Vulnerabilities coverage from Firewall Pulse holds 18 articles, 8 of them reference guides. The newest was published on October 10, 2026. New stories are added as soon as they are confirmed, from more than 50 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include FIRST: Common Vulnerability Scoring System and MITRE CWE.
Threat actors are actively exploiting unpatched flaws in the AhsayCBS backup management platform to install webshells and cryptocurrency mining software.
Two security issues in AWS Ops Wheel allow potential exposure of sensitive cloud infrastructure configurations to unauthorized users.
The National Vulnerability Database rates CVE-2026-62046 as critical, warning that untrusted data handling in the Gutentype plugin enables object injection.
Deserialization of untrusted data in the Convex plugin exposes WordPress sites to remote object injection attacks requiring immediate attention.
A critical authentication bypass in the WPCOM Member plugin for WordPress allows attackers to hijack admin accounts by forging social login sessions without valid credentials.
A critical vulnerability in the ThemeREX Greeny WordPress theme allows object injection through untrusted data deserialization in versions up to 2.10.0.
A high-severity injection flaw in older versions of the TinaCMS CLI allows attackers to execute arbitrary code during preview builds by manipulating Git branch names.
Most administrative interfaces remain accessible to the public internet because default configurations prioritise convenience over isolation, leaving the back door open.
Removing unnecessary permissions breaks the chain of lateral movement, forcing attackers to compromise every single account individually rather than escalating from one foothold.
Unstructured patching breaks business logic more often than it prevents exploitation, turning routine maintenance into a primary source of downtime.
Use-after-free flaws let attackers execute code by manipulating memory after the system has released it, often bypassing standard network defences.
N-day vulnerabilities force you to act on known exploits before attackers can automate widespread damage to your infrastructure.
Tightening system settings reduces the attack surface but often breaks functionality, forcing teams to choose between security and operational stability.
Attackers exploit the fact that private package registries often prioritise internal packages over public ones, allowing malicious code to be pulled into secure networks.
Federal agencies must mitigate the ProFTPD file copy flaw by 11 October after CISA added it to the Known Exploited Vulnerabilities catalog.
A critical flaw in the Sipay OpenCart module allows attackers to bypass cryptographic signature checks and spoof transaction data.
The US government has added CVE-2015-5477 to its catalog, requiring teams to mitigate the high-severity remote DoS vulnerability within three days.
Align security urgency with operational stability by using structured testing, rollback plans, and clear communication channels to prevent outages during critical updates.