Vulnerabilities
FearlessCMS 0.1.2b Update Mechanism Allows Remote Code Execution
Admins can force the system to clone attacker-controlled Git repos, replacing core files and executing arbitrary PHP code on the server.
NetSec Observer Patch Watch Desk
Vulnerabilities
NullHub NullClaw Auth Bypass Lets Attackers Hijack Agents and Configs
A missing authentication flaw in NullHub NullClaw allows unauthenticated users to control agents and rewrite provider credentials through the management API.
Vulnerabilities
Dokku Command Injection via Docker Options Plugin in Pre-0.38.25 Builds
Attackers with app-level access can execute arbitrary commands on the host by injecting shell syntax into Docker configuration strings processed by Bash.
Vulnerabilities
Microsoft SQL Server 2019-2025 Deserialization Bug Allows Auth Users Remote Code Execution
Microsoft SQL Server versions through 2025 contain a high-severity deserialization flaw that lets authorized users run remote code.
Vulnerabilities
Junos OS Extended Echo Integer Underflow Enables Critical Remote DoS on Juniper Networks
Unauthenticated network attackers can crash Junos OS kernels by exploiting an integer underflow in the Extended Echo feature, resulting in critical denial of service.
Vulnerabilities
Cisco Secure Email Gateway: Unauthenticated Root Command Execution via Crafted AMP Attachments
An unauthenticated flaw in Cisco Secure Email Gateway allows remote attackers to write files and execute commands as root via crafted attachments.
Vulnerabilities
Video-stitch Unquoted Filename Vulnerability Enables Critical Shell Command Injection Before 2.0.0-beta.1
An unquoted filename flaw in Video-stitch allows attackers to run shell commands with Node.js privileges via specific video processing functions.
Vulnerabilities
itthinx Affiliates Deserialization Bug CVE-2026-108291 Hits 9.8 CVSS for Versions Up to 7.0.1
A critical deserialization vulnerability in itthinx Affiliates versions up to 7.0.1 allows object injection of untrusted data.
Vulnerabilities
ASP.NET Core SignalR Resource Exhaustion Flaw CVE-2026-70159 Patches Available for .NET 8 to 11
Microsoft patches a high-severity resource exhaustion flaw in SignalR that allows unauthenticated attackers to block broadcasts and deny service.
Vulnerabilities
Vitess Debug Pages Critical XSS CVE-2026-104252 Patches in 23.0.5 and 24.0.2
Unauthenticated attackers can inject scripts into Vitess debug pages, accessing sensitive database diagnostics in versions prior to 23.0.5 and 24.0.2.
Vulnerabilities
Windows iSCSI Use-After-Free CVE-2026-69883: Critical 9.8 RCE Vulnerability
A critical remote code execution vulnerability in the Windows iSCSI service allows unauthorized network attackers to execute arbitrary code without prior access.
Vulnerabilities
Critical Heap Overflow in MS PostScript Driver Enables Remote Code Execution via Network
A critical heap-based buffer overflow in the Microsoft PostScript Printer Driver allows unauthorized attackers to run code over a network.
Vulnerabilities
Ivanti Xtraction CWE-73 Vulnerability Lets Authenticated Users Hijack Requests to Steal Credentials
A critical vulnerability in Ivanti Xtraction allows authenticated attackers to hijack requests and steal connector credentials in versions prior to 2026.4.
Vulnerabilities
Citrix NetScaler Zero-Days Enable Unauthenticated Remote Code Execution
Attackers exploit two critical flaws in NetScaler ADC and Gateway to deploy modified Platypus backdoors on edge devices.
Vulnerabilities
Grav Login OAuth Plugin Uses Weak MD5 Passwords for OAuth Users
Unauthenticated attackers can guess credentials for Grav Login OAuth accounts and seize admin control due to predictable username and password generation.
Vulnerabilities
Discourse CVE-2026-55420 ImageMagick Race Condition Enables File Read
A race condition in Discourse's upload pipeline allows low-privilege users to access server files via crafted image uploads.
Vulnerabilities
Palo Alto GlobalProtect Auth Bypass CVE-2026-0257 Enables Stealthy Qilin Settra VPN Access
Ransomware groups Qilin and Settra are actively using an authentication bypass in Palo Alto Networks GlobalProtect to create stealthy, unauthorized VPN sessions.
Vulnerabilities
CISA adds five exploited flaws to KEV catalog with 2026 compliance deadline
The Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its catalog, setting a 2026 deadline for remediation across multiple vendors.
Vulnerabilities
Stack Overflow survey shows developer distrust of AI code generation judgment
New data reveals that while developers heavily use AI tools, the majority remain skeptical about the accuracy and reliability of the generated output.
Vulnerabilities
Partiso Theme Untrusted Data Deserialization: Critical CVE-2026-93934 Hits Versions <= 1.1.13
The National Vulnerability Database rates CVE-2026-93934 as critical, affecting Partiso theme versions up to 1.1.13 through untrusted data deserialization.
Vulnerabilities
Wine House Theme PHP Object Injection: CVE-2026-62053 Grants Remote Code Execution
The National Vulnerability Database lists CVE-2026-62053 as a critical flaw affecting ThemeREX Wine House versions up to 3.20, allowing remote code execution.
Vulnerabilities
PaperCut MF Vulnerability Chain Enables Remote Code Execution Without Authentication
watchTowr Labs revealed a sequence of flaws in PaperCut software that allows attackers to run code remotely without needing user login credentials.
Vulnerabilities
OpenSpug Critical RCE: Unauth OS Command Injection in File Transfer Affects v3.0-4.0.1 With No Fix
A critical remote code execution vulnerability in OpenSpug's file transfer module allows unauthenticated attackers to inject operating system commands.
Vulnerabilities
WineShop PHP Object Injection in v3.20 Enables Unauthenticated Code Execution with 9.8 CVSS Score
A critical vulnerability in WineShop versions up to 3.20 allows attackers to execute arbitrary code without authentication, rated 9.8 CVSS.