Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishers
- Builder
- Builder 24%
- Operator
- Operator 75%
- Investor
- Investor 1%
Reality
- Evidence72
- Adoption58
- Hype gap−20
- Incentives68
- Confidence68
Imperva found that a syntactically valid SQL query under 2MB can drive the SQLGlot parser past 1.5GB of memory, about 750 times the input. Tools that parse user or model-supplied SQL before the database sees it carry the same exposure until they upgrade.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives45
- Confidence55
Imperva found remote denial-of-service flaws in GraphQL Java's query parsing and validation, fixed in releases 24.4, 25.1 and 26.1. Imperva says the bugs sit ahead of the depth and cost limits most teams rely on, so exposure depends on the library version a stack ships.
Reality
- Evidence45
- Adoption60
- Hype gap+15
- Incentives70
- Confidence50
Imperva found Microsoft's DebugMCP 1.1.4 let a malicious webpage run code on a developer's machine through an unauthenticated port 3001 listener. The fix reached 1.2.0 with no advisory, so finding exposed machines means checking installed extension versions.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence60
OWASP's August 3 edition added no categories and removed none, yet eight of the ten entries changed rank, with Unbounded Consumption up four places and Improper Output Handling down five. Prompt Injection still holds first.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+12
- Incentives70
- Confidence55
Adobe scored CVE-2026-75650 at 10.0 and hotfixed it outside the normal cycle after exploitation had already started. Imperva reports attempts against sites in 15 countries and backdoors dressed as system processes.
Reality
- Evidence45
- Adoption58
- Hype gap+18
- Incentives80
- Confidence42
Thales's Imperva is shipping a connector for DigiCert's lifecycle manager. The deadline that makes it necessary belongs to the CA/Browser Forum, not to any vendor.
Reality
- Evidence34
- Adoption14
- Hype gap+32
- Incentives90
- Confidence33