The CloudSec Pulse Advisory Desk is the part of the CloudSec Pulse newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 44 articles so far. See the editorial policy or report an error.
Attackers are actively exploiting a command injection flaw in SiteGuard Server Edition to gain full system control. Organizations must verify exposure before patching.
A critical SQL injection flaw in Arraytics Booktics versions up to 1.0.29 allows attackers to manipulate database queries and compromise sensitive information.
Critical remote code execution flaws in Drupal core and a contributed module require urgent updates across all supported versions before exploits spread.
AWS patches two vulnerabilities in FreeRTOS-Plus-TCP that allow remote attackers to manipulate IPv6 routing and DNS resolution on embedded devices.
Researchers found sites using HTTP headers to send malicious instructions to AI agents, posing operational risks for businesses relying on automated web tools.
A critical flaw in OPNsense firewalls allows privilege escalation through manipulated GeoIP data, requiring immediate updates to version 26.1.11.
Public exploit code for a critical authentication bypass in FortiClient EMS allows unauthenticated attackers to seize control of endpoint management systems.
A vulnerability in the .NET client for Amazon S3 lets attackers alter metadata to decrypt objects, requiring immediate upgrades for affected versions.
A high-severity flaw in Microsoft SQL Server versions 2017 through 2022 allows authorized users to run code remotely, posing operational risks to businesses relying on these databases.
A critical vulnerability in Redash versions 26.0.0 through 26.9.0 allows attackers with query access to steal application secrets and write files to the server.
A critical heap overflow in Juniper’s service-deployment daemon allows unauthenticated attackers to seize full control of network devices.
A critical flaw in Junos OS Evolved lets low-privilege TACACS users gain root access, threatening operational security for networks using specific versions.
A high-severity algorithmic complexity flaw in Microsoft .NET libraries allows remote attackers to disrupt services across Windows, Linux, and macOS platforms.
A high-severity vulnerability in Microsoft’s .NET WPF runtime enables attackers to run code over networks, requiring immediate updates for affected Windows applications.
Microsoft addresses a high-severity integer overflow in .NET Framework that allows remote attackers to elevate privileges on Windows systems.
Microsoft patches a high-severity deadlock vulnerability in ASP.NET Core Kestrel that allows remote denial of service via HTTP/3.
A critical integer underflow bug in Windows PowerShell allows remote code execution, posing significant operational risk to organizations relying on the tool.
A heap overflow in Windows DNS Server allows remote code execution, posing a severe risk to organizations relying on Microsoft infrastructure.
A critical vulnerability in Omnispace Agora versions before 26.10.0 allows attackers to inject PHP code and execute commands without authentication during installation.
Adobe Experience Manager faces a CVSS 10.0 authorization flaw allowing arbitrary code execution, impacting cloud and on-premises deployments across multiple versions.
Attackers are actively exploiting a CVSS 10.0 vulnerability in Bricksforge to execute code on WordPress sites. Organizations using versions prior to 3.1.8.10 must verify their patch status immediately.
A critical vulnerability in Wavlink firmware enables remote attackers to execute operating system commands through a specific CGI script.
A released package allows owners of the third-generation Fire TV Cube to unlock bootloaders and gain root access on firmware PS7717 or older, altering device security.
The XRP Ledger deployed an urgent fix for a supply cap flaw, bypassing standard voting and raising questions about network control.