A high-severity flaw in Semaphore UI allows task runners to execute arbitrary code by overriding Ansible variables, exposing server-side secrets and keys.
Attackers exploit a command injection flaw in SiteGuard Server Edition to gain root access. Defenders must save diagnostic logs before applying the vendor's patch or upgrade.
A CVE-2026-112006 flaw in OpenTelemetry HTTP exporter versions before 1.45.0 allows attackers to intercept telemetry data by bypassing certificate checks.
A critical missing authentication flaw in IceCMS allows attackers to reset admin passwords without credentials, risking full system control for users on versions 4.1.5 and earlier.
Authenticated viewers can exploit CVE-2026-111634 to manipulate data sources via crafted report parameters in Helical Insight through version 7.0.0.
A flaw in Apache Answer through version 2.0.2 allows users with unpin rights to hide or show questions, bypassing intended permission controls.
A critical flaw in Archon AI versions 0.2.13 through 0.11.1 lets attackers run host commands without authentication via an exposed API.
X.Org Server has released a fix for a high-severity flaw that lets local attackers escalate to root by exploiting a double free in SetGeometry handling.
A session handling flaw in WeGIA versions prior to 3.8.6 allows session takeover and exposes internal database host names in cookie responses.
A flaw in Eclipse Vert.x allows malicious MySQL servers to trigger out-of-memory crashes before authentication completes by sending unlimited data packets.
Authenticated attackers can exploit SQL injection in Slican IPx WebCTI services running versions prior to 6.62.0100, requiring immediate patching.
A high-severity authorization bypass in older QNAP Video Station versions allows remote attackers to steal sensitive data before patching.
Unpatched Symfony versions crash PHP processes when parsing deeply nested expressions, exposing user-facing apps to denial-of-service attacks.
An unauthenticated flaw in Lychee versions below 7.7.1 lets buyers alter payment amounts, bypassing merchant controls on supported webshops.
A critical server-side template injection in SolusVM 2 allows authenticated attackers to execute arbitrary code as root on affected servers.
A critical SQL injection flaw in TMS Amelia Booking Plugin versions up to 2.4.10 exposes sites to database manipulation, requiring immediate inventory checks.
AI coding agents introduce vulnerabilities faster than teams can fix them, requiring continuous security checks beyond standard pull request scans.
Attackers exploited vulnerabilities in internet-connected fridge units at 700 French stores using flaws flagged by Claroty and CISA in three specific device models.
A critical SQL injection in WeGIA versions prior to 3.8.6 allows attackers to manipulate billing and credential data without authentication.
Microsoft’s October update fixes a record number of flaws, including an actively exploited Windows Shell zero-day that bypasses security warnings.
A critical vulnerability in Frontend Dashboard versions through 3.0.7 allows attackers to escalate privileges, requiring immediate inventory and containment of exposed instances.
Windows applications using .NET 8 through 11 must update NuGet packages to address CVE-2026-70197, a high-severity remote code execution flaw in socket handling.
Two high-severity flaws in Zoom Workplace and My Notes allow unauthenticated attackers to access sensitive data over a network, requiring immediate version checks.
Google releases critical patches for memory corruption bugs in latest desktop builds for Windows, Mac and Linux.