Topic
7 articles
CyberSecureToday covers Web Security across 7 articles published between 22 Sep 2026 and 1 Nov 2026.
The coverage includes 7 vulnerability advisories. 7 advisories are rated critical or high severity, and 3 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.
Stories on Web Security most often intersect with Remote Code Execution, Active Exploitation and WordPress, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Drupal Commerce Core Critical Authorization Bypass Flaw Under Active Exploitation (CVE-2026-118539)”, was published 1 Nov 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
CMS SecurityA highly critical authorization bypass vulnerability (CVE-2026-118539) in Drupal Commerce Core is under active exploitation, allowing order price tampering.
CMS SecurityCVE-2026-119977, an unauthenticated upgrade-window race condition in WordPress Core versions 4.7 to 7.1.3, was targeted in 63,000 automated exploitation probes.
Threat IntelONLYOFFICE patches a critical path traversal vulnerability in Document Server DocService (CVE-2021-3199) allowing arbitrary file overwrite and remote code execution.
Threat IntelCloudflare resolves critical vulnerability CVE-2026-73190 in Workers KV edge caching, where HTTP Range header normalization flaws allowed global cache poisoning.
Threat IntelA critical security flaw in yii2-starter-kit exposes the Gii code generator and debug modules to all remote IP addresses by default, allowing unauthenticated RCE.
CMS SecurityWordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Threat IntelCloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.