Vulnerabilities
Leantime JSON-RPC Flaw Lets Users Escalate to Admin in Versions Below 3.10.0
A high-severity authorization bypass in Leantime allows any authenticated user to create admin accounts or manage plugins. Version 3.10.0 patches the issue.
Vulnerabilities
Vulnerabilities
Vulnerabilities
HTTP Headers Enable Indirect Prompt Injection in AI Agents via 30 Sites
Researchers found dozens of sites using HTTP headers to inject malicious instructions into AI agents, though most attempts were harmless pranks.
Vulnerabilities
Linux KVM CVE-2026-99999 Critical Flaw Enables Guest VMs to Corrupt Host Memory in Versions 4.4-6.18
A critical kernel flaw in Linux networking code allows guest VMs to corrupt host memory, affecting KVM hypervisors running versions 4.4 through 6.18.
Vulnerabilities
ILIAS PHP Object Injection Flaw Lets Authenticated Users Run Code
A high-severity vulnerability in ILIAS allows attackers with test permissions to execute arbitrary code via crafted archives.
Vulnerabilities
Markdown Preview Enhanced Fixes Remote Code Execution in VS Code Extension
A high-severity command injection flaw in the Markdown Preview Enhanced extension allows attackers to run system commands via crafted links, now patched in version 0.8.28.
Vulnerabilities
WeGIA Session Flaw Lets Attackers Hijack Accounts and Leak DB Host
A vulnerability in WeGIA below version 3.8.6 allows session hijacking and internal host disclosure, with a patch now available for deployment.
Vulnerabilities
OpenAEV Patch Fixes Unauthenticated Access to Adversary Simulation Data
A high-severity flaw in OpenAEV allows unauthenticated users to read and modify exercise data. Version 2.260622.0 provides a fix for the authentication bypass.
Vulnerabilities
FileRise WebDAV Bypass Allows Login Without TOTP in Versions Before 3.16.0
A high-severity flaw in FileRise lets attackers bypass two-factor authentication on the WebDAV service using only primary credentials.
Vulnerabilities
GitPython Argument Injection in Head.checkout() Allows Arbitrary File Read Before 3.2.0
Versions of the GitPython library prior to 3.2.0 contain a high-severity argument injection flaw that lets attackers read local files via malicious branch names.
Vulnerabilities
MoviePilot Command Injection Flaw Allows Remote Code Execution
A high-severity flaw in MoviePilot through 3.1.5 lets attackers run system commands via crafted content, with no patch confirmed yet.
Vulnerabilities
Ellucian WebAdvisor 3.2 Has High-Severity Unauthenticated XXE Flaw
An unpatched XML injection flaw in Ellucian WebAdvisor 3.2 allows remote attackers to steal credentials and read files. No fix exists.
Vulnerabilities
Detect JWT Vulnerabilities: Signals, Tools, and Hidden Blind Spots
Most JWT security failures occur not in the cryptography itself, but in how applications interpret and validate the token’s header and payload structure during processing.
Vulnerabilities
iOS Zero-Click Vulnerabilities Explained for Beginners
Zero-click exploits allow attackers to compromise your device without you opening a link or touching the screen, bypassing standard user interaction defenses.
Vulnerabilities
Eclipse Vert.x PostgreSQL Client Has High-Severity Memory Exhaustion Flaw
A missing validation check in the PostgreSQL message decoder allows malicious servers to crash clients before authentication completes.
Vulnerabilities
Implement Secure Configuration Baselines: A Step-by-Step Guide
Configuration baselines reduce your attack surface by disabling unused features, but they introduce hidden operational friction that requires strict change management to survive.
Vulnerabilities
How CRLF Injection Works: Step-by-Step Mechanics and Defense
CRLF injection exploits protocol parsing rules to split headers from bodies, allowing attackers to inject arbitrary HTTP response data or bypass security controls without executing code.
Vulnerabilities
Slican IPx Phone Systems Patch Plaintext Password Storage Flaw
Slican released a version update for IPx telephone exchanges to fix a high-severity flaw that stored subscriber passwords in readable text.
Vulnerabilities
How OpenSSH Vulnerabilities Work: The Attack Chain Explained
OpenSSH flaws often succeed because cryptographic boundaries fail during protocol negotiation, allowing attackers to bypass authentication without breaking the encryption itself.
Vulnerabilities
Microsoft Exchange Vulnerability Warning Signs and Response Steps
Exchange servers often leak internal network topology and service states through HTTP headers before authentication failures appear in standard logs.
Vulnerabilities
Threat Modeling for Small Applications: Practical Steps and Costs
Threat modeling exposes architectural flaws that automated scanners miss, allowing small teams to prioritize fixes before code reaches production environments.
Vulnerabilities
Logging Library Vulnerabilities: Hidden Risks and Mitigation Strategies
Logging libraries often execute code during message formatting, turning simple text output into a vector for remote execution and data exfiltration without any direct user input validation.
Vulnerabilities
Why CVSS Environmental Scores Matter for Security Prioritization
Base scores ignore your specific context, causing teams to waste effort on low-impact flaws while missing critical risks in their actual architecture.
Vulnerabilities
AWS Load Balancer Controller 3.4.2 Fixes Misordered HTTP/gRPC Route Precedence CVE
Version 3.4.2 resolves CVE-2026-15738, which allowed users to intercept traffic via misordered HTTP and gRPC routes on shared gateways.
Vulnerabilities
SQL Injection in CP Multi View Event Calendar Affects WordPress Sites
A high-severity SQL injection flaw in the CP Multi View Event Calendar plugin affects versions through 1.4.41, with no confirmed patch status in the record.