SQL Server, WordPress Avada, and Gitea Under Active Exploitation

The Daily CVE Update · Aug 27, 2026 · 15m

SQL Server, WordPress Avada, and Gitea Under Active Exploitation

Three critical vulnerabilities are being actively exploited in the wild, all with patches available. Microsoft SQL Server’s CVE-2019-1068, a remote code execution flaw first patched in 2019, remains weaponised against unpatched systems seven years later. WordPress sites running the Avada theme and Fusion Builder plugin face a 9.8-rated vulnerability (CVE-2026-18431) allowing unauthenticated attackers to achieve full site compromise. Gitea, the self-hosted Git service, is being targeted via CVE-2026-60004, enabling arbitrary code…