CISA KEV entry for the CVE-2026-71362 incorrect authorization flaw in Adobe Commerce and Magento shows date added 2026-09-24. Federal agencies must apply mitigations by 2026-09-27 under BOD 26-04 rules.
CVE-2026-71362 allows unauthorized access without user interaction.
Stakeholders must assess internet exposure.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
IBM disclosed CVE-2026-16841, a high-severity stack buffer overflow in AIX 7.2, 7.3 and PowerVM VIOS 4.1 that could allow remote arbitrary code execution with a CVSS score of 8.8. The flaw, published August 19 2026, requires prompt patching on affected enterprise Unix and virtualization platforms. Direct NVD page not yet surfaced in searches; support page referenced in related IBM AIX CVE reports.
IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 allow privilege escalation through a specially crafted query. CVE-2026-10543 carries a CVSS 3.1 score of 8.2 high, stems from improper authorization (CWE-285), and was published August 12, 2026. An IBM advisory is available.
ChainDrop, a self-propagating worm, has compromised more than 1,300 npm packages responsible for 2 billion combined monthly downloads, including Keyv, Cacheable and utilities tied to Deliveroo, Picsart, Qlik and others. The malware steals a broad array of developer and cloud credentials from infected systems and CI/CD environments, requiring any impacted machine to be treated as fully breached.
Zyxel disclosed CVE-2026-6837, a command injection vulnerability in the export-cgi program of WAX650S firmware through version 7.10(ABRM.4)C0 that lets authenticated administrators execute OS commands. The flaw scores 7.2 on CVSS v3.1 and was published August 3, 2026.
NVD has published CVE-2026-67308 for a shell injection vulnerability in Wazuh workflows before 44bf114. Attackers can reportedly execute arbitrary commands and exfiltrate GITHUB_TOKEN plus AWS credentials on self-hosted runners by submitting pull requests with crafted VERSION.json files. The record, received from VulnCheck on August 1 2026, carries a CVSS 3.1 score of 10.0 critical from the CNA.
