Vulnerabilities
Databasus API Flaw Allows Unrestricted Brute-Force of Password Reset Codes
A critical flaw in Databasus versions up to 3.61.0 allows attackers to guess six-digit reset codes without rate limits, risking full account takeover.
Vulnerabilities
Vulnerabilities coverage from Packet Tribune holds 45 articles, 15 of them reference guides. The newest was published on October 15, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include OWASP Top Ten and FIRST: Common Vulnerability Scoring System.
Vulnerabilities
Visual Studio Code Output Encoding Error Triggers RCE Threat in Versions Below 1.141.1
Unpatched Visual Studio Code installations risk remote code execution due to improper output encoding, rated high severity by NVD.
Vulnerabilities
Palo Alto GlobalProtect input handling bug CVE-2026-0319 enables identity impersonation, patches released for PAN-OS
Palo Alto Networks fixes a medium-severity input handling bug allowing authenticated users to assume other identities in GlobalProtect gateways.
Vulnerabilities
Palo Alto Cortex XSOAR OS Command Injection Flaw CVE-2026-0313
Authenticated admins can run remote OS commands via OS Query pack in Cortex XSOAR and XSIAM before version 1.0.17.
Vulnerabilities
.NET Uncontrolled Recursion Flaw CVE-2026-58280 Patches Available
Microsoft releases fixes for a high-severity denial of service bug in .NET runtimes across Windows, Linux and macOS platforms.
Vulnerabilities
.NET Pkcs Library Fixes CPU Exhaustion Bug Triggered by Malformed X.509 Data
Microsoft releases updates for System.Security.Cryptography.Pkcs to fix a quadratic CPU exhaustion bug triggered by malformed X.509 data.
Vulnerabilities
EPSS Score Mechanics: How Probability Drives Patch Prioritisation
The Exploit Prediction Scoring System predicts the likelihood of real-world exploitation, allowing teams to ignore high-CVE scores that rarely face active attacks.
Vulnerabilities
.NET Framework Deserialization Flaw CVE-2026-70035 in WPF Components
Microsoft releases patches for a high-severity remote code execution vulnerability in .NET Framework WPF components involving untrusted data deserialization.
Vulnerabilities
Microsoft RPC Runtime Library Critical OOB Write Vulnerability Enables Remote Code Execution
A critical vulnerability in the RPC Runtime Library permits unauthorised attackers to execute code over a network via an out-of-bounds write.
Vulnerabilities
Printcart Store Arbitrary File Upload Flaw Enables Unauthenticated RCE on WooCommerce
An arbitrary file upload flaw in the Printcart Store plugin allows attackers to execute remote code on affected WooCommerce sites without authentication.
Vulnerabilities
Detect Business Logic Flaws: Log Signals and Blind Spots
Automated scanners miss logic errors because they validate syntax rather than intent, requiring manual workflow mapping to expose gaps in state transitions and permission checks.
Vulnerabilities
Windows Shell and .NET Framework: Microsoft Ships 1,413 Patches for 3 Zero-Days in October
Microsoft issued 1,413 patches in October, including fixes for three zero-day vulnerabilities affecting Windows Shell and .NET Framework components.
Vulnerabilities
HTTP Security Headers Explained: The Digital Envelope Metaphor
HTTP security headers instruct browsers on how to handle incoming data, preventing attackers from tricking users into executing malicious code or stealing session tokens.
Vulnerabilities
Microsoft Failover Cluster Driver Double Free CVE-2026-96864 Enables Unauthenticated Remote Code Execution
A critical double free vulnerability in the Microsoft Failover Cluster Virtual Driver allows unauthenticated network attackers to execute arbitrary code.
Vulnerabilities
Cross-Site Request Forgery Prevention Checklist for Secure Web Apps
Modern frameworks often ignore CSRF because they assume anti-forgery tokens are automatic, leaving state-changing endpoints vulnerable to silent exploitation.
Vulnerabilities
What is security debt: the hidden costs of delayed fixes
Unresolved security shortcuts compound over time, creating a technical burden that eventually outweighs the initial speed gained by deferring proper controls.
Vulnerabilities
Adobe Commerce Template Injection Bug Grants Unauthenticated Remote Code Execution on Versions Through 2.4.9
A critical vulnerability in Adobe Commerce and Magento Open Source allows unauthenticated attackers to execute arbitrary code via template injection.
Vulnerabilities
SQL Injection in Fortinet and Metabase Enables Arbitrary File Operations
Security teams face high-severity SQL flaws in Fortinet appliances and Metabase analytics platforms that permit arbitrary file read and write actions.
Vulnerabilities
RClone Manager Local API Flaw Exposes Credentials to Browser Attacks
A critical vulnerability in RClone Manager allows malicious web pages to steal cloud storage credentials via an unauthenticated local service.
Vulnerabilities
WordPress Plugin Update Policies: 8 Practices for Secure Maintenance
Automated updates often break business logic, so you must isolate plugin changes in staging environments to prevent silent data corruption during security patches.
Vulnerabilities
GPT-SoVITS UVR5 Module Exposes Critical OS Command Injection Flaw
Unauthenticated users can execute server commands via manipulated output paths in the voice cloning tool’s vocal remover interface.
Vulnerabilities
NetEase Cloud Music Windows: Critical URL Injection Flaw CVE-2026-109422 Enables Local Binary Execution
A critical flaw in the Windows client allows attackers to execute local binaries by passing unvalidated URLs to the system shell.
Vulnerabilities
Quarkus Code Gen Flaw: Missing @MethodProperties Security Constraints Enable Unauthenticated Access
A critical flaw in Quarkus allows unauthenticated access when developers use @MethodProperties without re-declaring security constraints.
Vulnerabilities
Grav Login OAuth flaw exposes predictable credentials for unauthenticated access
Before version 1.4.3, the plugin sets unsalted MD5 passwords and deterministic usernames, enabling credential guessing attacks.