vulnerability in GitLab Community Edition and Enterprise Edition, caused by improper handling of a GraphQL directive in the application’s API layer. GitLab disclosed the issue and shipped fixes in an ad hoc critical patch release on August 17, 2026, outside its normal twice-monthly security schedule. The vulnerability carries a CVSS base score of 9.4 (Critical) as assigned by GitLab. Exploitation requires no authentication and no user interaction.

An unauthenticated SQL injection vulnerability exists in the jsonArrayContains filter function in GeoTools, the geospatial library that underpins GeoServer. When an OGC filter is evaluated against a PostGIS data store, the value passed to jsonArrayContains is written into the generated SQL statement without escaping, allowing an attacker to alter the query the database executes.

CVE-2026-71362 is an incorrect authorization vulnerability (CWE-863) in Adobe Commerce and Magento Open Source, caused by the platform failing to correctly bind a customer identity to an account session. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical). Exploitation requires no authentication. Adobe’s advisory states that the flaw is exploitable without credentials, does not require administrator privileges, and does not require user interaction.

CVE-2026-26035 is an improper authentication vulnerability (CWE-287) in Fortinet FortiWeb, disclosed by Fortinet on August 12, 2026 in advisory FG-IR-26-158 under the title “Broken access control in the RADIUS type admin group.” The flaw sits in FortiWeb’s remote RADIUS administrator authentication path, where the appliance fails to correctly validate an administrative login before granting access.

CVE-2026-72766 is a type confusion vulnerability in the Send Email node of n8n, an open-source workflow automation platform. The node does not enforce that its message fields hold string values, so a non-string value arriving from a workflow expression can be passed through to the underlying mail library, Nodemailer, which interprets it as a file path or a URL rather than message text. The vulnerability carries a CVSS v3.1 base score of 7.5 (High). Under CVSS v4.0 it scores 8.2 (High).

CVE-2026-20349 is a denial of service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw stems from insufficient error checking when the service processes HTTP requests. The vulnerability carries a CVSS v3.1 base score of 8.6 (High). Cisco tracks it under CWE-244.

CVE-2026-34265 is a memory corruption vulnerability in the Application Server ABAP component of SAP NetWeaver and the ABAP Platform. The flaw stems from logical errors in how the SAP kernel parses DIAG protocol messages, the proprietary protocol that carries traffic between the SAP GUI presentation layer and the application server. Malformed input reaching the parser leads to an out-of-bounds write, classified as CWE-787. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).