Vulnerabilities
LavaLite CMS 10.1.2 High-Severity CVE-2026-113358 Enables Unauthenticated Access to Private Files
An unauthenticated flaw in LavaLite CMS through version 10.1.2 allows attackers to download private files from local or remote storage.
Vulnerabilities
Vulnerabilities
Pillow MIC Parsing Bug: CVE-2026-112390 Causes Infinite Loop in olefile-Enabled Apps
A flaw in the Python imaging library allows crafted files to hang worker threads, requiring an upgrade to version 13.0.0 for resolution.
Vulnerabilities
Craft CMS Authentication Bypass Allows Account Takeover via Code Reuse
A high-severity flaw in Craft CMS versions prior to 5.11.0 lets attackers reuse email verification codes to reset passwords and seize control of user accounts.
Vulnerabilities
aiohttp multipart flaw triggers resource exhaustion; patch CVE-2026-111066 in 3.14.4
Unauthenticated attackers can trigger resource exhaustion in aiohttp versions 2 through 3.14.3 via crafted multipart requests using Request.post().
Vulnerabilities
crewai-tools SSRF vulnerability in SeleniumScrapingTool exposes internal resources via prompt injection
A server-side request forgery vulnerability in crewai-tools allows attackers to access internal resources via the SeleniumScrapingTool component.
Vulnerabilities
Bearer CLI SAST Ranks SQLi and OWASP Flaws by Proximity to Personal Data
The free static analysis tool ranks flaws by proximity to personal data, helping teams prioritize remediation efforts without executing the source code.
Vulnerabilities
Remote DoS in SGLang Scheduler Affects Versions Up to 0.5.19
A high-severity flaw in the SGLang scheduler allows remote denial of service attacks on versions through 0.5.19 while a fix awaits acceptance.
Vulnerabilities
DataBuff ai-apm-web Authentication Bypass Allows Admin Token Forgery
Unauthenticated attackers can forge administrative session tokens using a hardcoded secret in DataBuff ai-apm-web versions up to 0.1.10, granting full access to protected API routes.
Vulnerabilities
Course-Tencent-Cloud Critical SMS Brute-Force Flaw CVE-2026-111675 Affects v2.0.1
A critical vulnerability in the Course-Tencent-Cloud plugin allows unauthenticated attackers to bypass security controls via unlimited SMS verification code attempts.
Vulnerabilities
phpMyFAQ 4.2.0-alpha suffers high-severity resource exhaustion flaw
Unauthenticated API endpoints in phpMyFAQ 4.2.0-alpha allow attackers to crash servers by forcing the application to load all database records into memory.
Vulnerabilities
sshportal AuthZ Bug in Mgmt Shell Lets Non-Admins Grab Decrypted SSH Keys
Authenticated non-admin users can retrieve decrypted backend SSH keys via the management shell, enabling direct access to infrastructure and bypassing security controls.
Vulnerabilities
RIOT OS CoAP Integer Overflow Enables Remote Memory Corruption
An integer overflow in RIOT OS nanocoap allows remote attackers to corrupt memory. The flaw affects versions prior to 2026.07 and is rated critical.
Vulnerabilities
X.Org Server Use-After-Free Bug in Window Handling Leaks Data, Patch Available
A vulnerability in X.Org Server’s window handling allows local attackers to leak sensitive data, though a vendor patch is now available.
Vulnerabilities
Apache Answer 2.0.2 Auth Bypass: Unauth Users View Invite Lists; Update to 2.0.3
A low-severity flaw in Apache Answer versions through 2.0.2 allows unauthorized users to view invited-user lists for non-public questions.
Vulnerabilities
n8n OAuth Endpoint Flaw Allows Unauthenticated Resource Exhaustion in Versions Before 2.41.4
An uncontrolled resource consumption vulnerability in n8n allows attackers to bypass client registration caps and fill disk space via manipulated OAuth identifiers.
Vulnerabilities
Emacs CVE-2026-79992 Fix Incomplete; New CVE-2026-108976 Assigned
An advisory notes the previous patch for an Emacs flaw was incomplete, leading to the assignment of a new CVE identifier for the residual issue.
Vulnerabilities
Eclipse Vert.x Redis Parser Flaw Triggers Massive Memory Allocations, Crashing Event Loops in DoS Attack
A parser flaw in Eclipse Vert.x allows malicious Redis servers to trigger massive memory allocations that crash application event loops and deny service.
Vulnerabilities
Zero-Click Exploit Prevention Checklist for Secure Systems
Zero-click exploits bypass user interaction by exploiting memory corruption flaws, requiring strict isolation and minimal attack surfaces to mitigate risk.
Vulnerabilities
Sudo Vulnerability Response: Recovery and Containment Steps
Compromised privilege escalation tools require immediate credential rotation and binary replacement to prevent persistent root access on your servers.
Vulnerabilities
Why Disputed CVEs Matter for Your Security Workflow
Ignoring rejected CVE records creates blind spots that allow attackers to exploit known weaknesses before your defenses can respond.
Vulnerabilities
Compensating Controls: How to Secure Systems When Primary Defenses Fail
Compensating controls provide equivalent security when primary defenses are impossible to implement, allowing operations to continue safely without violating compliance standards.
Vulnerabilities
Detect Citrix NetScaler Vulnerabilities: Logs, Tools, and Hidden Blind Spots
Most Citrix NetScaler breaches succeed because defenders monitor application logs while the actual compromise occurs in the underlying operating system kernel.
Vulnerabilities
Web Application Firewall Tuning: Stop False Positives and Protect Traffic
Default firewall rules block legitimate user actions, forcing you to tune signatures to distinguish between human error and actual attacks.
Vulnerabilities
Linux Kernel Privilege Escalation Response and Recovery Steps
A compromised kernel bypasses all user-space security controls, requiring immediate network isolation and forensic imaging before any remediation attempts begin.