Saturday, September 12, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

WordPress ecosystem components dominate the day's critical disclosures, with StellarWP The Events Calendar, wpeverest Everest Forms, and ThemeREX Addons all carrying CVSS 9.8 flaws that expose large numbers of public-facing sites. Critical CVEs totaled 28 (down 51% from 57 the prior day) alongside 49 high-priority entries (down 47% from 93), for 77 CVEs overall. The highest-severity items include CVE-2026-14560 (CVSS 10) in the WordPress teddy-bear-customize-addon plugin, CVE-2026-82617 (CVSS 10) in Apache OpenNLP, and CVE-2026-87988 (CVSS 10) in MistralAI Mistral Vibe. Remote code execution and authentication bypass remain the dominant patterns, and the 14 actively exploited entries reach infrastructure that sits at the network edge, including Citrix NetScaler, Fortinet FortiOS, Cisco Secure Firewall Management Center, MikroTik RouterOS, and ConnectWise ScreenConnect. Prioritize internet-facing remote access and management planes first, restrict administrative interfaces to trusted networks, and confirm fix status for each affected component in the vendor's own advisory.

  • StellarWP The Events Calendar carries two CVSS 9.8 flaws (CVE-2026-78006, CVE-2026-78159) affecting a widely deployed WordPress plugin
  • 28 critical CVEs, down 51% from 57 the previous day
  • 49 high-priority CVEs, down 47% from 93 the previous day
  • Remote code execution and authentication bypass lead the disclosure set, spanning Apache OpenNLP (CVE-2026-82617, CVSS 10), SPIP (CVE-2026-72710, CVSS 9.8), and GetSimpleCMS-CE (CVE-2026-53952, CVSS 9.8)
  • Check WordPress plugin inventories first (Events Calendar, Everest Forms, ThemeREX Addons, teddy-bear-customize-addon), then edge and management appliances
  • 14 CVEs show confirmed active exploitation, including Citrix NetScaler, Fortinet FortiOS, MikroTik RouterOS, ConnectWise ScreenConnect, GitLab (CVE-2026-85706, CVSS 10), and JFrog Artifactory

Immediate action: Internet-facing remote access and management systems need attention first: Citrix NetScaler ADC and Gateway, Fortinet FortiOS and FortiSwitchManager, Cisco Secure Firewall Management Center, MikroTik RouterOS, ConnectWise ScreenConnect, GitLab, and JFrog Artifactory all appear with confirmed exploitation. In parallel, audit WordPress installations for The Events Calendar, Everest Forms, ThemeREX Addons, and teddy-bear-customize-addon, and restrict administrative interfaces to trusted networks where an update cannot be applied immediately. Confirm the fix status and required version for each affected product directly in the vendor's advisory before closing out remediation.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation