Vulnerabilities
miniOrange OTP Plugin Privilege Escalation Bug Hits WordPress Sites, CVSS 9.8
A CVSS 9.8 vulnerability in the miniOrange OTP verification plugin allows attackers to escalate privileges on affected WordPress sites.
Packet Tribune CVE Desk
Vulnerabilities
Apache Camel Karavan CVE-2026-103413 Applies Unvalidated Kubernetes Resources
A high-severity flaw in Apache Camel Karavan allows authenticated users to deploy arbitrary Kubernetes resources, including privileged pods, via unvalidated YAML files.
Vulnerabilities
PraisonAI Agents sandbox escape lets LLM code harvest env vars in v1.6.77
A critical vulnerability in PraisonAI Agents allows LLM-generated code to access all environment variables, bypassing intended sandbox protections.
Vulnerabilities
Nginx UI Middleware Gap in CVE-2026-107813 Skips 2FA for Node Management With Valid JWT
A missed middleware wrapper in Nginx UI allows attackers with valid JWTs to restart clusters and manage nodes without second-factor authentication.
Vulnerabilities
OSS Scanner auto-generates vulnerability reports for critical open-source software using AI
The company’s new opt-in service uses advanced models to generate security reports for critical software, marking a shift in automated vulnerability detection.
Vulnerabilities
IBM Security Verify Access Critical Auth Bypass Flaw CVE-2026-16823 Lacks Patch
IBM warns that improper authentication in Security Verify Access allows remote attackers to bypass security restrictions without a confirmed patch.
Vulnerabilities
NetScaler SAML Memory Overflow Flaw Triggers RCE or DoS on Identity Providers and Service Providers
A CVSS 9.5 vulnerability in NetScaler ADC and Gateway allows remote code execution or denial-of-service when SAML is configured, affecting multiple versions.
Vulnerabilities
IBM Guardium Path Traversal Flaw in v12.0-12.2 Lets Hackers Run Code With No Login
Unauthenticated attackers can exploit a path traversal flaw in IBM Guardium v12.0-12.2 to execute arbitrary code, posing severe risk.