Users of the richdocumentscode app must upgrade to version 26.4.303 to stop remote attackers from executing operating system commands without credentials.
A flaw in the http_request tool allows credential theft via proxy manipulation. Version 0.8.2 patches the issue; rotate tokens if you used affected builds.
A high-severity flaw in phpMyFAQ allows authenticated users with edit permissions to modify any FAQ entry, bypassing access controls and moderation checks.
A critical remote code execution flaw in LMCache allows unauthenticated attackers to run code via Pickle deserialization in distributed deployments.
A high-severity vulnerability in Tektronix oscilloscopes allows remote attackers to execute arbitrary commands with elevated privileges on affected devices.
Unauthenticated attackers can inject shortcodes via HTTP headers in the User Registration & Membership plugin versions up to 5.2.8.
Unauthenticated attackers can bypass account lockouts on LatePoint versions through 5.7.4 by exploiting a race condition in the verification process.
Anthropic releases patch for CVE-2026-96620, a critical flaw allowing arbitrary command execution via unvalidated resume parameters in the Python SDK.
Authenticated non-admin users in sshportal up to 1.19.5 can retrieve decrypted backend private keys via the management shell, bypassing security controls.
A high-severity authorization flaw in FreeRTOS versions 11.3.0 and 11.3.1 allows unprivileged tasks to read and write protected kernel memory.
A critical vulnerability in RIOT OS allows remote attackers to corrupt memory via malformed CoAP requests, with a fix available in version 2026.07.
MariaDB releases updates for multiple series to fix CVE-2026-92262, a critical flaw allowing attackers to bypass file encoding and execute code.
A critical flaw in MariaDB Server allows remote code execution via cursor handling; patches are available for affected 12.3 and 13.0 branches.
A CVSS 7.2 directory traversal bug in SonicWall Secure Mobile Access allows remote attackers to run code as root, but a vendor update is now available.
Google releases an update for Windows and Mac desktops that fixes ten security issues, including two rated critical severity.
GitLab releases patches for a critical integer overflow in CI/CD regular-expression handling that allows unauthenticated remote code execution on affected instances.
A low-severity flaw in Apache Kylin allows project admins to exhaust resources via cache APIs. Version 5.0.5 resolves the issue for affected users.
Apache Answer versions through 2.0.2 lack visibility checks on invited users for non-public questions, allowing unauthorized data retrieval.
A critical zero-day in BeyondTrust Remote Support allowed unauthenticated root access. The vendor released a patch on October 8 for affected versions up to 26.2.3.
A high-severity flaw in FrankenPHP allows concurrent requests to mix user session IDs, risking account takeover for systems using shared modules.
A high-severity flaw in OpenNextJS Cloudflare allows attackers to bypass middleware authorization by exploiting inconsistent path decoding in cached routes.
WordPress sites using halfdata Green Popups must update to version 7.6.3 to fix a critical blind SQL injection flaw.
A heap-based buffer overflow in X.Org Server lets local attackers escalate to root; a patch is available for affected installations.
A confirmed update addresses an out-of-bounds read in X.Org Server that could allow local attackers to access sensitive system data.