A CVSS 9.4 vulnerability in OpenSpug Spug enables remote attackers to execute OS commands through the file transfer component, with no vendor fix confirmed.
A critical authentication bypass in Pingvin Share X allows unauthenticated attackers to hijack accounts, including admin roles, by exploiting a missing email verification check in OAuth flows.
A critical flaw in Privasys Enclave OS Mini allows attackers to spoof identity via TLS relay, patched in wasm-v0.40.0.
System administrators must update Vikunja to version 2.4.0 to stop attackers from using limited API tokens to mint unrestricted session credentials.
A critical flaw in Astron Agent versions prior to 1.1.2 allows authenticated users to execute code as root and bypass tenant isolation controls.
Attackers can hijack TVU Networks Receiver and Transceiver devices by exploiting a login flaw that ignores missing usernames.
A critical flaw in Advanced IP Blocker lets attackers bypass two-factor authentication and take over WordPress sites without knowing any passwords.
A flaw in the AWS Toolkit for Visual Studio Code allowed local attackers to steal cached CodeCatalyst bearer tokens due to insecure file permissions.