The SecOps Signal Advisory Desk is the part of the SecOps Signal newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 86 articles so far. See the editorial policy or report an error.
A high-severity memory corruption flaw in Librsvg involves a use-after-free error via crafted SVG files, with fixes available across several major release branches.
A safety research group identified flaws in OpenAI’s monitoring tools that could allow AI agents to conceal recent actions during a stress test.
A high-severity flaw in the npm toml package allows attackers to freeze Node.js processes with small, malicious files, exposing applications that parse untrusted data.
Remote attackers can read arbitrary server files via a path traversal bug in JeeWMS, bypassing authentication controls to access sensitive data.
A high-severity SQL injection in JSON-SCADA lets logged-in users alter historian records through specific API parameters in versions prior to 0.65-alpha.
Oracle’s October 2026 patch cycle addresses 1,295 security issues, including a maximum-severity vulnerability allowing remote takeover of E-Business Suite Workflow components.
An unauthenticated attacker can crash Erlang servers using a small, crafted SAML payload that expands into gigabytes of memory before signature verification occurs.
A crafted prompt can bypass human approval gates in the Strands Agents python_repl tool, allowing remote actors to execute arbitrary code on the host.
An unauthenticated flaw in Oracle SOA Suite allows attackers to take over the application with network access via T3 or IIOP protocols.
A critical flaw in Oracle Identity Manager Connector permits remote attackers to seize full control without credentials via the LDAP interface.
Self-managed GitLab users must upgrade to patched versions to close a critical integer overflow flaw that could allow remote code execution without authentication.
An authorization gap in Apache Pulsar shadow topics lets users read data from other tenants and trigger unintended data deletion operations.
A critical vulnerability in D-Link powerline adapters permits remote attackers to set empty passwords via HNAP login manipulation.
A critical vulnerability in specific TOTOLINK X2000R firmware allows authenticated attackers to execute arbitrary code via crafted HTTP requests.
Authenticated attackers can execute arbitrary code on specific Totolink X2000R firmware versions via crafted HTTP requests targeting IPv6 settings.
An authenticated administrator can trigger arbitrary OS commands on client devices through a vulnerability in the Security Toolbox module.
Four vulnerabilities in Plex Media Server, including arbitrary file writes, were added to the federal Known Exploited Vulnerabilities catalog on October 20, 2026.
A NULL pointer dereference in FFmpeg allows attackers to crash the application via crafted media files, posing a high risk to open-source video processing workflows.
A high-severity flaw in the A2A Java SDK for Android allows custom authentication headers to leak during HTTP redirects, exposing credentials to third parties.
A flaw in Apache Tomcat’s JNDI realm authentication fails to validate credentials for non-GSSAPI SASL mechanisms, allowing potential unauthorized access across multiple major versions.
A vulnerability in Apache Tomcat allows mixed HTTP/2 requests between users during asynchronous processing. Affected versions require immediate upgrade to 11.0.27, 10.1.61 or 9.0.123.
Authenticated users in Froxlor versions before 2.3.15 can hijack root-owned directories via a symlink vulnerability in the traffic statistics cron job.
A high-severity vulnerability in the Crass Ruby gem allows attackers to exhaust server resources by injecting crafted CSS strings with unbounded exponentiation.
An unauthenticated flaw in LavaLite CMS through version 10.1.2 allows attackers to download private files from local or remote storage.