The Circuit Observer Flaw Tracker Desk is the part of the Circuit Observer newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 32 articles so far. See the editorial policy or report an error.
A critical flaw in LMCache allows attackers to run code on servers without authentication, impacting versions from 0.3.9 up to 0.5.5 in multi-node setups.
A severe vulnerability in IceCMS allows unauthorized users to reset passwords and seize control of administrator accounts without providing any credentials.
A timing flaw in the LatePoint booking plugin allows attackers to bypass login locks and steal customer accounts using concurrent requests.
Microsoft confirms a cryptographic bypass flaw in Windows Remote Desktop and documents how a security feature blocks non-admin access on recent updates.
New benchmark shows purpose-built agents outperform general coding tools by 30 points in safely upgrading vulnerable software packages.
A flaw in e107 CMS install scripts allows attackers to take full control of servers. Version 2.3.7 patches the issue for older sites.
A critical stack overflow flaw in Juniper’s web management interface allows attackers to execute code remotely without any login credentials, affecting multiple OS branches.
Unauthenticated UDP flaws in end-of-life Lantronix firmware allow remote attackers to read and permanently overwrite device settings without credentials.
Attackers can execute operating system commands by injecting shell metacharacters into file path options within the vulnerable Node.js package.
A critical flaw in the nodejs-whisper library allows attackers to execute operating system commands by manipulating audio file paths in versions up to 0.3.1.
Fortinet warns that a hard-coded cryptographic key in FortiSandbox allows attackers to bypass authentication and access API endpoints without credentials.
A race condition in .NET runtime allows local privilege escalation on Unix systems. Microsoft releases updates for versions 8, 9, 10 and 11 to fix the issue.
Microsoft issued patches for CVE-2026-85851, a use-after-free bug in SmartScreen that elevates local privileges without user interaction on Windows 11 and Server 2025.
A double free vulnerability in Microsoft Outlook enables unauthorized attackers to run code remotely, rated critical with a CVSS score of 9.8.
A severe origin validation error in Legacy Update versions 1.12.0 through 1.13.1 lets attackers install updates and restart computers without consent.
A severe flaw in the Microsoft PostScript Printer Driver allows remote attackers to execute code without authorization, according to security advisories.
A critical vulnerability in Adobe ColdFusion allows remote code execution without user interaction, affecting versions up to 2025.0.13 and 2023.0.25.
Attackers exploited two unpatched Citrix NetScaler flaws to deploy a modified remote access tool on exposed edge appliances, prompting emergency fixes.
Huntress reports active exploitation of two AhsayCBS vulnerabilities, leading to webshell and crypto miner deployment on managed service provider servers.
A critical vulnerability in IBM DataStage allows authenticated attackers to access sensitive data, requiring immediate review of access controls.
A critical vulnerability in sandboxed.sh versions up to 1.3.0 lets container code bypass isolation and access the host filesystem due to missing nsenter flags.
An unauthenticated flaw in phpMyFAQ allows remote attackers to extract database secrets via Unicode input, rated critical by the NVD.
An unauthenticated flaw in the Metasploit Framework Web Service allowed unrestricted access to credential stores across all versions prior to 6.5.5.
Meta declined Anthropic’s bid for additional compute capacity earlier this year, highlighting the intense competition for resources among major AI developers.