Do Son A critical SQL injection flaw (CVE-2026-2413) in the Ally WordPress plugin exposes 400K+ sites to database theft. Update to version 4.1.0 immediately.
Time-Based SQLi
SuiteCRM released an urgent patch (v8.9.1) for two SQL Injection flaws. The time-based SQLi (CVSS 8.8) and GraphQL SQLi allow authenticated users to extract sensitive customer data from the backend database.