Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-81891 is an unrestricted file upload vulnerability in Studio 42 elFinder, an open source web file manager embedded in a wide range of PHP applications and content management systems. The flaw sits in the checkExtractItems() function in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize().

Attack surface management (ASM) is the discipline of continuously discovering, inventorying, assessing, and prioritizing every asset, control, and exposure across your environment. It gives you an always-on picture of what you actually have, rather than a point-in-time scan. Done right, it answers the three questions every security leader is really asking: What do I have? Where am I exposed? What do I fix first?

If you run a security team, a large part of the job is responding to change. Something in the environment moves, and you have to work out whether risk moved with it, and how quickly you need to act. Those changes arrive from two different directions, external and internal. Of course, we’re all familiar with the external ones. A new CVE drops, a proof of concept goes public, a ransomware group starts naming your sector. The internal ones start inside your own organization.

CVE-2026-21580 is a stored cross-site scripting vulnerability in Atlassian Confluence Data Center and Server, which the vendor advisory groups together with a privilege escalation component and a security misconfiguration weakness. An attacker persists crafted HTML or JavaScript on a vulnerable instance, and that payload executes later in the browser of whichever user views the affected content. The vulnerability carries a CVSS 4.0 base score of 8.6.

CVE-2026-60702 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, that allows a low-privileged attacker with network access over the T3 or IIOP protocols to compromise the server. Oracle published the issue on August 18, 2026, as part of its August 2026 Critical Security Patch Update. The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical).

An unauthenticated SQL injection vulnerability exists in the jsonArrayContains filter function in GeoTools, the geospatial library that underpins GeoServer. When an OGC filter is evaluated against a PostGIS data store, the value passed to jsonArrayContains is written into the generated SQL statement without escaping, allowing an attacker to alter the query the database executes.

CVE-2026-19478 is a code injection vulnerability in GitLab Community Edition and Enterprise Edition, caused by improper handling of a GraphQL directive in the application’s API layer. GitLab disclosed the issue and shipped fixes in an ad hoc critical patch release on August 17, 2026, outside its normal twice-monthly security schedule. The vulnerability carries a CVSS base score of 9.4 (Critical) as assigned by GitLab. Exploitation requires no authentication and no user interaction.

It comes as no surprise that the Mythos era continues to put pressure on security teams: it’s never been easier for attackers to find and weaponize vulnerabilities at scale, and comparable capability is only becoming more available. The gap between a CVE’s disclosure and its exploitation is compressing fast, while patches still take days to weeks to roll out.

CVE-2026-71362 is an incorrect authorization vulnerability (CWE-863) in Adobe Commerce and Magento Open Source, caused by the platform failing to correctly bind a customer identity to an account session. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical). Exploitation requires no authentication. Adobe’s advisory states that the flaw is exploitable without credentials, does not require administrator privileges, and does not require user interaction.

CVE-2026-26035 is an improper authentication vulnerability (CWE-287) in Fortinet FortiWeb, disclosed by Fortinet on August 12, 2026 in advisory FG-IR-26-158 under the title “Broken access control in the RADIUS type admin group.” The flaw sits in FortiWeb’s remote RADIUS administrator authentication path, where the appliance fails to correctly validate an administrative login before granting access.