View Ridge Security
Back to Cyber Hose

WordPress Core TOCTOU race condition enables unauthenticated RCE

WordPress Core RCE during upgrades headlines this run, alongside a cPGuard supply-chain attack and a critical Chrome Android RCE.

📋 ADVISORIES

  • 📄 Source for WordPress Core TOCTOU race condition (CVE-2026-119977) allows unauthenticated RCE during upgrades — github.com

  • 📄 Source for Hackers hijack cPGuard update channel to backdoor Linux servers and steal credentials — support.opsshield.com

🔓 CVEs & KEV

  • CVE-2026-121247 — Google Chrome — CVSS 9.6 — Critical Chrome Dawn RCE: Buffer Overflow Enables Remote Code Execution on Android

  • CVE-2026-116650 — Tanium Threat Response — CVSS 7.5 — Tanium addressed an unauthorized code execution vulnerability in Threat Respo...

  • CVE-2026-116651 — Tanium Threat Response — CVSS 7.5 — Tanium addressed an unauthorized code execution vulnerability in Threat Respo...

  • CVE-2026-121565 — Tanium TanOS — CVSS 7.4 — Tanium addressed an improper certificate validation vulnerability in multiple...

  • CVE-2026-120775 — Tanium Deploy — CVSS 7.2 — Tanium addressed a heap-based buffer overflow vulnerability in Deploy.Tanium ...

  • CVE-2026-116661 — Tanium Enforce — CVSS 6.5 — Tanium addressed an improper access controls vulnerability in Enforce.Tanium ...

  • CVE-2026-116663 — Tanium Enforce — CVSS 6.5 — Tanium addressed an improper access controls vulnerability in Enforce.Tanium ...

  • CVE-2026-116654 — Tanium Threat Response — CVSS 6.5 — Tanium addressed an improper input validation vulnerability in Threat Respons...

  • CVE-2026-116669 — Tanium Discover — CVSS 6.5 — Tanium addressed an improper access controls vulnerability in Discover.Tanium...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check