Daily Security Brief — today's top actively-exploited and high-severity vulnerabilities.

Daily Security Brief — today's top actively-exploited and high-severity vulnerabilities.
⚡ 4 item(s) name a component we run (patch-watch).

• [CRITICAL] CVE-2026-114432 CVE-2026-114432: The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension o… ⚡
nvd.nist.gov/vuln/detail/CVE-2026-114432
• [HIGH] CVE-2026-18893 CVE-2026-18893: IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and … ⚡
nvd.nist.gov/vuln/detail/CVE-2026-18893
• [HIGH] CVE-2026-123604 CVE-2026-123604: Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop … ⚡
nvd.nist.gov/vuln/detail/CVE-2026-123604
• [HIGH] CVE-2026-123562 CVE-2026-123562: devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in s… ⚡
nvd.nist.gov/vuln/detail/CVE-2026-123562
• [CRITICAL] CVE-2026-6715 CVE-2026-6715: IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorp…
nvd.nist.gov/vuln/detail/CVE-2026-6715
• [CRITICAL] CVE-2026-17466 CVE-2026-17466: IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain se…
nvd.nist.gov/vuln/detail/CVE-2026-17466

Full brief: diginpl.com/security/brief
Sources: CISA KEV, NVD (NIST) and security news. DigiNepal links to each source; nothing is rewritten.