CVE-2026-77806 (CVSS 9.8) is a SPIP unauthenticated RCE exploited in the wild, with public exploit code now available. Update to SPIP 4.4.21 now.

Related Posts:

• EverShop CVE-2026-72843 Flaw Allows Unauthenticated Account Takeover
• Spring Data REST and Spring AI Vulnerabilities: Four High-Severity Flaws Patched
• CVE-2026-75501: Public PoC for Calix Router Flaw That Bypasses NAT and Firewall Protections

The post CVE-2026-77806: SPIP Unauthenticated RCE Exploited in the Wild as Public Exploit Lands appeared first on Daily CyberSecurity.

CVE-2026-77647 (CVSS 9.8) is an unauthenticated SPIP remote code execution flaw exploited in the wild. Update to SPIP 4.4.20 now.

Related Posts:

• RDK-B WebUI Vulnerabilities Let Attackers Bypass Login
• CVE-2026-18963: Unauthenticated Account Takeover Flaw Hits Keycloak
• CVE-2026-67567 (CVSS 9.9): Red Hat Flaws Enable Privilege Escalation in ACM and FreeIPA

The post CVE-2026-77647 (CVSS 9.8): Unauthenticated SPIP RCE Exploited in the Wild appeared first on Daily CyberSecurity.

WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth XSS on the login screen that can escalate to remote code execution. CVSS 8.9. Update now.

Related Posts:

• Metabase SQL Injection Zero-Day (CVSS 10) Exploited
• Multiple ClamAV Flaws Let Remote Attackers Cause DoS
• CryptoJS Randomness Vulnerability Drains Crypto Wallets

The post CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution appeared first on Daily CyberSecurity.