Vulnerabilities
LavaLite CMS 10.1.2 High-Severity CVE-2026-113358 Enables Unauthenticated Access to Private Files
An unauthenticated flaw in LavaLite CMS through version 10.1.2 allows attackers to download private files from local or remote storage.
NVD
Everything SecOps Signal has reported about NVD: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
aiohttp multipart flaw triggers resource exhaustion; patch CVE-2026-111066 in 3.14.4
Unauthenticated attackers can trigger resource exhaustion in aiohttp versions 2 through 3.14.3 via crafted multipart requests using Request.post().
Vulnerabilities
crewai-tools SSRF vulnerability in SeleniumScrapingTool exposes internal resources via prompt injection
A server-side request forgery vulnerability in crewai-tools allows attackers to access internal resources via the SeleniumScrapingTool component.
Vulnerabilities
Windows Search Use-After-Free Flaw Enables Network Privilege Escalation
An unauthenticated remote vulnerability in the Windows Search component allows attackers to gain elevated privileges, rated critical by the NVD.
Vulnerabilities
Argo CD Flaw Lets Git Users Spawn Forbidden Kubernetes Resources During Deletion
A critical authorization flaw in Argo CD allows Git users to bypass project restrictions and create forbidden Kubernetes resources during application deletion events.
Vulnerabilities
Edimax BR-6208AC 1.32 Exposes Remote Command Injection via Firmware Upgrade Form
A critical CVE-2026-108917 allows remote attackers to execute arbitrary code on Edimax routers through a vulnerable upgrade endpoint.