[CVE-2026-48282]

July 9, 2026

• CISA added actively-exploited Adobe ColdFusion (CVE-2026-48282), Langflow, and two Joomla extension flaws to its KEV catalog, giving federal agencies a Friday deadline. The Langflow auth bypass is the same flaw the LLM-driven JADEPUFFER operator exploited last week. BleepingComputer, The Hacker News · Vulnerabilities & Exploits

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro

July 8, 2026

• The Adobe ColdFusion exploitation story widened: Horizon3 detailed pre-auth unrestricted file upload and path traversal in CVE-2026-48283/CVE-2026-48313, and a public PoC dropped for the actively exploited CVE-2026-48282 (RDS path traversal, CVSS 10.0). Horizon3, PoC · Vulnerabilities & Exploits

in Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM

July 7, 2026

• Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) is under active exploitation. The path-traversal-to-RCE flaw affects ColdFusion 2025 Update 9 and 2023 Update 20 and earlier; KEVIntel reported unauthenticated arbitrary file write/read attempts less than two hours after public details dropped, and Canada's CCCS has warned defenders to patch exposed instances fast (BleepingComputer). · Vulnerabilities & Exploits

in A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary