Everything BlueTeam Herald has reported about NVD: 7 stories, newest first. Part of our Vulnerabilities coverage.
A high-severity flaw in WP User Manager allows unauthenticated visitors to gain administrator roles without payment if the payment gateway is disconnected.
A flaw in Vyper versions before 0.3.0 allows memory corruption during internal function calls, risking incorrect smart contract behavior.
A high-severity flaw in Semaphore UI allows task runners to execute arbitrary code by overriding Ansible variables, exposing server-side secrets and keys.
Authenticated viewers can exploit CVE-2026-111634 to manipulate data sources via crafted report parameters in Helical Insight through version 7.0.0.
A critical flaw in Archon AI versions 0.2.13 through 0.11.1 lets attackers run host commands without authentication via an exposed API.
An unauthenticated flaw in Lychee versions below 7.7.1 lets buyers alter payment amounts, bypassing merchant controls on supported webshops.
A CVSS 9.8 flaw allows subscribers to gain unauthorized privileges in Sergey AIWU versions 1.5.9 and below, requiring immediate vendor patches.