pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Search
Search results for “CVE-2026-71362”
Find published research by company, product, platform or technology.
Showing 1–20 of 384 dossiers
WordPress 7.1.2 patches core RCE path as attackers move from probes to active exploitation
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
PHP security release fixes an IPv6 FastCGI ACL bypass across every supported branch
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
The Events Calendar exposes 600,000+ WordPress sites to two comment-preview RCE chains
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
Keycloak patches a critical password-reset flaw that can let unauthenticated attackers take over any account
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
Adobe ships an emergency hotfix for an actively exploited Magento RCE affecting current 2.4.x lines
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Super Forms’ 13,000-site WordPress flaw is being exploited at scale despite its smaller install base
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
Elementor Pro’s unauthenticated file-upload flaw is now being actively exploited
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
Chrome patches a V8 zero-day already being exploited in the wild
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Node.js July security release fixes high-severity HTTP/2 and Permission Model flaws
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
PostgreSQL JDBC 42.7.14 closes authentication and SQL-data leakage flaws
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
Shopify’s 2026-10 API release candidate opens a two-week migration window for breaking app changes
This is more than a routine quarterly version bump. Several 2026-10 changes require code updates or can change order economics and checkout behavior, so Shopify apps need to test against the release candidate before production traffic begins moving to the new stable version.
Cloudflare’s H1 2026 DDoS report shows hyper-volumetric attacks surging while most attacks stay short
Cloudflare’s first half-year DDoS report records 935 network-layer attacks above 1 Tbps and a 519% Q1-to-Q2 increase, but says 96.62% of attacks stayed below 500 Mbps and 90.60% ended within 10 minutes. The figures are Cloudflare-network telemetry, not a neutral census of the internet.
SaaS Capital’s 2026 survey puts median private SaaS ARR per employee at $141K
Private SaaS teams now have a fresher efficiency baseline: median ARR per employee rose to $141,125, and bootstrapped businesses lead equity-backed peers on the metric across company sizes. The same survey family shows bootstrapped $3M–$20M SaaS companies growing more slowly but generally operating with stronger cost discipline.
Web DevelopmentSaaSMarketing & DistributionSaaS OperationsDeveloper ToolsMarketplaces & PlatformsActive dossier
Shopify makes Next Gen Events generally available — a declarative alternative to webhooks
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
Shopify Global Catalog REST API shuts down November 2 — agents must migrate to UCP MCP
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
ChartMogul finds the first 30 days dominate SaaS upgrades — across 10.5 million purchases
New SaaS cohort data challenges the habit of waiting six months to pitch an upgrade. The strongest seat and plan expansion window is the first month, while year-one renewal creates a second chance; AI-native customers are more likely to reactivate after churn.
Google makes Spanner Omni production-ready outside its cloud — with a new licensing boundary
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
Meta blocks TikTok-linked advertising across seven markets, including third-party campaigns
The October 8 policy closes a paid cross-platform acquisition route, including indirect TikTok-link campaigns, while leaving the wider boundaries for independent creators and non-ByteDance destinations unclear.
Flathub replaces its AI-app ban with disclosure, but keeps AI out of submission manifests
Linux app developers no longer face an outright AI-generated-code exclusion, but they must identify affected code and documentation, write manifests without AI assistance and keep agents out of the submission workflow.