A critical flaw allows attackers to bypass authorization checks when deleting Argo CD applications, enabling unauthorized resource creation in Kubernetes clusters.
A critical vulnerability in Ivanti Xtraction allows authenticated attackers to hijack requests and steal connector credentials until version 2026.4 is released.
A critical flaw in IBM MCP Context Forge allows attackers to forge admin tokens. Version 1.0.2 fixes the issue by removing the default signing key and tightening access controls.
A high severity path traversal bug in Wazuh manager versions before 4.14.8 allows attackers with cluster keys to bypass validation and write files to arbitrary paths.
A critical vulnerability in Wazuh manager versions prior to 4.14.8 allows compromised cluster workers to overwrite configuration files and gain root execution.
A critical vulnerability in Square Squash allows attackers to execute arbitrary Ruby code via unsafe YAML processing on the symbolication API endpoint.
Bloom Security found over 1,500 npm packages vulnerable to a publishing attack that could allow AI agents to install malicious code without credential theft.
Attackers targeted the unauthenticated server-side request forgery flaw in SonicWall appliances shortly after the vendor issued a critical security update.
A critical vulnerability in Wavlink router firmware allows remote attackers to execute arbitrary operating system commands via a CGI script.
A critical SQL injection flaw in phpMyFAQ allows unauthenticated attackers to access database credentials and configuration secrets via the autocomplete search feature.
A critical flaw in Obsidian-TC allows unauthorized vault access via token misuse, fixed in version 1.3.1.
A critical isolation flaw in MarkLogic Server allows attackers to hijack sessions via REST and XDBC paths in versions prior to 11.3.7 and 12.1.0.
A critical vulnerability in older MarkLogic Server versions lets users with limited rights escalate to full administrative control.
A critical flaw in AnyDesk versions prior to 8.0.3 allows attackers to run code as root on Linux systems without user approval or authentication.
A remote code execution vulnerability in Linksys E1700 firmware allows attackers to inject operating system commands via IPv6 configuration inputs.
A new survey reveals that while developers use AI tools, most question the accuracy of the generated code and output.
Security researchers identified a critical blind SQL injection flaw in Tickera versions up to 3.6.0.6, risking unauthorized database access and data exposure.
Citrix urges immediate patching for a new 9.5-severity remote code execution flaw affecting NetScaler ADC and Gateway appliances, though exploitation status remains unconfirmed.
A critical flaw in Wukong_HRM lets attackers bypass login checks to access sensitive employee data and administrative controls without valid credentials.
Versions before 0.5.0 of the Privasys RA-TLS library allow attackers to relay valid enclave quotes to unauthorized TLS sessions, bypassing security checks.
A critical flaw in the Advanced IP Blocker plugin allows unauthenticated attackers to bypass two-factor authentication and seize full control of WordPress sites.
A critical vulnerability in Privasys Enclave OS allows attackers to relay TLS quotes, bypassing security checks in versions prior to specific tdx updates.
A logic error in Nginx UI versions prior to 2.5.0 allows password-only login for accounts protected by WebAuthn passkeys, ignoring the second factor requirement.
Security teams must patch WordPress installations running ThemeREX Convex versions through 1.16.0 to close a critical deserialization flaw rated 9.8 by the NVD.