Three organizations in Israel, the UK, and the US are hiring senior security experts to strengthen their teams amid high demand for specialized roles.
Rapid7 found three vulnerabilities in the facility management platform, including a critical remote code execution flaw that allows unauthenticated attackers to take control of servers.
Python imaging library Pillow has released version 13.0.0 to fix a critical argument injection flaw that allows attackers to execute arbitrary commands via Ghostscript.
Versions before 1.2.0 contain an out-of-bounds memory access that lets attackers leak JVM heap data or crash services.
A high-severity deserialization flaw in Apache Camel’s JGroups component enables remote code execution. Patches are available for supported versions.
A critical vulnerability in DB-GPT through version 0.8.2 lets attackers run code as root without authentication, exploiting a mock admin role function.
Versions before 3.14.4 lack initial timeout checks, allowing idle connections to persist indefinitely and exhaust capacity.
IBM confirms a high-severity flaw in specific appliance versions that permits local attackers to gain elevated rights via hardcoded credentials.
A critical remote code injection flaw in H3C Magic NX15 version NX15V100R017 allows attackers to manipulate path arguments for arbitrary code execution.
A high-severity flaw in the Python imaging library allows crafted animated PNGs to crash servers by exhausting system memory before safety checks run.
Attackers are chaining four flaws in Plex Media Server to execute code remotely, deploying cryptominers and proxy software on unpatched systems.
The Grav API plugin for versions prior to 1.0.42 contains critical flaws that allow attackers to exhaust server storage or bypass page rules.
A critical flaw in Mercury versions before 3.2.6 lets anonymous users run arbitrary Python code on servers configured without authentication tokens.
Attackers execute commands on NetScaler ADC and Gateway without credentials. Citrix provides patches for versions 14.1 and 13.1.
Authenticated users can exploit a missing guard in Craft CMS to write webshells, affecting versions prior to 4.18.8 and 5.11.0.
An authenticated stack-based buffer overflow in the Tapo C320WS Wi-Fi camera allows local attackers to execute commands with root privileges on affected devices.
An unauthenticated attacker can crash servers using crafted requests in aiohttp versions before 3.14.4. A patch is now available for affected Python deployments.
A high-severity injection vulnerability in BentoML allows attackers to manipulate Docker build instructions through crafted configuration files, potentially exposing build secrets.
A vulnerability in the Spring Redis component allows remote code execution via untrusted data. Patches are available for supported versions, while older lines remain at risk.
A hardcoded admin token in Vanus versions 0.8.0 through 0.9.0 allows unauthenticated attackers to gain full cluster-admin access to the gateway proxy.
A critical vulnerability in WhoDB versions before 0.135.0 allows attackers to access arbitrary files on the host system without credentials.
The US government catalog now includes six exploited vulnerabilities in major security and backup products, requiring immediate patching by operations teams.
Users of the richdocumentscode app must upgrade to version 26.4.303 to stop remote attackers from executing operating system commands without credentials.
A flaw in the http_request tool allows credential theft via proxy manipulation. Version 0.8.2 patches the issue; rotate tokens if you used affected builds.