Vulnerabilities
.NET WPF Integer Overflow: MS Patches Remote Priv Escalation in Desktop Runtime 8-11
Microsoft released updates for .NET Desktop Runtime to fix a network-accessible privilege escalation flaw affecting versions 8 through 11.
Vuln Post Vulnerability Desk
Vulnerabilities
Vulnerabilities
.NET WPF Runtimes: Unsafe Deserialization Flaw in Versions 8-11 Patched to Stop RCE
Microsoft has released updates for .NET WPF runtimes to fix a high-severity remote code execution vulnerability caused by unsafe data deserialization.
Vulnerabilities
GlobalProtect macOS Privilege Escalation: Patch Available for Root Access Flaw
A medium-severity flaw in GlobalProtect for macOS allows local users to gain root access, but a fix is now available.
Vulnerabilities
WeGIA SQLi CVE-2026-55683: 3.8.6 Stops Remote Attackers From Manipulating Credentials and Billing Data
LabRedesCefetRJ WeGIA 3.8.6 patches a critical flaw allowing remote attackers to manipulate billing data and credentials via unsanitized inputs.
Vulnerabilities
WeGIA Critical SQL Injection CVE-2026-55684 Fixed in 3.8.6 Update for Charity Management App
LabRedesCefetRJ released version 3.8.6 to fix CVE-2026-55684, a CVSS 9.8 critical SQL injection vulnerability in the WeGIA charity management web application that allowed remote attackers to manipulate database records without authentication.
Vulnerabilities
PAN-OS Stored XSS Flaw CVE-2026-0316 Affects Firewalls and Panorama
Palo Alto Networks reports a low-severity stored cross-site scripting flaw in PAN-OS management interfaces that requires administrative access to exploit.
Vulnerabilities
Juniper Junos OS J-Web Buffer Overflow Allows Unauthenticated Remote Code Execution
A critical stack-based buffer overflow in Juniper Junos OS and Evolved httpd processes exposes virtual domains to remote code execution and denial of service.
Vulnerabilities
Juniper Junos OS Kernel Crash Vulnerability Requires Urgent Attention
An unauthenticated integer underflow flaw in Juniper Junos OS allows remote attackers to crash the kernel if Extended Echo is enabled.
Vulnerabilities
Ahsay Backup Server Patches Chained Auth Bypass and RCE Flaws Allowing Root Access
Ahsay released patches for two chained flaws in its backup server that let attackers create admin accounts and run code as root.
Vulnerabilities
webp-converter OS Command Injection Flaw Affects Versions Before 3.0.0
A critical flaw in the Node.js webp-converter library allows attackers to run system commands via crafted file names or option strings.
Vulnerabilities
transcribe2texts OS Command Injection Lets Attackers Run System Commands
Attackers can run system commands via crafted audio paths in transcribe2texts up to version 1.0.6. The NVD rates this flaw as critical.
Vulnerabilities
TR7 ASP Critical Command Injection Requires Urgent Updates for Virtual and Physical Deployments
A critical command injection vulnerability in TR7 ASP requires immediate version checks for both virtual and physical deployment models.
Vulnerabilities
.NET 8-11 Out-of-Bounds Write Flaw Enables Remote Code Execution on Windows
A high-severity out-of-bounds write flaw in .NET allows remote code execution on Windows. Patched runtimes are now available for versions 8 through 11.
Vulnerabilities
Microsoft .NET WPF RCE Flaw CVE-2026-70174 Patches XPS Link Bypass
High-severity remote code execution in .NET WPF allows attackers to run code via malicious XPS hyperlinks. Patches are available for versions 8 through 11.
Vulnerabilities
Abandoned Cart Pro Token Forgery Bug Permits Admin Takeover in Versions Up to 10.8.0
Unauthenticated attackers can hijack any user account, including admins, by forging tokens in Abandoned Cart Pro versions up to 10.8.0.
Vulnerabilities
Microsoft PPP EAP-TLS Heap Buffer Overflow Rated 9.8 Critical CVSS Score for Unauthenticated RCE
A critical heap overflow in Microsoft's PPP EAP-TLS protocol allows unauthenticated attackers to execute code remotely over a network connection.
Vulnerabilities
Printcart Store Plugin Unauthenticated RCE Flaw Affects Versions Through 2.9.1
A critical vulnerability in the Printcart Store WooCommerce plugin allows attackers to execute code remotely without logging in, affecting all versions up to 2.9.1.
Vulnerabilities
Adobe ColdFusion Authorization Flaw CVE-2026-106612 Enables Remote Code Execution
A critical authorization bypass in Adobe ColdFusion 2023 and 2025 allows low-privileged attackers to execute code without user interaction.
Vulnerabilities
Adobe ColdFusion Authorization Bypass CVE-2026-75994 Triggers Urgent Patch for 2023/2025 Versions
A critical authorization flaw in Adobe ColdFusion lets attackers run code without user interaction. Teams must patch versions 2025.0.13 and 2023.0.25 immediately.
Vulnerabilities
AEM OS Command Injection Flaw Allows Low-Privilege Code Execution
A critical OS command injection in Adobe Experience Manager lets low-privileged users run code without interaction. No patch is confirmed yet.
Vulnerabilities
Blazor WebAssembly Debugger CVE-2026-102870 Enables Remote Command Execution on Developer Workstations
A high-severity code injection flaw in the Blazor WebAssembly debugger allows remote attackers to execute commands on developer workstations during debugging sessions.
Vulnerabilities
Adobe Experience Manager 6.5 Faces Critical Input Validation Flaw
A zero-click code execution vulnerability affects AEM 6.5 through 6.5.25 with a CVSS score of 9.9. Security teams should assess exposure immediately as no patch is confirmed.
Vulnerabilities
FortiSIEM grpc path traversal bug enables unauthenticated remote code execution with 9.4 CVSS score
An unauthenticated path traversal flaw in FortiSIEM allows attackers to execute arbitrary code, rated high severity with a CVSS of 9.4 by Fortinet.
Vulnerabilities
Docker Registry Patched Critical Token Impersonation Flaw CVE-2026-105445 After Rapid Response
Docker fixed a critical flaw in its registry that let attackers impersonate users via transferred personal access tokens during account conversions.