Vulnerabilities
Tenable Identity Exposure Flaw Grants SYSTEM Access to Low-Privileged Attackers Before 3.126.0
A critical flaw in Tenable Identity Exposure allows low-privileged attackers to execute commands with SYSTEM-level access.
Vulnerabilities
Vulnerabilities
GPA Patches Critical Unauth RCE in openPDC, openHistorian Before 2.9.477, 2.8.580
A critical deserialization flaw allows remote code execution in grid monitoring tools, with unauthenticated access possible on some configurations.
Vulnerabilities
CVE-2026-15340: Savannah lwIP 2.2.1 SMTP client lacks input validation, risking embedded systems
A critical flaw in the Savannah lwIP SMTP client allows attackers to overflow buffers by sending unchecked inputs, posing severe risks to embedded systems.
Vulnerabilities
FBI, DoJ disrupt China-linked Flax Typhoon scans of US critical infrastructure
The FBI and DoJ disrupted infrastructure used by the China-linked group to scan and infiltrate US critical sectors.
Vulnerabilities
Anthropic rolls out opt-in AI scanner to audit critical open-source projects without human review
Anthropic introduces a free, opt-in vulnerability scanner that uses AI models to audit critical open-source projects without human review.
Vulnerabilities
NVIDIA patches CVSS 8.2 CVE-2026-47483 in DCGM Exporter blocking remote unauthenticated AI workload crashes
Unauthenticated attackers can crash GPU monitoring services and disrupt AI workloads via a vulnerability fixed by NVIDIA.
Vulnerabilities
Anthropic uses top AI models to scan open-source code for free security fixes
Anthropic's new OSS Scanner service uses its strongest AI models to find vulnerabilities in open-source software at no cost to participating projects.
Vulnerabilities
AhsayCBS Authentication Bypass Flaws Exploited to Install Crypto Miners
Attackers are using two unpatched vulnerabilities in the AhsayCBS backup utility to bypass login checks and install malicious software on compromised servers.
Vulnerabilities
Version 1.7.1 patches CVSS 8.5 unauthenticated OS command execution flaw CVE-2026-107322 in databases-on-aws
A CVSS 8.5 flaw in the databases-on-aws plugin allowed attackers to run OS commands. Version 1.7.1 resolves the issue.
Vulnerabilities
VulnCheck Confirms Active Exploits: CERT-EU Demands Urgent Atlassian Fixes
CERT-EU urges immediate upgrades for internet-facing Atlassian servers after VulnCheck confirms active exploitation of the arbitrary file access vulnerability.
Vulnerabilities
Single Request Triggers Full System Takeover in mJobTime via SQLi in Login.aspx Up to Build 15.7.3.32
A critical SQL injection in mJobTime’s admin panel allows unauthenticated remote code execution with full system privileges through builds 15.7.3.32.
Vulnerabilities
CVE-2026-107700: dot-access Path Manipulation Triggers Critical OS Command Execution on Node.js
A critical flaw in the dot-access library allows attackers to run arbitrary OS commands on Node.js servers through crafted inputs.
Vulnerabilities
CVE-2026-107699: Attackers Execute System Commands in ppt2png via Path Injection
A critical vulnerability in the ppt2png Node.js library allows attackers to execute arbitrary system commands via unsanitized file paths.
Vulnerabilities
Update @enmaso/node-convert Now: Critical RCE Flaw Lets Attackers Run System Commands
A severe vulnerability in a popular Node.js image conversion library allows attackers to run arbitrary system commands on servers.
Vulnerabilities
Attackers Execute Ruby Commands via image_optimizer CVE-2026-107704 Using Shell Metacharacters
A critical command injection bug in the image_optimizer gem enables attackers to run system commands if they control file paths.
Vulnerabilities
Monitor traffic manipulation triggers critical IBM Guardium XSS, risking user session hijacking via CVE-2026-84244
An unauthenticated attacker can inject malicious scripts into the Quick Search grid, risking session hijacking for authenticated users.
Vulnerabilities
Remote attackers bypass login on TVU devices pre-7.9 via empty username exploit
A flaw in TVU video devices allows remote attackers to bypass login and gain full administrative access without valid credentials.
Vulnerabilities
TVU Networks Firmware Flaw Lets Hackers Hijack DNS and Steal Configs Without Login
A critical flaw in TVU Networks hardware lets attackers alter DNS settings and steal configuration data without credentials.
Vulnerabilities
Dromara Skyeye Exposes Servers to Critical 9.3 Script Injection Without Vendor Patch
A missing authentication bug in Dromara Skyeye allows remote attackers to execute arbitrary scripts on host systems without logging in.
Vulnerabilities
Unauthenticated Attackers Can Run Windows Commands via Dromara Skyeye Flaw
A critical command injection bug in the Dromara Skyeye monitoring tool allows remote attackers to execute arbitrary PowerShell code on Windows servers without a login.
Vulnerabilities
IBM Security Verify Access Flaw Lets Attackers Skip Login Checks, Exposing Orgs to Unauthorized Remote Access
A critical flaw in IBM’s access management software lets attackers skip login checks, exposing organizations to unauthorized remote access.
Vulnerabilities
Hackers Steal PHPNuxBill Data via Critical CVE-2026-108107 SQLi in Versions up to 2025.3.20
Attackers can exploit CVE-2026-108107 to steal customer data and credentials from PHPNuxBill versions up to 2025.3.20.
Vulnerabilities
PHPNuxBill Account Takeover Flaw Lets Attackers Hijack Customer Logins
A critical vulnerability in PHPNuxBill’s password reset flow allows unauthenticated attackers to brute-force codes and steal accounts.
Vulnerabilities
IBM Identity Access Software Has Critical Deserialization Flaw Allowing Remote Code Execution
Unauthenticated attackers can exploit CVE-2026-78406 in IBM Security Verify Access to run arbitrary code, a risk rated 9.8 by NVD.