A high-severity vulnerability in Microsoft’s .NET WPF runtime enables attackers to run code over networks, requiring immediate updates for affected Windows applications.
Microsoft addresses a high-severity integer overflow in .NET Framework that allows remote attackers to elevate privileges on Windows systems.
Microsoft patches a high-severity deadlock vulnerability in ASP.NET Core Kestrel that allows remote denial of service via HTTP/3.
A critical integer underflow bug in Windows PowerShell allows remote code execution, posing significant operational risk to organizations relying on the tool.
A heap overflow in Windows DNS Server allows remote code execution, posing a severe risk to organizations relying on Microsoft infrastructure.
A critical vulnerability in Omnispace Agora versions before 26.10.0 allows attackers to inject PHP code and execute commands without authentication during installation.
Adobe Experience Manager faces a CVSS 10.0 authorization flaw allowing arbitrary code execution, impacting cloud and on-premises deployments across multiple versions.
Session tokens often travel insecurely in WebSocket upgrades, allowing attackers to mirror your live activity without triggering standard intrusion alerts.
NoSQL injection occurs when application code treats user input as database queries, allowing attackers to bypass authentication and extract sensitive records without traditional SQL syntax.
Hard-coded credentials embed access secrets directly into software code, creating a permanent backdoor that remains visible to anyone who examines the application’s source files.
Attackers are actively exploiting a CVSS 10.0 vulnerability in Bricksforge to execute code on WordPress sites. Organizations using versions prior to 3.1.8.10 must verify their patch status immediately.
Self-hosted GitLab breaches often exploit configuration errors and outdated components rather than unknown code flaws, allowing attackers to pivot from web access to full system control.
A critical vulnerability in Wavlink firmware enables remote attackers to execute operating system commands through a specific CGI script.
A released package allows owners of the third-generation Fire TV Cube to unlock bootloaders and gain root access on firmware PS7717 or older, altering device security.
Command injection is a specific mechanism that leads to remote code execution, which is the broader outcome an attacker seeks to achieve.
The XRP Ledger deployed an urgent fix for a supply cap flaw, bypassing standard voting and raising questions about network control.
Attackers target unauthenticated server-side request forgery flaw in SonicWall SMA 1000 appliances, prompting urgent vendor patching and heightened alert status.
A flaw in sandboxed.sh versions up to 1.3.0 allows container code to bypass isolation and access host files, creating severe security risks for organizations using the tool.
Self-managed GitLab users must upgrade immediately to fix severe authorization and code execution flaws released in October 2026.
Horizon3.ai reports that CVE-2026-102489 in Zammad allows attackers to steal session cookies and potentially execute remote code through error messages.
A critical vulnerability in the rtMedia plugin allows attackers to traverse directories, potentially exposing sensitive data on WordPress, BuddyPress, and bbPress sites.
Unauthenticated PHP object injection in Stargaze versions 1.10 and earlier allows attackers to take full control of affected websites.
Attackers are targeting unpatched AhsayCBS management consoles to install webshells and cryptocurrency miners, posing a significant risk to MSPs.
A critical authentication bypass in Wukong_HRM allows unauthenticated remote attackers to access all HR endpoints and modify employee records without credentials.