Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-71362 is an incorrect authorization vulnerability (CWE-863) in Adobe Commerce and Magento Open Source, caused by the platform failing to correctly bind a customer identity to an account session. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical). Exploitation requires no authentication. Adobe’s advisory states that the flaw is exploitable without credentials, does not require administrator privileges, and does not require user interaction.

CVE-2026-26035 is an improper authentication vulnerability (CWE-287) in Fortinet FortiWeb, disclosed by Fortinet on August 12, 2026 in advisory FG-IR-26-158 under the title “Broken access control in the RADIUS type admin group.” The flaw sits in FortiWeb’s remote RADIUS administrator authentication path, where the appliance fails to correctly validate an administrative login before granting access.

Most AI code review tools fail the same way. They work, in the sense that comments appear on the pull request. Then you read the comments and they are 80% “consider extracting this into a helper”, “missing test coverage”, “this variable name could be clearer”, and within a couple of weeks everyone has learned to scroll past anything the bot wrote. These are not false positives. They are true and irrelevant, which costs the same attention and is harder to argue with.

CVE-2026-72766 is a type confusion vulnerability in the Send Email node of n8n, an open-source workflow automation platform. The node does not enforce that its message fields hold string values, so a non-string value arriving from a workflow expression can be passed through to the underlying mail library, Nodemailer, which interprets it as a file path or a URL rather than message text. The vulnerability carries a CVSS v3.1 base score of 7.5 (High). Under CVSS v4.0 it scores 8.2 (High).

CVE-2026-20349 is a denial of service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The flaw stems from insufficient error checking when the service processes HTTP requests. The vulnerability carries a CVSS v3.1 base score of 8.6 (High). Cisco tracks it under CWE-244.

CVE-2026-34265 is a memory corruption vulnerability in the Application Server ABAP component of SAP NetWeaver and the ABAP Platform. The flaw stems from logical errors in how the SAP kernel parses DIAG protocol messages, the proprietary protocol that carries traffic between the SAP GUI presentation layer and the application server. Malformed input reaching the parser leads to an out-of-bounds write, classified as CWE-787. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-58048 is a privilege escalation vulnerability in the database management functionality of cPanel & WHM, the hosting control panel developed by WebPros. An authenticated cPanel account holder with access to the MySQL/MariaDB database feature can execute arbitrary database commands with full administrative privileges, rather than being confined to the databases and grants tied to their own account. The CVE record carries a CVSS v4.0 base score of 9.4 (Critical).

Two weeks ago I sat in on a webinar where CyCognito’s founders walked through continuous AI pentesting. The framing stayed with me: the pentest itself has not changed, only who runs each part of it. AI has reached nearly every corner of cybersecurity, and pentesting is no exception. The promise is an agent that probes applications, uncovers flaws scanners miss, and delivers a report before a human tester has finished scoping the engagement.

The July 2026 Apache Traffic Server security release addresses a large batch of vulnerabilities across the proxy core and its plugin ecosystem, disclosed on July 29, 2026 and fixed in versions 9.2.15 and 10.1.4. Published counts of the batch differ. The Apache Traffic Server project describes the release as addressing 34 CVEs, while Belgium’s Centre for Cybersecurity puts the figure at 38 vulnerabilities.