1,437 articles
Threat IntelA critical security flaw in yii2-starter-kit exposes the Gii code generator and debug modules to all remote IP addresses by default, allowing unauthenticated RCE.
OT / SCADACISA advisory ICSA-26-272-05 exposes critical unauthenticated command injection and credential disclosure vulnerabilities across Anjvision streaming transcoders.
DevSecOpsA critical command injection flaw in GitLab AI Gateway allows remote attackers to break LLM agent sandboxes and execute code across enterprise cloud runners.
Threat IntelA critical stack-based buffer overflow in Tenda GPON optical terminals allows unauthenticated remote attackers on the WAN interface to achieve root command execution.
Threat IntelA critical HTTP header smuggling and cache poisoning vulnerability in Apache Traffic Server allows attackers to bypass ACLs and serve poisoned content globally.
AppleAn authentication bypass in Fleet device APIs allows unauthenticated remote attackers to impersonate enrolled Apple devices and trigger MDM actions.
Threat IntelAn authentication bypass and SQL injection in ground-station before v0.8.0 allows remote attackers to plant admin accounts and seize telemetry consoles.
OT / SCADAUndocumented backdoor maintenance accounts and hardcoded credentials in Hitachi Coding Software Suite through v3.3.0 permit unauthorized full system access.
OT / SCADAA hardcoded JWT signing key in Hitachi Coding Software Suite through v3.3.0 allows unauthenticated attackers to forge admin tokens and hijack factory lines.
Threat IntelA privilege escalation vulnerability in Internet2 Grouper before v7.5.1 allows authenticated users with rule editing rights to elevate to full system administrator.
Cyber AttackAn authentication bypass in SOGo groupware allows remote attackers to impersonate any user without credentials by supplying an unsanitized x-webobjects-remote-user header.
Threat IntelCISA advisory ICSA-26-272-04 warns that malformed RF uplink packets in Baicells Nova 430H private LTE base stations cause remote denial-of-service.
Threat IntelA critical URL validation defect in LiteSpeed Web Server before v6.3.7 build 1 permits remote actors to bypass rewrite rules and access internal handlers.
Threat IntelAn element confusion flaw in Apache WSS4J allows attackers to substitute encrypted headers with unencrypted plaintext, bypassing WS-Security confidentiality policies.
Threat IntelA critical format string vulnerability in ASUS gateway router web modules allows authenticated attackers to execute arbitrary code with root privileges.
FortinetFortinet resolves a high-severity improper access control flaw in FortiSandbox (CVE-2026-26084) allowing unauthenticated attackers to expose forensic analysis data.
Threat IntelA critical use-after-free flaw in Python's ssl module allows remote unauthenticated clients to crash TLS servers or hijack function pointers via SNI callbacks.
Threat IntelAn authentication bypass in Zammad helpdesk versions 6.3.0–6.5.4 allows remote attackers to hijack administrative sessions and achieve remote code execution.
Threat IntelA pre-authentication heap buffer overflow in ESnet iperf3 v3.20–3.21 allows unauthenticated remote attackers to corrupt heap memory via oversized RSA tokens.
Threat IntelAn unauthenticated RPyC service in LightLLM visual_only deployments enables remote attackers to execute arbitrary code on GPU clusters via pickle deserialization.
Threat IntelA critical heap use-after-free vulnerability in ESnet iperf3 v3.21 allows unauthenticated remote attackers to crash network test daemons or execute code.
Threat IntelA race condition in OpenBSD ldapd delegated authentication allows remote attackers to hijack directory sessions and impersonate arbitrary user identities.
Threat IntelA missing authentication flaw in PTZOptics cameras and Firmware Upgrade Tools allows unauthenticated attackers to flash malicious firmware remotely.
Threat IntelCISA issues ICSA-26-272-03 warning of a critical command injection flaw in VIVOTEK industrial camera firmware enabling physical security stream hijacking.