Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

VBulletin 6.2.2 security patch release for template-engine flaw

Security Patch Release
First reported
Last updated
Happening score
H score 32
1 unique sources, 1 articles

Summary

Hide ▲

vBulletin released security patches for 6.2.1, 6.2.0, and 6.1.6 and shipped 6.2.2 as the fixed build, closing a template-engine remote code execution flaw on self-hosted forum servers. The update mattered because the affected branches could be reached without authentication until administrators applied the patch or upgraded. Cloud sites were already patched before public exploit details emerged on July 27.

Related Happenings

NodeBB eight-flaw security patch release (4.14.2)

Security Patch Release
H score34 First: 24.07.2026 10:41 Last: 24.07.2026 10:41 Sources 1

About this happening: NodeBB released 4.14.2 to close eight high-severity flaws that exposed admin access, private messages, private categories, and code-execution paths. The affect...

Open Happening

RabbitMQ maintainers security patch release for CVE-2026-57219

Security Patch Release
H score29 First: 14.07.2026 16:48 Last: 14.07.2026 16:48 Sources 1

About this happening: RabbitMQ maintainers released fixed versions for multiple supported release lines, closing two access-control flaws that could expose OAuth client secrets and cross-te...

Open Happening

Linux kernel stable maintainers security patch release for CVE-2026-53359

Security Patch Release
H score41 First: 06.07.2026 20:37 Last: 06.07.2026 20:37 Sources 1

About this happening: The Linux kernel shipped stable fixes for CVE-2026-53359, closing a KVM use-after-free on x86 hosts with nested virtualization. The fix reached 7.1.3, 6.18.3...

Open Happening

Gitea Docker images security update (CVE-2026-20896)

Security Patch Release
H score51 First: 06.07.2026 19:28 Last: 06.07.2026 19:28 Sources 1

About this happening: Gitea released version 1.26.3 to fix CVE-2026-20896, closing a critical authentication-bypass risk in Gitea Docker images. The update removed the default "*" wildc...

Open Happening

Trend Micro security patch release for CVE-2025-69258

Security Patch Release
H score39 First: 09.01.2026 12:01 Last: 09.01.2026 12:01 Sources 1

About this happening: Trend Micro released security updates for Apex Central for Windows to fix CVE-2025-69258, a 9.8 CVSS remote-code-execution flaw that could let an unauthenticat...

Open Happening

Timeline

  1. 27.07.2026 17:40 2 articles · 3h ago

    vBulletin ships 6.2.2 to close the template-engine RCE flaw

    Mitigation Patch Update

    vBulletin releases the fixed 6.2.2 build after issuing security patches for 6.2.1, 6.2.0, and 6.1.6, closing an unauthenticated remote code execution flaw in the forum software's template engine; Cloud sites were already patched against the flaw.

    Show sources
    Open in new tab
  2. 27.07.2026 17:40 1 articles · 3h ago

    Public exploit details expose vBulletin's pre-authentication eval() path

    Technical Analysis Update

    Public exploit details for CVE-2026-61511 show how an unauthenticated request reaches PHP's eval() inside vBulletin's template engine and can execute code on an unpatched forum server through the public ajax/render/pagenav route and a visitor-supplied pagenav[pagenumber] value.

    Show sources
    Open in new tab