Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

An unauthenticated SQL injection vulnerability exists in the jsonArrayContains filter function in GeoTools, the geospatial library that underpins GeoServer. When an OGC filter is evaluated against a PostGIS data store, the value passed to jsonArrayContains is written into the generated SQL statement without escaping, allowing an attacker to alter the query the database executes.

CVE-2026-19478 is a code injection vulnerability in GitLab Community Edition and Enterprise Edition, caused by improper handling of a GraphQL directive in the application’s API layer. GitLab disclosed the issue and shipped fixes in an ad hoc critical patch release on August 17, 2026, outside its normal twice-monthly security schedule. The vulnerability carries a CVSS base score of 9.4 (Critical) as assigned by GitLab. Exploitation requires no authentication and no user interaction.

We benchmarked how well leading models produce vulnerability fixes that are both secure and functional, across ~150 real vulnerable code samples in JavaScript, Java, and Python. We ran each model on its own and with Snyk Intelligence (the new agentic Agent Fix architecture). The headline findings.

This post is an unfortunate affirmation of our prior research into abandoned open-source packages, where we found that 11% of the most-downloaded packages have been abandoned and not actively maintained, becoming invisible vulnerabilities to your scanner. Today we share a zip-slip vulnerability we found in extract-zip (CVE-2026-19693), an npm package with over 20 million weekly downloads.

CVE-2026-55040, a critical SharePoint authentication bypass, is now being actively exploited. A proof-of-concept went public on August 11. Within 24 hours, threat intelligence firm Defused confirmed exploitation attempts against its SharePoint honeypots using that same PoC. Over 8,500 SharePoint servers remain reachable from the open internet, putting unpatched instances at immediate risk.

Attackers are using compromised hotel Wi-Fi routers to redirect users to Microsoft 365 phishing sites, according to researchers at ReliaQuest. The attacks were observed in multiple U.S. cities, as well as across India and Saudi Arabia. These types of DNS poisoning attacks can send users to phishing sites with very little evidence that something suspicious has taken place.

Security teams can’t remediate every vulnerability the moment it appears, so prioritization must separate urgent, business-critical risks from noise. This is complicated by the fact that traditional scoring methods like CVSS often lack the context needed to decide what should be fixed first. The Stakeholder-Specific Vulnerability Categorization (SSVC) framework is one option many organizations use to fill this gap as part of automating vulnerability prioritization.

CVE-2026-26035 is an improper authentication vulnerability (CWE-287) in Fortinet FortiWeb, disclosed by Fortinet on August 12, 2026 in advisory FG-IR-26-158 under the title “Broken access control in the RADIUS type admin group.” The flaw sits in FortiWeb’s remote RADIUS administrator authentication path, where the appliance fails to correctly validate an administrative login before granting access.