Vulnerabilities
Patch GitLab to Stop SAML-LDAP Account Takeover Without Victim Interaction
GitLab users must update to block a high-severity flaw allowing authenticated attackers to hijack LDAP accounts via improper input sanitization.
BlueTeam Herald Advisory Desk
The BlueTeam Herald Advisory Desk is the part of the BlueTeam Herald newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 64 articles so far. See the editorial policy or report an error.
Vulnerabilities
Patch Trigger.dev CLI CSRF Flaw Before Version 4.5.2 to Prevent Account Takeover
A high-severity cross-site request forgery in the Trigger.dev CLI authorization flow allows attackers to steal personal access tokens from logged-in users.
Vulnerabilities
Patch virtualenv to stop arbitrary command execution in bash prompts
A high-severity flaw in virtualenv allows attackers to run shell commands via crafted environment names, requiring users to update to 21.14.7 immediately.
Vulnerabilities
Patch WP User Manager to Block Unauthenticated Admin Access via CVE-2026-110523
A high-severity flaw in WP User Manager allows unauthenticated visitors to gain administrator roles without payment if the payment gateway is disconnected.
Vulnerabilities
Patch CouchDB 3.5.2 to Block Unauthorized Access to Prefixed System Databases
A high-severity authorization bypass in Apache CouchDB allows unrestricted reading of prefixed user and replicator databases, requiring an immediate upgrade to 3.5.3.
Vulnerabilities
Update Node.js follow-redirects to block CVE-2026-111755 credential leaks via regex escape flaw
A regex flaw in the Node.js follow-redirects package allows custom credential headers to leak during cross-origin redirects if header names contain specific characters.
Vulnerabilities
Patch Eclipse OpenJ9 to Stop Remote JITServer Denial of Service Attacks
Unauthenticated attackers can crash JVM processes in OpenJ9 versions before 0.63.0 by sending malformed payloads to the JITServer component.
Vulnerabilities
Update Chrome Desktop and ChromeOS to Patch 353 Security Flaws
Google releases Chrome 156 stable updates for desktop and ChromeOS, addressing hundreds of security vulnerabilities including critical memory corruption issues.
Vulnerabilities
Update Argo CD to stop low-privilege attackers from reading secrets and crashing servers via JSONnet
A critical flaw allows attackers to read sensitive files and exhaust memory via JSONnet imports in Argo CD versions prior to the latest security updates.
Vulnerabilities
Block Argo CD RCE: Helm Plugin Flaw in 2.1 to 3.6 Requires Patching
A critical vulnerability in Argo CD allows remote code execution via Helm plugins with minimal permissions, affecting versions up to 3.6.0-rc2.
Vulnerabilities
Secure Totolink X2000R Admin Access to Mitigate Critical RCE Risk
A critical buffer overflow in Totolink X2000R firmware allows authenticated attackers to execute arbitrary code via crafted HTTP requests.
Vulnerabilities
Upgrade Vyper to 0.3.0 to Fix High-Severity Memory Corruption Vulnerability
A flaw in Vyper versions before 0.3.0 allows memory corruption during internal function calls, risking incorrect smart contract behavior.
Vulnerabilities
Secure Totolink X2000R Routers Against Critical Remote Code Execution Flaw
Researchers identified critical stack-based buffer overflows in the device's IPv6 setup feature that allow attackers to run arbitrary code.
Vulnerabilities
Block TCF Servlet Access to Stop Oracle EBS Remote Code Execution
Horizon3 researchers found an unauthenticated SQL injection in Oracle E-Business Suite that allows attackers to run commands on application servers without logging in.
Vulnerabilities
Block Malformed PUT Requests to Prevent NetX Duo Remote Crash
An unauthenticated remote crash flaw in Eclipse ThreadX NetX Duo allows attackers to crash servers via a single bad HTTP request.
Vulnerabilities
Block Path Traversal Attacks on EyeLock nano NXT Biometric Devices
Unauthenticated attackers can read arbitrary files on EyeLock nano NXT devices via a high-severity path traversal flaw in older firmware versions.
Vulnerabilities
Patch Go compress library to fix high-severity integer overflow crash
Attackers can trigger a segmentation fault in Go applications using the klauspost compress library by supplying crafted dictionary data that bypasses validation checks.
Vulnerabilities
Upgrade TYPO3 File Manager to 3.1.3 to fix CVE-2026-112238 SQLi and prevent sensitive data leaks
Unquoted search terms in the File Manager extension allow database queries to break out, exposing sensitive data to attackers.
Vulnerabilities
Patch Advantech ADAM-3600 to Stop Critical Remote Command Execution
An unpatched firmware flaw allows attackers to forge packets and run commands with full privileges on exposed industrial modules.
Vulnerabilities
Deploy Reference Monitors to Secure AI Agents Against Insider Threats, Rapid7 Says
Rapid7 argues that AI agents require external reference monitors rather than internal prompts to prevent misuse of privileged access.
Vulnerabilities
Update Grav CMS to 2.2.2 to Stop Page Editors Deleting Files via CVE-2026-112780
Page editors in vulnerable Grav versions can bypass allowlists to delete directories or read files by renaming form fields.
Vulnerabilities
Block Unauthenticated Access to Piflow DeepAgents Chat Endpoints Now
Piflow 2.0.0 and 2.0.1 allow unauthenticated remote code execution via chat agents, risking credential theft.
Vulnerabilities
Block Command Execution in Camunda 7 by Restricting Query Access
Authenticated users can execute OS commands in vulnerable Camunda 7 versions by injecting expressions into query fields, bypassing safety controls.
Vulnerabilities
Install Mercury 3.2.6 to stop anonymous users from running arbitrary Python code via exposed servers
Default tokenless deployments of the Mercury framework allow anonymous users to create Jupyter kernels and run arbitrary Python code on exposed servers.