Vulnerabilities
Advantech ADAM-3600 Patch Fixes Path Traversal Flaw CVE-2026-43851
A high-severity path traversal bug in the ADAM-3600 allows authenticated attackers to read system files. Version 2.8.5.0 resolves the issue for affected users.
Vuln Post Vulnerability Desk
Vulnerabilities
Vulnerabilities
Advantech ADAM-3600 Patch Fixes Unauthenticated Crash Vulnerability
A high-severity flaw in the ADAM-3600 logging system allows remote attackers to crash the service. Version 2.8.5.0 resolves the issue.
Vulnerabilities
Riskified, United Utilities, Toyota Logistics hire security leaders for app, cloud, and CISO roles
Three organizations in Israel, the UK, and the US are hiring senior security experts to strengthen their teams amid high demand for specialized roles.
Vulnerabilities
Eptura Archibus Critical RCE: Unauthenticated Attackers Can Control Servers via Rapid7-Found Flaw
Rapid7 found three vulnerabilities in the facility management platform, including a critical remote code execution flaw that allows unauthenticated attackers to take control of servers.
Vulnerabilities
Pillow Ghostscript Argument Injection CVE-2026-112900 Patched in Version 13.0.0 Release
Python imaging library Pillow has released version 13.0.0 to fix a critical argument injection flaw that allows attackers to execute arbitrary commands via Ghostscript.
Vulnerabilities
Ning compress-lzf pre-1.2.0 OOB Access Enables JVM Heap Leak and Service Crash via CVE-2026-109395
Versions before 1.2.0 contain an out-of-bounds memory access that lets attackers leak JVM heap data or crash services.
Vulnerabilities
Apache Camel JGroups Deserialization Bug CVE-2026-88900 Enables RCE, Patches Now Available
A high-severity deserialization flaw in Apache Camel’s JGroups component enables remote code execution. Patches are available for supported versions.
Vulnerabilities
DB-GPT 0.8.2 Critical Flaw Allows Unauthenticated Remote Code Execution
A critical vulnerability in DB-GPT through version 0.8.2 lets attackers run code as root without authentication, exploiting a mock admin role function.
Vulnerabilities
aiohttp keepalive flaw lets attackers hoard server connections
Versions before 3.14.4 lack initial timeout checks, allowing idle connections to persist indefinitely and exhaust capacity.
Vulnerabilities
IBM Security Verify Access CVE-2026-109126 Allows Physical Privilege Escalation
IBM confirms a high-severity flaw in specific appliance versions that permits local attackers to gain elevated rights via hardcoded credentials.
Vulnerabilities
H3C Magic NX15 Critical RCE Flaw CVE-2026-112371 Allows Arbitrary Code Execution
A critical remote code injection flaw in H3C Magic NX15 version NX15V100R017 allows attackers to manipulate path arguments for arbitrary code execution.
Vulnerabilities
Pillow APNG Memory Exhaustion Vulnerability Fixed in Version 13.0.0
A high-severity flaw in the Python imaging library allows crafted animated PNGs to crash servers by exhausting system memory before safety checks run.
Vulnerabilities
Plex Media Server RCE Chain Deploys Cryptominers on Unpatched Systems
Attackers are chaining four flaws in Plex Media Server to execute code remotely, deploying cryptominers and proxy software on unpatched systems.
Vulnerabilities
Grav API Plugin Vulnerability Lets Attackers Drain Server Storage or Evade Page Rules
The Grav API plugin for versions prior to 1.0.42 contains critical flaws that allow attackers to exhaust server storage or bypass page rules.
Vulnerabilities
Mercury RCE Bug in Pre-3.2.6 Lets Attackers Run Python Code on Tokenless Servers
A critical flaw in Mercury versions before 3.2.6 lets anonymous users run arbitrary Python code on servers configured without authentication tokens.
Vulnerabilities
Citrix NetScaler RCE: Access-Log Poisoning Enables Unauthenticated Root Access via CVE-2026-88771
Attackers execute commands on NetScaler ADC and Gateway without credentials. Citrix provides patches for versions 14.1 and 13.1.
Vulnerabilities
Craft CMS Twig Filter Flaw Allows Remote Code Execution
Authenticated users can exploit a missing guard in Craft CMS to write webshells, affecting versions prior to 4.18.8 and 5.11.0.
Vulnerabilities
Tapo C320WS Wi-Fi Camera Has Authenticated Stack Overflow Vulnerability
An authenticated stack-based buffer overflow in the Tapo C320WS Wi-Fi camera allows local attackers to execute commands with root privileges on affected devices.
Vulnerabilities
aiohttp multipart flaw exhausts file descriptors in Python apps
An unauthenticated attacker can crash servers using crafted requests in aiohttp versions before 3.14.4. A patch is now available for affected Python deployments.
Vulnerabilities
BentoML Dockerfile Injection Flaw Rated High Severity, Affects Versions Up to 1.4.39
A high-severity injection vulnerability in BentoML allows attackers to manipulate Docker build instructions through crafted configuration files, potentially exposing build secrets.
Vulnerabilities
Apache Camel Redis Component Has High-Severity Deserialization Flaw
A vulnerability in the Spring Redis component allows remote code execution via untrusted data. Patches are available for supported versions, while older lines remain at risk.
Vulnerabilities
Vanus Hardcoded Admin Token Granting Cluster-Admin Access in Versions 0.8.0 to 0.9.0
A hardcoded admin token in Vanus versions 0.8.0 through 0.9.0 allows unauthenticated attackers to gain full cluster-admin access to the gateway proxy.
Vulnerabilities
WhoDB Arbitrary File Access Bug in Pre-0.135.0 Builds Enables Unauthenticated Host File Read and Write
A critical vulnerability in WhoDB versions before 0.135.0 allows attackers to access arbitrary files on the host system without credentials.
Vulnerabilities
Cisco Email, PAN-OS, Ahsay Flaws: CISA Mandates Immediate Patching for Six Exploited Vulnerabilities
The US government catalog now includes six exploited vulnerabilities in major security and backup products, requiring immediate patching by operations teams.