Vulnerabilities
Lantronix XPress-DR Firmware Allows Remote Config Overwrite Without Authentication
Attackers can rewrite IP addresses and forwarding records on Lantronix serial devices by sending unauthenticated UDP packets to a specific port.
Vulnerabilities
Vulnerabilities
git-diff Library Flaw Lets Attackers Run Shell Commands with Node Privileges
A critical command injection flaw in the git-diff library for Node.js allows attackers to execute arbitrary system commands by manipulating diff inputs.
Vulnerabilities
pypdftk OS Command Injection Flaw Lets Attackers Run Shell Commands
A critical vulnerability in the pypdftk library allows attackers to execute operating system commands by injecting shell metacharacters into file path arguments.
Vulnerabilities
Microsoft Patches CVE-2026-96232 in .NET Windows Desktop Runtimes to Stop Remote Info Disclosure
Microsoft releases updates for .NET Windows Desktop runtimes to address a high-severity vulnerability that allows remote attackers to disclose sensitive information.
Vulnerabilities
Vitess Debug Endpoint XSS Allows Script Execution in Operator Browsers
A critical flaw in Vitess debug pages lets attackers run scripts in admin browsers, exposing sensitive database diagnostics and environment data.
Vulnerabilities
Microsoft warns of critical remote code execution flaw in Windows iSCSI
An unauthenticated attacker can run code on Windows systems via a heap overflow in the iSCSI service, rated 9.8 by the National Vulnerability Database.
Vulnerabilities
Microsoft warns of critical iSCSI flaw allowing remote code execution
An unauthenticated attacker can run arbitrary code on Windows systems by exploiting a memory error in the iSCSI service, according to Microsoft.
Vulnerabilities
Microsoft IIS Buffer Overflow Lets Attackers Run Code Remotely
A critical flaw in Windows Internet Information Services allows unauthorized remote code execution via a stack-based buffer overflow.
Vulnerabilities
Microsoft Confirms Unauthenticated RCE in Windows Error Reporting
A heap overflow in Windows Error Reporting lets attackers run code remotely without credentials, earning a critical 9.8 CVSS score.
Vulnerabilities
Low-Privilege Attackers Can Execute Code on Adobe ColdFusion Servers
A critical code injection flaw in Adobe ColdFusion allows remote execution without user interaction, affecting versions up to 2025.0.13 and 2023.0.25.
Vulnerabilities
Attack Surface Management Checklist: Find Hidden Exposure
Most organizations track only known assets, leaving shadow IT and third-party dependencies as the primary entry points for attackers.
Vulnerabilities
Cross Site Scripting vs CSRF: How to Tell Them Apart and Stop Both
XSS hijacks the user to execute code in their browser, while CSRF tricks the browser into sending requests the user already authorized for.
Vulnerabilities
Critical Auth Flaw in Adobe Commerce Lets Attackers Run Code
A high-severity authorization error in Adobe Commerce and Magento Open Source allows remote attackers to execute arbitrary code without user interaction.
Vulnerabilities
Integer Overflow Vulnerabilities: 7 Mistakes That Break Your Code
Integer overflow errors allow attackers to bypass security checks by wrapping arithmetic values, turning valid inputs into unauthorized memory access or logic failures.
Vulnerabilities
Ivanti Neurons Patch for Intune Gets Critical 9.9 CVSS Rating for Auth Data Leak
A critical vulnerability in Ivanti Neurons Patch for Intune allows remote authenticated users to access sensitive authentication information through an exposed endpoint.
Vulnerabilities
Should I do firmware updates? Risks, benefits, and safe execution
Firmware updates patch hardware-level trust boundaries, but they also introduce supply chain risks that require verification before installation.
Vulnerabilities
SaltStack Docs Vulnerability Exposes Secrets via Forked Pull Requests
Attackers could steal credentials from the SaltStack documentation repository by injecting malicious code into a pull request from a forked project.
Vulnerabilities
Penetration Testing Misconceptions: What Security Teams Actually Miss
Most organizations confuse penetration testing with vulnerability scanning, missing the strategic value of simulating attacker logic and chaining low-severity flaws into critical breaches.
Vulnerabilities
Hardening a Self-Hosted GitLab Server: 8 Proven Practices
You reduce your attack surface by treating the GitLab runner as a separate security domain and isolating database connections from the web tier.
Vulnerabilities
WordPress Plugin Vulnerability Prevention Checklist
Most plugin breaches occur because organizations neglect the code execution context and privilege boundaries rather than ignoring known CVE identifiers.
Vulnerabilities
CVE-2026-65173: Critical NVIDIA AIStore Flaw Risks Data Tampering and Denial of Service for All Versions
A critical vulnerability in NVIDIA AIStore allows unauthenticated remote attackers to submit crafted revocation lists, risking data tampering and denial of service.
Vulnerabilities
OTRS CE 6 Users Face Data Theft Risk as CVSS 9.4 Auth Bypass Allows Impersonation via Remote-User Header
A critical flaw in OTRS Community Edition 6 allows remote attackers to bypass authentication by injecting crafted HTTP headers, risking data theft.
Vulnerabilities
AES Key Flaw in NetEase Cloud Music Windows Lets Attackers Execute Arbitrary Local Binaries
A flaw in the Windows music app allows attackers to run local binaries by injecting content into the renderer process via an unvalidated API.
Vulnerabilities
CVE-2026-85947: Forest-Management Rights Let Attackers Create Admin Accounts in MarkLogic Server
A critical vulnerability in Progress MarkLogic Server allows attackers with forest-management rights to create unauthorized administrator accounts and seize full control.