path-traversal

Atlassian File Access Vulnerability in Data Center

By Editorial Team | October 8, 2026

Atlassian Data Center file access vulnerability CVE-2026-21589 (CVSS 9.3) hits eight products with no login. No exploitation reported yet. Patch now.

The Atlassian file access vulnerability CVE-2026-21589 (CVSS 9.3) lets an unauthenticated attacker read files from the web root of eight self-hosted products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Every version is affected until it is upgraded. CISA lists it as exploited, and the patched releases are out. What decides…

FortiMail Zero-Day Vulnerability Exploited in the Wild

By Editorial Team | October 5, 2026

A FortiMail zero-day vulnerability lets attackers write files with no login. Exploited now; fixes for 7.4, 7.6 and 8.0 were pending at disclosure.

A FortiMail zero-day vulnerability, CVE-2026-104286 (CVSS 9.8), lets an unauthenticated attacker write arbitrary files onto Fortinet’s email security appliance with nothing more than crafted web requests. Fortinet confirmed active exploitation on October 1, CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, and fixed releases for the 7.4, 7.6 and 8.0…

GitLab Path Traversal Vulnerability: Patch Now

By Editorial Team | September 21, 2026

A critical GitLab path traversal vulnerability lets attackers read any file from self-managed servers with no login. Active exploitation confirmed.

A critical GitLab path traversal vulnerability, CVE-2026-85706 (CVSS 10.0), lets an unauthenticated attacker read any file off a self-managed GitLab server, including credentials, deploy keys, and CI/CD configuration. GitLab shipped a patch on September 10; CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day, and BSI issued its own warning on…

CVE-2026-48282 Adobe ColdFusion RCE Exploited in 2 Hours

By Editorial Team | July 9, 2026

CVE-2026-48282 Adobe ColdFusion RCE is now the fastest-weaponized CVSS-10.0 flaw DIESEC has tracked in 2026: attackers began exploiting Adobe’s maximum-severity ColdFusion vulnerability within two hours of public disclosure, and CISA has given US federal agencies until July 10 to patch. What Happened Adobe’s APSB26-68 security bulletin, released June 30, 2026, patched 11 CVEs across ColdFusion,…

OPNsense CVE-2026-57155: Root RCE via GeoIP Alias

By Editorial Team | July 7, 2026

OPNsense CVE-2026-57155 (CVSS 9.9) is a path-traversal flaw in the firewall’s GeoIP alias importer that lets a low-privileged user escalate to full root remote code execution. It is the fifth critical or high-severity OPNsense vulnerability disclosed since May 2026, and it matters disproportionately for German Mittelstand IT teams and MSPs because OPNsense’s free, open-source model…