Live Web Security Brief for August 5, 2026: APIs, WordPress, and Application Risk

CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

CISA Known Exploited Vulnerabilities | August 4, 2026 | Known Exploited | Apache Tomcat

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.

Why it matters: Apache Tomcat should be tied to a reachable route, enabled component, authentication state, and permanent application fix.

What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.

CISA remediation date: 2026-08-07. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CISA Known Exploited Vulnerabilities | July 27, 2026 | Known Exploited | Fortinet FortiOS

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Why it matters: Fortinet FortiOS commonly protects an internet edge or management boundary. Exposure there can affect remote access, traffic inspection, credentials, and the trust placed in downstream systems.

What to verify: Check the running firmware and model, restrict management access, compare configuration changes and new accounts, preserve independent logs, and rotate credentials if compromise cannot be excluded.

CISA remediation date: 2026-08-10. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-5581: The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to…

NIST National Vulnerability Database | August 5, 2026 | CRITICAL | CVSS 9.1

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via…

Why it matters: CVE-2026-5581 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

Operational focus: Use a WAF as temporary risk reduction where appropriate, but keep the permanent software fix owned.

Open the original NIST National Vulnerability Database record

CVE-2026-70554: MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers…

NIST National Vulnerability Database | August 5, 2026 | CRITICAL | CVSS 9.8