A critical vulnerability in Ivanti Neurons Patch for Intune allows remote authenticated users to access sensitive authentication information through an exposed endpoint.
Attackers could steal credentials from the SaltStack documentation repository by injecting malicious code into a pull request from a forked project.
A critical vulnerability in NVIDIA AIStore allows unauthenticated remote attackers to submit crafted revocation lists, risking data tampering and denial of service.
A critical flaw in OTRS Community Edition 6 allows remote attackers to bypass authentication by injecting crafted HTTP headers, risking data theft.
A flaw in the Windows music app allows attackers to run local binaries by injecting content into the renderer process via an unvalidated API.
A critical vulnerability in Progress MarkLogic Server allows attackers with forest-management rights to create unauthorized administrator accounts and seize full control.
TRENDnet confirms a critical vulnerability in three legacy routers, stating it cannot test or fix the devices because they were discontinued in 2011.
Researchers found that one-third of AI-generated fixes for real bugs failed the specific checks written by human developers, despite stopping crashes.
A critical SQL injection flaw in the ELEX WooCommerce Advanced Bulk Edit plugin exposes user data in versions 1.5.3 and earlier.
The National Vulnerability Database rates a PHP object injection bug in Kalles CMS as critical, affecting all versions through 1.1.7.1.
The Equadio WordPress theme contains a severe vulnerability allowing remote code execution without authentication, posing immediate risks to users.
A critical flaw in the PPOM WooCommerce plugin allows unauthenticated attackers to delete server files and execute remote code on WordPress sites.
Unauthenticated users can execute OS commands in Floci versions below 2.2.0 via malicious Velocity templates, posing critical risk to infrastructure.
Amazon Web Services released security updates for Amazon Linux to fix the Dirty Frag privilege escalation bug and other kernel issues in 2026.
Google releases Chrome 155.0.8059.39 for Windows, Mac, and Linux, addressing 24 security issues including four critical memory safety bugs.
An unauthenticated remote attacker can exploit improper input validation in Cisco Finesse to forge server-side requests and access limited sensitive data.
A critical flaw in the popular Java HTTP client caused credentials to leak to incorrect servers during failover. Patches are now available for affected versions.
PraisonAI Agents version 1.6.78 fixes a critical flaw where the code execution sandbox failed to block access to environment variables containing sensitive credentials.
A critical remote code execution vulnerability in the Handlebars template engine is resolved in version 4.7.10, which stops attackers from bypassing security filters.
A critical remote code execution vulnerability in the Handlebars template engine allows attackers to inject arbitrary JavaScript via manipulated AST objects.
A critical flaw in Tenable Identity Exposure allows low-privileged attackers to execute commands with SYSTEM-level access.
A critical deserialization flaw allows remote code execution in grid monitoring tools, with unauthenticated access possible on some configurations.
A critical flaw in the Savannah lwIP SMTP client allows attackers to overflow buffers by sending unchecked inputs, posing severe risks to embedded systems.
The FBI and DoJ disrupted infrastructure used by the China-linked group to scan and infiltrate US critical sectors.