Vulnerabilities
Abandoned Cart Pro Token Forgery Bug Permits Admin Takeover in Versions Up to 10.8.0
Unauthenticated attackers can hijack any user account, including admins, by forging tokens in Abandoned Cart Pro versions up to 10.8.0.
Vulnerabilities
Vulnerabilities
Vulnerabilities
Microsoft PPP EAP-TLS Heap Buffer Overflow Rated 9.8 Critical CVSS Score for Unauthenticated RCE
A critical heap overflow in Microsoft's PPP EAP-TLS protocol allows unauthenticated attackers to execute code remotely over a network connection.
Vulnerabilities
Printcart Store Plugin Unauthenticated RCE Flaw Affects Versions Through 2.9.1
A critical vulnerability in the Printcart Store WooCommerce plugin allows attackers to execute code remotely without logging in, affecting all versions up to 2.9.1.
Vulnerabilities
Adobe ColdFusion Authorization Flaw CVE-2026-106612 Enables Remote Code Execution
A critical authorization bypass in Adobe ColdFusion 2023 and 2025 allows low-privileged attackers to execute code without user interaction.
Vulnerabilities
Adobe ColdFusion Authorization Bypass CVE-2026-75994 Triggers Urgent Patch for 2023/2025 Versions
A critical authorization flaw in Adobe ColdFusion lets attackers run code without user interaction. Teams must patch versions 2025.0.13 and 2023.0.25 immediately.
Vulnerabilities
AEM OS Command Injection Flaw Allows Low-Privilege Code Execution
A critical OS command injection in Adobe Experience Manager lets low-privileged users run code without interaction. No patch is confirmed yet.
Vulnerabilities
Blazor WebAssembly Debugger CVE-2026-102870 Enables Remote Command Execution on Developer Workstations
A high-severity code injection flaw in the Blazor WebAssembly debugger allows remote attackers to execute commands on developer workstations during debugging sessions.
Vulnerabilities
Adobe Experience Manager 6.5 Faces Critical Input Validation Flaw
A zero-click code execution vulnerability affects AEM 6.5 through 6.5.25 with a CVSS score of 9.9. Security teams should assess exposure immediately as no patch is confirmed.
Vulnerabilities
Broken Access Control Prevention Checklist for Secure Applications
Most access control failures stem from trusting client-side inputs rather than enforcing server-side authorization checks on every request.
Vulnerabilities
FortiSIEM grpc path traversal bug enables unauthenticated remote code execution with 9.4 CVSS score
An unauthenticated path traversal flaw in FortiSIEM allows attackers to execute arbitrary code, rated high severity with a CVSS of 9.4 by Fortinet.
Vulnerabilities
Difference Between Cross Site Scripting and Request Forgery: Core Mechanics
Cross-site scripting executes code in the user's browser, while request forgery tricks the browser into sending authenticated requests without user consent.
Vulnerabilities
Docker Registry Patched Critical Token Impersonation Flaw CVE-2026-105445 After Rapid Response
Docker fixed a critical flaw in its registry that let attackers impersonate users via transferred personal access tokens during account conversions.
Vulnerabilities
Argo CD: Critical Auth Bypass in PostDelete Hooks Lets Git Users Create Unauthorized Kubernetes Resources
A critical flaw allows attackers to bypass authorization checks when deleting Argo CD applications, enabling unauthorized resource creation in Kubernetes clusters.
Vulnerabilities
Ivanti Xtraction Request Hijack CVE-2026-106042 Steals Credentials in Versions Before 2026.4
A critical vulnerability in Ivanti Xtraction allows authenticated attackers to hijack requests and steal connector credentials until version 2026.4 is released.
Vulnerabilities
7 Configuration Mistakes That Enable XML External Entity Attacks
Default XML parsers often process external entities by design, turning data inputs into file-read or server-side request forgery vectors without any code change.
Vulnerabilities
IBM MCP Context Forge: CVE-2026-53709 Critical Vuln Enables Unauth Admin Token Forge in Pre-1.0.2 Versions
A critical flaw in IBM MCP Context Forge allows attackers to forge admin tokens. Version 1.0.2 fixes the issue by removing the default signing key and tightening access controls.
Vulnerabilities
Wazuh Path Traversal Flaw Lets Cluster Workers Write Arbitrary Files
A high severity path traversal bug in Wazuh manager versions before 4.14.8 allows attackers with cluster keys to bypass validation and write files to arbitrary paths.
Vulnerabilities
7 Configuration Errors That Expose Systems to Zero-Day Exploits
Most zero-day breaches originate from flawed deployment patterns that amplify the impact of unknown code flaws long before patches exist.
Vulnerabilities
Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
Default configurations and implicit trust assumptions create silent pathways for unauthenticated remote code execution that bypass standard perimeter defenses.
Vulnerabilities
Wazuh Arbitrary File Overwrite in MasterHandler Yields Root RCE for CVE-2026-74040
A critical vulnerability in Wazuh manager versions prior to 4.14.8 allows compromised cluster workers to overwrite configuration files and gain root execution.
Vulnerabilities
WordPress Plugin Update Policies: 6 Common Misunderstandings Corrected
Automatic updates often skip security patches due to compatibility checks, leaving sites exposed to known vulnerabilities for weeks.
Vulnerabilities
Square Squash Unsafe YAML Processing Enables Critical Unauthenticated Ruby RCE in CVE-2026-109391
A critical vulnerability in Square Squash allows attackers to execute arbitrary Ruby code via unsafe YAML processing on the symbolication API endpoint.
Vulnerabilities
npm Packages Exposed via Trusted Publishing Flaw in SlugFest Report
Bloom Security found over 1,500 npm packages vulnerable to a publishing attack that could allow AI agents to install malicious code without credential theft.
Vulnerabilities
SonicWall SMA 1000 SSRF Flaw CVE-2026-102255 Hit Before Oct 6 Patch
Attackers targeted the unauthenticated server-side request forgery flaw in SonicWall appliances shortly after the vendor issued a critical security update.