Tier 1: CVE-2021-48017 affects OrbiTeam BSCW Server. The unauthenticated path traversal is actively exploited in the wild and can expose local files, credentials and configuration data Analysis: github.com/alan-turing-insti… #CyberSecurity #PathTraversal #GovernmentSecurity

Tier 1: CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM Unauthenticated SQL injection is actively exploited in the wild and can expose user wallets, payment records, bank-transfer data and financial commission github.com/alan-turing-insti… #CyberSecurity #SQLInjection

CVE-2026-112252 affects the Wubang Safety Management System. Unauthenticated SQL injection can expose backend data and, where xp_cmdshell is enabled, lead to remote code execution. Analysis: github.com/alan-turing-insti… #CyberSecurity #RCE #CriticalInfrastructure

CVE-2026-78164 affects Apache Camel. Property-placeholder injection can expose environment variables, JVM properties and cloud or vault secrets from vulnerable integration routes. Analysis: github.com/alan-turing-insti… #CyberSecurity #APISecurity #CloudSecurity

CVE-2025-10149 affects WSO2 Identity Server. A SCIM authorisation flaw can let authenticated federated users take over colliding local accounts, including privileged identities. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #IAM

Tier 1: CVE-2026-110447 affects Nextcloud’s Collabora Online Built-in CODE Server. The unauthenticated RCE is actively exploited in the wild and can deploy webshells, leading to full Nextcloud server compromise. Analysis: github.com/alan-turing-insti… #CyberSecurity #Nextcloud #RCE

CVE-2026-111911 affects phpMyFAQ WebAuthn. Unauthenticated attackers can register a malicious passkey against another user’s account, bypassing passwords and TOTP when WebAuthn is enabled. Analysis: github.com/alan-turing-insti… #CyberSecurity #WebAuthn #DigitalIdentity

CVE-2026-35268 affects Oracle Identity Manager. An unauthenticated RCE flaw could compromise enterprise identity-management infrastructure and expose high-value access-control systems. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #IAM

CVE-2026-111924 affects Fleet endpoint management. Unauthenticated gzip requests can exhaust server memory and crash the service, disrupting device management and security visibility. Analysis: github.com/alan-turing-insti… #CyberSecurity #MDM #InfrastructureSecurity

CVE-2026-111911 affects phpMyFAQ. Unauthenticated attackers can register a WebAuthn passkey to another user’s account and bypass password and TOTP protections. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #WebAuthn

CVE-2026-85922 affects Azure Key Vault. An authentication-bypass flaw could expose keys, certificates and secrets used across cloud identity and regulated services. Analysis: github.com/alan-turing-insti… #CyberSecurity #Azure #DigitalIdentity

CVE-2026-69802 affects Microsoft Active Directory Certificate Services/NDES. Unauthenticated RCE could compromise certificate-issuance infrastructure underpinning enterprise and government authentication. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #PKI

Tier 1: CVE-2026-104935 affects Ivanti Connect Secure. Actively exploited authentication bypass can lead to unauthenticated RCE, root compromise and theft of AD credentials. Analysis: github.com/alan-turing-insti… #CyberSecurity #Ivanti #VPN

CVE-2026-41510 affects OWASP Coraza WAF. Unauthenticated attackers can bypass WAF inspection or exhaust proxy memory using crafted requests against default configurations. Analysis: github.com/alan-turing-insti… #CyberSecurity #WAF #InfrastructureSecurity

CVE-2026-109372 affects ZITADEL SAML federation. A provider-confusion flaw can allow cross-organisation account takeover where the required admin permissions and multi-provider configuration are present. Analysis: github.com/alan-turing-insti… #CyberSecurity #SAML #DigitalIdentity

CVE-2026-109373 affects ZITADEL. Forged session cookies can allow unauthenticated attackers to hijack user sessions and bypass MFA, including for administrator accounts. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #MFA

CVE-2026-108718 affects Rill’s OAuth server. A malicious OAuth client can obtain a non-expiring API token with a victim’s permissions after they follow a crafted authorisation link. Analysis: github.com/alan-turing-insti… #CyberSecurity #OAuth #DigitalIdentity

CVE-2026-106608 affects WooCommerce. An authenticated privilege-escalation flaw can turn a compromised user account into full administrator access. Analysis: github.com/alan-turing-insti… #CyberSecurity #WooCommerce #EcommerceSecurity

CVE-2026-96765 affects the WPO365 Microsoft SSO plugin for WordPress. Unauthenticated stored XSS could hijack an administrator session when the plugin configuration page is opened. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #SSO

CVE-2026-104759 affects the WPO365 Microsoft SSO plugin for WordPress. An OIDC token replay flaw could give attackers administrator access and full site control. Analysis: github.com/alan-turing-insti… #CyberSecurity #DigitalIdentity #OIDC