Loading story…
CVE-2026-54614 affects CakePHP DebugKit's MailPreview route in versions earlier than 4.10.3 and 5.2.4. A user-controlled previewName can pass through PHP autoloading and cause unintended application classes to be instantiated without verifying that they extend DebugKit\Mailer\MailPreview. Crafted namespaced values may therefore execute available class constructors—and potentially destructor-based gadget behavior—with impacts ranging from limited information disclosure to file modification or deletion depending on the application’s installed classes.
Exploitation requires access to DebugKit with debug mode enabled, typically in development environments but potentially in publicly exposed or misconfigured production deployments; hostname checks based on local or allowlisted hosts may also be bypassable. CakePHP fixed the issue by rejecting backslashes in preview names and enforcing the expected MailPreview subclass check. Organizations should upgrade to DebugKit 4.10.3 or 5.2.4 or later, disable debug mode outside development, restrict DebugKit access, and exclude development dependencies from production deployments. The reported CVSS v3 score is 4.3 and no public exploits were known at publication.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CakePHP published CVE-2026-54614, an unsafe class-instantiation flaw in DebugKit MailPreview that can permit arbitrary constructor execution when DebugKit is accessible. The issue was fixed in DebugKit versions 4.10.3 and 5.2.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcetenable.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Craft CMS disclosed and patched two **critical** vulnerabilities, `CVE-2025-32432` and `CVE-2024-58136`, that can be chained or abused to achieve **unauthenticated remote code execution** and full compromise of vulnerable servers. The flaws affect Craft CMS `5.x` before `5.6.17`, `4.x` before `4.14.15`, and `3.x` before `3.9.15`; one issue involves insufficient input validation in image transformation functionality, while the other stems from unsafe handling of the `__class` variable in the underlying Yii 2 framework. Researchers and national defenders reported that the vulnerabilities are being **actively exploited in the wild**, with investigations tying attacks to malicious requests targeting the `actions/assets/generate-transform` endpoint and abuse of `__class` parameters. Organizations running exposed Craft CMS instances were urged to patch immediately, review logs for suspicious POST activity, check file and system integrity, and rotate credentials if compromise is suspected.
Aug 15, 2026
Kiteworks released security updates addressing **126 vulnerabilities** across Kiteworks Core, Email Protection Gateway (EPG), and Secure Data Forms (SDF). The most serious flaws affect Core and EPG versions earlier than `9.5.1`, including critical account-takeover vulnerabilities that could expose sensitive files, email workflows, sharing functions, and administrative capabilities. Core fixes also include arbitrary code execution, privilege escalation, and exposure of internal network resources; EPG and SDF fixes address unauthorized data modification, denial of service, and security-bypass issues. The Canadian Centre for Cyber Security issued advisory **AV26-988** urging organizations to review Kiteworks advisories and apply available updates. Administrators should upgrade affected deployments to `9.5.1` or later where applicable, identify internet-facing instances, and investigate suspicious account activity or indications of unauthorized access, particularly before remediation changes alter available evidence.
Oct 2, 2026
A critical unauthenticated server-side request forgery flaw, tracked as **`CVE-2026-78003`**, was disclosed in the **Mailgun for WordPress** plugin and affects versions through **`2.2.0`**. The bug stems from insufficient validation in the plugin's `add_list()` function, allowing attacker-controlled array keys to trigger path traversal and redirect authenticated Mailgun API requests to attacker-controlled endpoints. The issue carries a **CVSS 3.1 score of 9.8** and affects a plugin reported to have more than **80,000 active installations**. Attackers can exploit the flaw to create malicious inbound email-forwarding routes, intercept password reset messages, and ultimately seize **WordPress administrator** accounts. A fix is available in **`2.2.1`**, and defenders were urged to update immediately, rotate Mailgun API keys, and inspect Mailgun routes and mailing-list settings for unauthorized changes. Public detection coverage is also emerging, with a **Nuclei** template for `CVE-2026-78003` submitted to the ProjectDiscovery templates repository.
Aug 25, 2026