A missing privilege check in older Arcane versions lets holders of a specific delegation permission reset the global administrator password and seize full control.
Attackers can inject malicious objects into the LearnPress plugin via checkout parameters, gaining critical access to WordPress sites without logging in.
A critical use-after-free flaw in MariaDB enables remote code execution when combined with another vulnerability. Affected servers should apply the vendor patch.
Attackers can crash Rust-based AWS SDK servers by sending small, deeply nested data requests that exhaust stack space without needing credentials.
A critical Linux kernel vulnerability allows remote attackers to corrupt network headers by sending packets with invalid checksum metadata, potentially causing system mischief.
An authorization bypass in the low-code platform allows authenticated users to access and execute queries belonging to other organizations on shared instances.
A command injection flaw in older Komodo agents allows authenticated users to execute arbitrary root commands on servers, risking full infrastructure compromise.
A flaw in the AWS HealthLake MCP server lets remote users with valid logins trick the system into sending temporary security keys to attacker-controlled servers.
A server-side request forgery in an AI agent tool allowed attackers to steal operator credentials via crafted prompts.
A reflected XSS in Siemens Teamcenter allows zero-interaction code execution, enabling attackers to alter account permissions without user clicks.
A critical flaw in Hitachi Vantara Remot Ops Agent allows attackers to bypass login by signing their own access tokens.
Unauthenticated users can hijack accounts in Better Auth versions prior to 1.7.7 by misusing OAuth state values as verification tokens, a critical flaw rated 9.3 by NVD.
Unauthenticated attackers can execute commands as root on Cisco Secure Email Gateway appliances by sending a single malicious email with an attachment.
Attackers can rewrite IP addresses and forwarding records on Lantronix serial devices by sending unauthenticated UDP packets to a specific port.
A critical command injection flaw in the git-diff library for Node.js allows attackers to execute arbitrary system commands by manipulating diff inputs.
A critical vulnerability in the pypdftk library allows attackers to execute operating system commands by injecting shell metacharacters into file path arguments.
Microsoft releases updates for .NET Windows Desktop runtimes to address a high-severity vulnerability that allows remote attackers to disclose sensitive information.
A critical flaw in Vitess debug pages lets attackers run scripts in admin browsers, exposing sensitive database diagnostics and environment data.
An unauthenticated attacker can run code on Windows systems via a heap overflow in the iSCSI service, rated 9.8 by the National Vulnerability Database.
An unauthenticated attacker can run arbitrary code on Windows systems by exploiting a memory error in the iSCSI service, according to Microsoft.
A critical flaw in Windows Internet Information Services allows unauthorized remote code execution via a stack-based buffer overflow.
A heap overflow in Windows Error Reporting lets attackers run code remotely without credentials, earning a critical 9.8 CVSS score.
A critical code injection flaw in Adobe ColdFusion allows remote execution without user interaction, affecting versions up to 2025.0.13 and 2023.0.25.
A high-severity authorization error in Adobe Commerce and Magento Open Source allows remote attackers to execute arbitrary code without user interaction.