The Vuln Post Vulnerability Desk is the part of the Vuln Post newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 141 articles so far. See the editorial policy or report an error.
A flaw in follow-redirects versions 1.16.0 up to 1.16.1 allows sensitive headers with specific characters to leak during cross-origin redirects. Version 1.16.1 patches the issue.
Google releases Chrome 156 for desktop and ChromeOS, addressing 353 security issues on desktop with critical memory corruption fixes in Skia and Accessibility.
A flaw in Argo CD allows attackers to run commands on repo servers via crafted Kustomize files, with patches now available for affected versions.
IBM App Connect Enterprise versions up to 13.0.8.2 face critical risk from unrestricted IP binding that exposes sensitive data.
PHP issues urgent security update for two remote code execution flaws rated 9.2, affecting only actively supported branches.
Authenticated attackers can execute arbitrary code on Totolink X2000R routers running specific firmware versions via a high-severity injection vulnerability.
Security teams must upgrade Pillow to version 13.0.0 to address a high-severity memory leak in TIFF decoding that exposes heap contents.
Two critical RCE vulnerabilities in PHP versions 5 through 8 require immediate preparation for emergency updates scheduled for next week.
An authenticated attacker can trigger arbitrary code execution in specific Totolink X2000R firmware builds via a crafted HTTP request.
Multiple buffer overflows in the X2000R’s IPv6 configuration allow authenticated attackers to run arbitrary code on the device.
Authenticated attackers can execute code on specific Totolink X2000R firmware versions via crafted HTTP requests targeting PPPoE settings.
Unauthenticated attackers can exploit CVE-2026-101767 to run code on EBS servers. Oracle released a patch in October 2026.
The final quarterly update for 2026 addresses flaws in 33 product families, with Fusion Middleware receiving the most patches.
A flaw in Apache Tomcat's HTTP/2 async processing can cause user request mix-ups. The advisory lists affected versions but does not mention a fix.
Google released minor point updates for Go 1.27 and 1.26 that include a security fix related to CA certificate removal.
A logic error in the Jasper JSTL plug-in allows code execution after redirects in multiple Apache Tomcat versions, with no patch confirmed yet.
A vulnerability in OpenStack Cinder allows cross-project information disclosure via the Messages API, affecting specific versions from 9.0.0 to 29.0.0.
OpenStack Manila versions before specific updates allow unauthorized changes to public share settings and export metadata across projects.
The Roundcube team released security updates on Oct 19 to address multiple vulnerabilities, including command injection, in versions prior to 1.6.20 and 1.7.5.
Mozilla published advice on Oct 20 regarding compromised eMudhra intermediate certificates, urging protection for Firefox users via security mailing lists.
A high-severity vulnerability in Eclipse ThreadX allows privileged code to read or write beyond intended buffer boundaries due to a single-byte check error.
A high-severity vulnerability in the ADAM-3600 allows authenticated attackers to run arbitrary code with service privileges. Version 2.8.5.0 resolves the issue.
A high-severity path traversal bug in the ADAM-3600 allows authenticated attackers to read system files. Version 2.8.5.0 resolves the issue for affected users.
A high-severity flaw in the ADAM-3600 logging system allows remote attackers to crash the service. Version 2.8.5.0 resolves the issue.