Today's Top Cybersecurity News – February 26, 2026 1. CVE-2026-3057: SQL Injection in pearProjectApi Backend Task.php dateTotalForProject A remote SQL injection vulnerability exists in the dateTotalForProject function of pearProjectApi up to version 2.8.10, allowing attackers to manipulate the projectCode argument. The exploit is publicly available, increasing the risk of unauthorized data access or modification. Sources: Cvefeed https://cvefeed.io/vuln/detail/CVE-2026-3057 2. Critical Authentication Bypass and Privilege Escalation Vulnerabilities in Cisco Catalyst SD-WAN Multiple critical vulnerabilities in Cisco Catalyst SD-WAN products allow unauthenticated remote attackers to bypass authentication, escalate privileges to admin or root, and take full control of affected devices. Notably, CVE-2026-20127 has been actively exploited in zero-day attacks since 2023, enabling attackers to compromise controllers and insert rogue peers into networks. Users are urged to identify vulnerable devices, collect forensic data, update to patched versions, and conduct threat hunting. Sources: Bleepingcomputer, Cvefeed, Cyberscoop, Feedburner, Gbhackers, Kyberturvallisuuskeskus, Rapid7, Talosintelligence, Therecord https://www.kyberturvallisuuskeskus.fi/fi/kriittisia-haavoittuvuuksia-cisco-catalyst-sd-wan-tuotteissa 3. Multiple Critical and High Vulnerabilities Found in Binardat 10G08-0800GSM Network Switch A series of critical and high-severity vulnerabilities have been identified in Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209. These include hard-coded credentials, predictable session IDs, plaintext password exposure, weak encryption, and command injection, exposing devices to unauthorized access, credential compromise, and remote code execution. Medium-severity issues such as missing login rate limiting, CSRF, and XSS further increase the attack surface. Sources: Bleepingcomputer, Cvefeed, Securityweek https://cvefeed.io/vuln/detail/CVE-2026-27521 4. Multiple Vulnerabilities Disclosed Including Critical Path Traversal in Local Path Provisioner Several security vulnerabilities were disclosed affecting various platforms including Octopus Deploy, Red Hat Developer Hub, openSUSE, Udisks, Rancher CLI, and Local Path Provisioner. Notably, a critical path traversal vulnerability in Local Path Provisioner allows attackers to overwrite sensitive files, while other issues range from denial of service to unauthorized access of encryption metadata. Sources: Cvefeed https://cvefeed.io/vuln/detail/CVE-2026-0704 5. Multiple Critical Vulnerabilities in FreeRDP Affecting Versions Prior to 3.23.0 FreeRDP versions before 3.23.0 contain multiple severe vulnerabilities including heap-use-after-free, out-of-bounds writes, integer overflow, and denial-of-service flaws. These issues can lead to client or server crashes, memory corruption, and potential remote code execution, especially when interacting with malicious RDP servers or crafted data. A patch addressing all these vulnerabilities is available in version 3.23.0. Sources: Cvefeed https://cvefeed.io/vuln/detail/CVE-2026-27951 Stay sharp. Stay secure. #NerdieNews #InfoSec #CyberSecurity #TechNews #DataSecurity #CyberThreats
Post summary
The post highlights multiple critical CVEs, noting active exploitation of a Cisco SD‑WAN vulnerability and publicly available exploits for a SQL injection. Patches are available for several, but some remain unpatched.
