CVE-2026-26980Vulnerability

Reported by 2 independent sources · first reported 21 Sep 2026 by The Register (security) · last reported 7 Oct 2026

Last reported 17 days ago

What the reports say

2 reports, newest first · the exact sentence from each

“The two vulnerabilities that have witnessed active exploitation efforts are CVE-2026-26980, an SQL injection flaw in Ghost CMS, and CVE-2026-61500, a session forgery flaw in Rejetto HTTP File Server.”

The Hacker NewsNews7 Oct 2026
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
“…ead on the real Glasswing ‘danger factor.’" As of Monday, the CVE count is 225, and just one, a critical SQL injection bug in Ghost (CVE-2026-26980), has been exploited in the wild.”

The Register (security)News21 Sep 2026
Anthropic-linked CVEs pile up, attackers mostly shrug

named in the same reports

Also named with it: CVE-2026-61500

Thanks — we review every report.

Report a wrong value