Vulnerabilities
Wavlink WL-WN530BE1-A Router CGI Script Enables Arbitrary OS Command Execution
A critical vulnerability in Wavlink router firmware allows remote attackers to execute arbitrary operating system commands via a CGI script.
Vulnerabilities
Vulnerabilities
Vulnerabilities
phpMyFAQ Autocomplete SQLi Leak Config Secrets via Unicode Input
A critical SQL injection flaw in phpMyFAQ allows unauthenticated attackers to access database credentials and configuration secrets via the autocomplete search feature.
Vulnerabilities
Obsidian-TC Critical Auth Bypass Exposes Vaults Before 1.3.1
A critical flaw in Obsidian-TC allows unauthorized vault access via token misuse, fixed in version 1.3.1.
Vulnerabilities
MarkLogic Server Critical Isolation Flaw in Pre-11.3.7/12.1.0 Enables Session Hijacking via REST and XDBC
A critical isolation flaw in MarkLogic Server allows attackers to hijack sessions via REST and XDBC paths in versions prior to 11.3.7 and 12.1.0.
Vulnerabilities
MarkLogic Server Flaw Allows Remote Attackers to Seize Admin Control via Injection
A critical vulnerability in older MarkLogic Server versions lets users with limited rights escalate to full administrative control.
Vulnerabilities
AnyDesk Heap Overflow in Stream Protocol Grants Unauthenticated Root Access on Linux
A critical flaw in AnyDesk versions prior to 8.0.3 allows attackers to run code as root on Linux systems without user approval or authentication.
Vulnerabilities
Linksys E1700: Remote Code Execution via IPv6 Input in Unpatched Firmware
A remote code execution vulnerability in Linksys E1700 firmware allows attackers to inject operating system commands via IPv6 configuration inputs.
Vulnerabilities
Stack Overflow Survey Shows Developers Trusting AI Less Than Expected
A new survey reveals that while developers use AI tools, most question the accuracy of the generated code and output.
Vulnerabilities
Tickera Plugin: Critical Blind SQL Injection in v3.6.0.6 Risks Database Access
Security researchers identified a critical blind SQL injection flaw in Tickera versions up to 3.6.0.6, risking unauthorized database access and data exposure.
Vulnerabilities
Citrix NetScaler ADC and Gateway face critical RCE risk; patches required for 9.5-severity flaw
Citrix urges immediate patching for a new 9.5-severity remote code execution flaw affecting NetScaler ADC and Gateway appliances, though exploitation status remains unconfirmed.
Vulnerabilities
Input Validation Cyber Security: Stop Code Injection Before It Starts
Treating all incoming data as hostile by default prevents the majority of logical flaws that attackers exploit to take control of your systems.
Vulnerabilities
Wukong_HRM Critical Auth Bypass CVE-2026-108707 Exposes Employee Data and Admin Controls Without Credentials
A critical flaw in Wukong_HRM lets attackers bypass login checks to access sensitive employee data and administrative controls without valid credentials.
Vulnerabilities
VPN Appliance Vulnerabilities Prevention Checklist for Secure Networks
Default configurations and unpatched firmware expose remote access tunnels to lateral movement and data exfiltration without triggering standard network alerts.
Vulnerabilities
Privasys RA-TLS Relay Flaw Bypasses Security in Rust/Go Clients Under 0.5.0
Versions before 0.5.0 of the Privasys RA-TLS library allow attackers to relay valid enclave quotes to unauthorized TLS sessions, bypassing security checks.
Vulnerabilities
Advanced IP Blocker CVE-2026-104732: Unauthenticated TOTP Brute-Force Grants Full WordPress Control
A critical flaw in the Advanced IP Blocker plugin allows unauthenticated attackers to bypass two-factor authentication and seize full control of WordPress sites.
Vulnerabilities
Privasys Enclave OS TLS Quote Relay Bug Bypasses Attestation in Older Builds
A critical vulnerability in Privasys Enclave OS allows attackers to relay TLS quotes, bypassing security checks in versions prior to specific tdx updates.
Vulnerabilities
Nginx UI logic flaw CVE-2026-107808 bypasses WebAuthn 2FA for pre-2.5.0 users
A logic error in Nginx UI versions prior to 2.5.0 allows password-only login for accounts protected by WebAuthn passkeys, ignoring the second factor requirement.
Vulnerabilities
WordPress Convex Plugin Deserialization Vulnerability Requires Immediate Patching for Critical Fix
Security teams must patch WordPress installations running ThemeREX Convex versions through 1.16.0 to close a critical deserialization flaw rated 9.8 by the NVD.
Vulnerabilities
Detecting Zero-Day Exploits: Signals, Logs and Blind Spots
Zero-day exploits often leave no signature, so you must detect them by observing deviations in system behavior and resource consumption rather than matching known patterns.
Vulnerabilities
Why CVE Identifiers Matter for Security Operations
CVE identifiers transform chaotic vulnerability data into a structured language that enables precise risk assessment and automated remediation across complex infrastructure.
Vulnerabilities
Detecting Router Vulnerabilities: Log Signals, Blind Spots and Tools
Network devices hide compromise in firmware checksums and silent MAC address changes that standard intrusion detection systems miss entirely.
Vulnerabilities
Session Fixation Warning Signs and Immediate Response Steps
Attackers hijack valid session tokens without stealing credentials, allowing access even when passwords remain secure and encryption is active.
Vulnerabilities
Detect Clickjacking: Log Signals, Tool Gaps, and Hidden Traps
Clickjacking attacks often leave no server-side trace because the victim’s browser executes legitimate requests within hidden frames that bypass standard logging.
Vulnerabilities
Stop Authentication Bypass Vulnerabilities with Priority Controls
Most authentication bypasses occur because systems trust client-side state instead of verifying every request against a secure server-side session.