Topic
34 articles
Threat IntelIvanti patches critical SQL injection vulnerability CVE-2026-89310 in Endpoint Manager Core Server enabling unauthenticated remote code execution.
CMS SecurityTyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
VulnerabilityChromaDB patches a critical vulnerability (CVE-2026-78110) in vector metadata filtering that allows unauthenticated remote attackers to execute arbitrary code.
PostgreSQLA critical SQL injection flaw in LiteLLM Proxy's vector metadata filtering allows unauthenticated API consumers to execute arbitrary PostgreSQL queries.
Threat IntelAn authentication bypass and SQL injection in ground-station before v0.8.0 allows remote attackers to plant admin accounts and seize telemetry consoles.
Threat IntelLiteLLM releases urgent patch for CVE-2026-42208, a pre-auth SQL injection flaw allowing unauthenticated remote attackers to dump LLM proxy master credentials.
CMS SecurityCISA incorporates WordPress Core vulnerabilities CVE-2026-60137 and CVE-2026-63030 (CVSS 9.8) into KEV catalog following active in-the-wild web attacks.
Active ExploitCISA alerts enterprises to active exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase analytics dashboards allowing database exfiltration.
CiscoCISA mandates urgent federal remediation after confirming active exploitation of CVE-2026-76461, an unauthenticated SQL injection flaw granting root shell access on Cisco SEG appliances.
Four high-severity vulnerabilities in widely deployed enterprise software — including a build-artefact repository that sits directly in the software supply chain.