New Vulnerabilities CVE-2026-6121 and CVE-2026-35668 Discovered
Article Content
- •CVE-2026-6121 has a CVSS score of 8.80, indicating a high severity risk.
- •CVE-2026-35668, published on April 10, has a CVSS score of 7.10.
- •Both vulnerabilities allow for network-based attacks with low complexity.
On April 12, 2026, INCIBE-CERT published details on CVE-2026-6121, a high-severity vulnerability with a CVSS score of 8.80, allowing remote exploitation with low complexity and no user interaction required. This vulnerability affects systems with high confidentiality, integrity, and availability impacts. Additionally, CVE-2026-35668 was published on April 10, 2026, with a CVSS score of 7.10, also allowing network-based attacks with low complexity and low privileges required. Both vulnerabilities pose significant risks to affected systems, with CVE-2026-6121 being particularly critical due to its potential for complete data compromise. Organizations are urged to assess their systems for these vulnerabilities and implement necessary mitigations. No specific patches have been mentioned yet for either CVE. The vulnerabilities have been classified as high severity due to their potential impact on data security.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track CVE-2026-35668 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…