Vulnerabilities
Databasus API Flaw Allows Unrestricted Brute-Force of Password Reset Codes
A critical flaw in Databasus versions up to 3.61.0 allows attackers to guess six-digit reset codes without rate limits, risking full account takeover.
Packet Tribune CVE Desk
The Packet Tribune CVE Desk is the part of the Packet Tribune newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 30 articles so far. See the editorial policy or report an error.
Vulnerabilities
Visual Studio Code Output Encoding Error Triggers RCE Threat in Versions Below 1.141.1
Unpatched Visual Studio Code installations risk remote code execution due to improper output encoding, rated high severity by NVD.
Vulnerabilities
Palo Alto GlobalProtect input handling bug CVE-2026-0319 enables identity impersonation, patches released for PAN-OS
Palo Alto Networks fixes a medium-severity input handling bug allowing authenticated users to assume other identities in GlobalProtect gateways.
Vulnerabilities
Palo Alto Cortex XSOAR OS Command Injection Flaw CVE-2026-0313
Authenticated admins can run remote OS commands via OS Query pack in Cortex XSOAR and XSIAM before version 1.0.17.
Vulnerabilities
.NET Uncontrolled Recursion Flaw CVE-2026-58280 Patches Available
Microsoft releases fixes for a high-severity denial of service bug in .NET runtimes across Windows, Linux and macOS platforms.
Vulnerabilities
.NET Pkcs Library Fixes CPU Exhaustion Bug Triggered by Malformed X.509 Data
Microsoft releases updates for System.Security.Cryptography.Pkcs to fix a quadratic CPU exhaustion bug triggered by malformed X.509 data.
Vulnerabilities
.NET Framework Deserialization Flaw CVE-2026-70035 in WPF Components
Microsoft releases patches for a high-severity remote code execution vulnerability in .NET Framework WPF components involving untrusted data deserialization.
Vulnerabilities
Microsoft RPC Runtime Library Critical OOB Write Vulnerability Enables Remote Code Execution
A critical vulnerability in the RPC Runtime Library permits unauthorised attackers to execute code over a network via an out-of-bounds write.
Vulnerabilities
Printcart Store Arbitrary File Upload Flaw Enables Unauthenticated RCE on WooCommerce
An arbitrary file upload flaw in the Printcart Store plugin allows attackers to execute remote code on affected WooCommerce sites without authentication.
Vulnerabilities
Windows Shell and .NET Framework: Microsoft Ships 1,413 Patches for 3 Zero-Days in October
Microsoft issued 1,413 patches in October, including fixes for three zero-day vulnerabilities affecting Windows Shell and .NET Framework components.
Vulnerabilities
Microsoft Failover Cluster Driver Double Free CVE-2026-96864 Enables Unauthenticated Remote Code Execution
A critical double free vulnerability in the Microsoft Failover Cluster Virtual Driver allows unauthenticated network attackers to execute arbitrary code.
Vulnerabilities
Adobe Commerce Template Injection Bug Grants Unauthenticated Remote Code Execution on Versions Through 2.4.9
A critical vulnerability in Adobe Commerce and Magento Open Source allows unauthenticated attackers to execute arbitrary code via template injection.
Vulnerabilities
SQL Injection in Fortinet and Metabase Enables Arbitrary File Operations
Security teams face high-severity SQL flaws in Fortinet appliances and Metabase analytics platforms that permit arbitrary file read and write actions.
Vulnerabilities
RClone Manager Local API Flaw Exposes Credentials to Browser Attacks
A critical vulnerability in RClone Manager allows malicious web pages to steal cloud storage credentials via an unauthenticated local service.
Vulnerabilities
GPT-SoVITS UVR5 Module Exposes Critical OS Command Injection Flaw
Unauthenticated users can execute server commands via manipulated output paths in the voice cloning tool’s vocal remover interface.
Vulnerabilities
NetEase Cloud Music Windows: Critical URL Injection Flaw CVE-2026-109422 Enables Local Binary Execution
A critical flaw in the Windows client allows attackers to execute local binaries by passing unvalidated URLs to the system shell.
Vulnerabilities
Quarkus Code Gen Flaw: Missing @MethodProperties Security Constraints Enable Unauthenticated Access
A critical flaw in Quarkus allows unauthenticated access when developers use @MethodProperties without re-declaring security constraints.
Vulnerabilities
Grav Login OAuth flaw exposes predictable credentials for unauthenticated access
Before version 1.4.3, the plugin sets unsalted MD5 passwords and deterministic usernames, enabling credential guessing attacks.
Vulnerabilities
Linksys E1700 Critical Remote Buffer Overflow in VLAN Function
A critical flaw in the Linksys E1700 allows remote attackers to exploit a stack-based buffer overflow, with public exploit code available.
Vulnerabilities
CVE-2026-93933: ThemeREX Rosalinda Theme Subject to High-Risk Deserialization Attack
The National Vulnerability Database lists a critical object injection flaw in Rosalinda versions up to 1.2.4, exposing sites to potential compromise.
Vulnerabilities
TOZED X300 Firmware Critical RCE Flaw CVE-2026-108576 Unpatched; Vendor Ignored Disclosure Attempts
Unpatched flaws in TOZED X300 firmware allow remote attackers to execute OS commands via the IPPingDiagnostics component.
Vulnerabilities
OpenSpug Remote Command Injection: Unpatched Critical CVE-2026-108540 Affects Versions 3.0-4.0.1 With No Vendor Fix
Attackers can execute arbitrary OS commands via OpenSpug’s file transfer endpoint, with no patch confirmed by the vendor for affected releases.
Vulnerabilities
miniOrange OTP Plugin Privilege Escalation Bug Hits WordPress Sites, CVSS 9.8
A CVSS 9.8 vulnerability in the miniOrange OTP verification plugin allows attackers to escalate privileges on affected WordPress sites.
Vulnerabilities
Apache Camel Karavan CVE-2026-103413 Applies Unvalidated Kubernetes Resources
A high-severity flaw in Apache Camel Karavan allows authenticated users to deploy arbitrary Kubernetes resources, including privileged pods, via unvalidated YAML files.