Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

VBulletin 6.2.2 security patch release for template-engine flaw

Security Patch Release
First reported
Last updated
Happening score
H score 32
2 unique sources, 2 articles

Summary

Hide ▲

vBulletin released security patches for 6.2.1, 6.2.0, and 6.1.6 and shipped 6.2.2 as the fixed build, closing a template-engine remote code execution flaw on self-hosted forum servers. The update mattered because the affected branches could be reached without authentication until administrators applied the patch or upgraded. Cloud sites were already patched before public exploit details emerged on July 27.

Related Happenings

WordPress security patch release for CVE-2026-64638

Security Patch Release
H score34 First: 07.08.2026 15:56 Last: 07.08.2026 15:56 Sources 1

About this happening: WordPress 7.0.3 shipped a security fix for CVE-2026-64638, and the release was backported through the 4.7 branch. WordPress urged operators to update immediately a...

Open Happening

Paperclip security patch release for CVE-2026-41679

Security Patch Release
H score45 First: 05.08.2026 17:30 Last: 05.08.2026 17:30 Sources 1

About this happening: Paperclip shipped 2026.416.0 and 0.3.1 to close three disclosed vulnerabilities that could expose data and enable unauthenticated command execution. The releas...

Open Happening

Gitea security patch release for CVE-2026-59774

Security Patch Release
H score65 First: 05.08.2026 14:04 Last: 05.08.2026 14:04 Sources 1

About this happening: Gitea 1.27.1 is a security patch release that closes CVE-2026-59774 and CVE-2026-60004, reducing exposure for self-hosted Gitea deployments. The update fixes a C...

Open Happening

Gitea 1.27.1 security patch release for CVE-2026-60004

Security Patch Release
H score46 First: 29.07.2026 10:47 Last: 29.07.2026 10:47 Sources 1

About this happening: Gitea's 1.27.1 security patch release closes CVE-2026-60004, a critical RCE affecting Gitea versions 1.17 through 1.27.0. The fix requires upgrading to 1.27.1,...

Open Happening

OpenWrt security patch release for CVE-2026-53921

Security Patch Release
H score37 First: 28.07.2026 15:56 Last: 28.07.2026 15:56 Sources 1

About this happening: OpenWrt released 24.10.8 and 25.12.5 to close a critical DHCPv6 stack overflow in odhcpd, reducing the risk of root code execution on exposed routers. The...

Open Happening

Timeline

  1. 27.07.2026 17:40 3 articles · 11d ago

    vBulletin ships 6.2.2 to close the template-engine RCE flaw

    Mitigation Patch Update

    vBulletin releases the fixed 6.2.2 build after issuing security patches for 6.2.1, 6.2.0, and 6.1.6, closing an unauthenticated remote code execution flaw in the forum software's template engine; Cloud sites were already patched against the flaw.

    Show sources
    Open in new tab
  2. 27.07.2026 17:40 1 articles · 11d ago

    Public exploit details expose vBulletin's pre-authentication eval() path

    Technical Analysis Update

    Public exploit details for CVE-2026-61511 show how an unauthenticated request reaches PHP's eval() inside vBulletin's template engine and can execute code on an unpatched forum server through the public ajax/render/pagenav route and a visitor-supplied pagenav[pagenumber] value.

    Show sources
    Open in new tab