Vulnerabilities
Critical ActiveX Flaw in Legacy Update Allows Remote PC Restarts
A severe origin validation error in Legacy Update versions 1.12.0 through 1.13.1 lets attackers install updates and restart computers without consent.
Vulnerabilities
Vulnerabilities
CVSS 9.8 Score Marks Microsoft PostScript Driver as Critical Risk
A severe flaw in the Microsoft PostScript Printer Driver allows remote attackers to execute code without authorization, according to security advisories.
Vulnerabilities
CVSS 10.0 Zero-Click ColdFusion RCE: CVE-2026-106624 Impacts Versions Through 2025.0.13 and 2023.0.25
A critical vulnerability in Adobe ColdFusion allows remote code execution without user interaction, affecting versions up to 2025.0.13 and 2023.0.25.
Vulnerabilities
Web Cache Poisoning: How to Trace and Stop the Attack
Web cache poisoning succeeds when servers treat harmless request parts as untrusted, allowing attackers to store malicious code in shared storage for all users.
Vulnerabilities
SQL Injection Risks and Protection for Small Businesses
Small businesses face disproportionate SQL injection risk because custom applications often lack the rigorous code review processes that large enterprises enforce.
Vulnerabilities
Proof-of-Concept Exploits: How Small Teams Manage Public Code Risks
Public exploit code turns theoretical flaws into immediate operational threats, forcing small teams to prioritize patching over feature development.
Vulnerabilities
File Upload Vulnerabilities Prevention Checklist
Storing user files outside web roots and renaming them breaks the direct path attackers use to execute code on your server.
Vulnerabilities
Detect Authorization Bypass Vulnerabilities in Logs and Code
Authorization bypasses often hide in successful responses rather than failed attempts, requiring analysts to verify permission checks match the actual user context.
Vulnerabilities
Citrix Issues Emergency Fixes for 2 NetScaler Flaws After Platypus RAT Deployment
Attackers exploited two unpatched Citrix NetScaler flaws to deploy a modified remote access tool on exposed edge appliances, prompting emergency fixes.
Vulnerabilities
Five Orgs Hit as Attackers Exploit Unpatched AhsayCBS Flaws for Mining
Huntress reports active exploitation of two AhsayCBS vulnerabilities, leading to webshell and crypto miner deployment on managed service provider servers.
Vulnerabilities
NVD Scores CVE-2026-82103 Critical 9.6 for IBM DataStage 5.4.0.0 Remote Info Leak
A critical vulnerability in IBM DataStage allows authenticated attackers to access sensitive data, requiring immediate review of access controls.
Vulnerabilities
Missing nsenter Flags in sandboxed.sh 1.3.0 Enable Host Filesystem Access via CVE-2026-109569
A critical vulnerability in sandboxed.sh versions up to 1.3.0 lets container code bypass isolation and access the host filesystem due to missing nsenter flags.
Vulnerabilities
CVSS 9.2: Unauth Unicode Input in phpMyFAQ Lets Attackers Extract DB Secrets
An unauthenticated flaw in phpMyFAQ allows remote attackers to extract database secrets via Unicode input, rated critical by the NVD.
Vulnerabilities
6.5.5 Patch Fixes Metasploit Web Service CVE-2026-87689 Auth Bypass
An unauthenticated flaw in the Metasploit Framework Web Service allowed unrestricted access to credential stores across all versions prior to 6.5.5.
Vulnerabilities
Meta Rejects Anthropic’s AI Compute Request, Fueling Infrastructure Scarcity
Meta declined Anthropic’s bid for additional compute capacity earlier this year, highlighting the intense competition for resources among major AI developers.
Vulnerabilities
CVSS 9.4: OpenSpug RCE in File Transfer Lacks Vendor Fix for Versions Up to 3.4.0
A CVSS 9.4 vulnerability in OpenSpug Spug enables remote attackers to execute OS commands through the file transfer component, with no vendor fix confirmed.
Vulnerabilities
CVSS 9.2: Pingvin Share X OAuth Bug Bypasses TOTP, Lets Hackers Hijack Admin Accounts
A critical authentication bypass in Pingvin Share X allows unauthenticated attackers to hijack accounts, including admin roles, by exploiting a missing email verification check in OAuth flows.
Vulnerabilities
9.1 CVE Allows Relay Attack on Privasys Enclave OS Mini SGX Runtimes
A critical flaw in Privasys Enclave OS Mini allows attackers to spoof identity via TLS relay, patched in wasm-v0.40.0.
Vulnerabilities
CVSS 8.1: Vikunja 2.4.0 fixes CVE-2026-57458 OAuth flaw letting scoped API tokens bypass permissions
System administrators must update Vikunja to version 2.4.0 to stop attackers from using limited API tokens to mint unrestricted session credentials.
Vulnerabilities
Astron Agent CVE-2026-108263 Lets Tenants Run Root Code
A critical flaw in Astron Agent versions prior to 1.1.2 allows authenticated users to execute code as root and bypass tenant isolation controls.
Vulnerabilities
Pre-7.9 TVU Users Face Critical Risk: Empty Username Bypass Grants Admin Control
Attackers can hijack TVU Networks Receiver and Transceiver devices by exploiting a login flaw that ignores missing usernames.
Vulnerabilities
6-Digit 2FA Brute-Forced in Advanced IP Blocker: Full WordPress Admin Access for Unauthenticated Attackers
A critical flaw in Advanced IP Blocker lets attackers bypass two-factor authentication and take over WordPress sites without knowing any passwords.
Vulnerabilities
How Mass Assignment Works: The Hidden Data Exposure Risk
Mass assignment vulnerabilities occur when an API accepts user input for fields you never intended to expose, bypassing your backend logic without triggering alarms.
Vulnerabilities
Detect Remote Code Execution: Signals, Tools, and Blind Spots
Remote code execution often hides in routine system calls rather than obvious error messages, requiring deep inspection of process trees and memory states.