Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishers
- Builder
- Builder 24%
- Operator
- Operator 75%
- Investor
- Investor 1%
Reality
- Evidence72
- Adoption58
- Hype gap−20
- Incentives68
- Confidence68
A sub-2MB valid SQL query drives SQLGlot past 1.5GB of memory in Imperva tests
Imperva found that a syntactically valid SQL query under 2MB can drive the SQLGlot parser past 1.5GB of memory, about 750 times the input. Tools that parse user or model-supplied SQL before the database sees it carry the same exposure until they upgrade.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence55
GraphQL Java 24.4, 25.1 and 26.1 fix remote DoS flaws in query parsing and validation
Imperva found remote denial-of-service flaws in GraphQL Java's query parsing and validation, fixed in releases 24.4, 25.1 and 26.1. Imperva says the bugs sit ahead of the depth and cost limits most teams rely on, so exposure depends on the library version a stack ships.
Reality
- Evidence45
- Adoption60
- Hype gap+15
- Incentives70
- Confidence50
Microsoft's DebugMCP 1.1.4 left an unauthenticated debugger port open to malicious webpages
Imperva found Microsoft's DebugMCP 1.1.4 let a malicious webpage run code on a developer's machine through an unauthenticated port 3001 listener. The fix reached 1.2.0 with no advisory, so finding exposed machines means checking installed extension versions.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence60
Excessive Agency climbs from sixth to third in OWASP's 2026 LLM Top 10
OWASP's August 3 edition added no categories and removed none, yet eight of the ten entries changed rank, with Unbounded Consumption up four places and Improper Output Handling down five. Prompt Injection still holds first.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+12
- Incentives70
- Confidence55
Adobe's out-of-band Magento hotfix lands after attackers installed backdoors disguised as kworker
Adobe scored CVE-2026-75650 at 10.0 and hotfixed it outside the normal cycle after exploitation had already started. Imperva reports attempts against sites in 15 countries and backdoors dressed as system processes.
Reality
- Evidence45
- Adoption58
- Hype gap+18
- Incentives80
- Confidence42
47 days, eight renewals: the certificate calendar stops being a calendar
Thales's Imperva is shipping a connector for DigiCert's lifecycle manager. The deadline that makes it necessary belongs to the CA/Browser Forum, not to any vendor.
Reality
- Evidence34
- Adoption14
- Hype gap+32
- Incentives90
- Confidence33