Vulnerabilities
Grav Login OAuth flaw exposes predictable credentials for unauthenticated access
Before version 1.4.3, the plugin sets unsalted MD5 passwords and deterministic usernames, enabling credential guessing attacks.
Vulnerabilities
Vulnerabilities
Linksys E1700 Critical Remote Buffer Overflow in VLAN Function
A critical flaw in the Linksys E1700 allows remote attackers to exploit a stack-based buffer overflow, with public exploit code available.
Vulnerabilities
CVE-2026-93933: ThemeREX Rosalinda Theme Subject to High-Risk Deserialization Attack
The National Vulnerability Database lists a critical object injection flaw in Rosalinda versions up to 1.2.4, exposing sites to potential compromise.
Vulnerabilities
TOZED X300 Firmware Critical RCE Flaw CVE-2026-108576 Unpatched; Vendor Ignored Disclosure Attempts
Unpatched flaws in TOZED X300 firmware allow remote attackers to execute OS commands via the IPPingDiagnostics component.
Vulnerabilities
OpenSpug Remote Command Injection: Unpatched Critical CVE-2026-108540 Affects Versions 3.0-4.0.1 With No Vendor Fix
Attackers can execute arbitrary OS commands via OpenSpug’s file transfer endpoint, with no patch confirmed by the vendor for affected releases.
Vulnerabilities
miniOrange OTP Plugin Privilege Escalation Bug Hits WordPress Sites, CVSS 9.8
A CVSS 9.8 vulnerability in the miniOrange OTP verification plugin allows attackers to escalate privileges on affected WordPress sites.
Vulnerabilities
CVE Numbering Authorities Explained: How Vulnerability IDs Are Assigned
The global system relies on local coordinators who assign IDs based on product scope, not severity, creating a fragmented but scalable identification network.
Vulnerabilities
Router Vulnerabilities: Response and Recovery Steps
Isolating the compromised device before rebooting prevents the attacker from wiping forensic evidence and re-establishing control over your network traffic.
Vulnerabilities
API Vulnerabilities Explained: How Hidden Doors Risk Your Data
Most API flaws stem from poor access controls rather than complex code errors, leaving user data exposed through misconfigured digital doors.
Vulnerabilities
Dependency Updates: Mechanism, Risk and Maintenance Strategy
Updating dependencies is not merely a repair task; it is a continuous negotiation between software stability and the shrinking window of exploitability.
Vulnerabilities
Emergency Patching: How to Fix Critical Flaws Without Breaking Production
Emergency patching bypasses standard change controls to neutralise active threats, trading procedural safety for immediate risk reduction.
Vulnerabilities
Risk-Based Vulnerability Management: Prioritise Exploitability Over CVSS Scores
Treating all vulnerabilities equally wastes resources; ranking by exploitability and asset value reveals which flaws actually endanger your organisation.
Vulnerabilities
Exposed Admin Panels: Why Hidden Doors Become Break-in Points
Default login pages often sit on standard ports, making them easy targets for automated scans that ignore your main website traffic entirely.
Vulnerabilities
Mitigations vs Workarounds: Why Your Security Strategy Is Failing
Most teams treat temporary workarounds as permanent fixes, creating hidden technical debt that outlives the original vulnerability and increases long-term risk.
Vulnerabilities
NoSQL Injection Warning Signs: Detecting Hidden Database Attacks
NoSQL injection bypasses traditional SQL filters, allowing attackers to extract data through logical operators that standard scanners often miss entirely.
Vulnerabilities
Apache Camel Karavan CVE-2026-103413 Applies Unvalidated Kubernetes Resources
A high-severity flaw in Apache Camel Karavan allows authenticated users to deploy arbitrary Kubernetes resources, including privileged pods, via unvalidated YAML files.
Vulnerabilities
PraisonAI Agents sandbox escape lets LLM code harvest env vars in v1.6.77
A critical vulnerability in PraisonAI Agents allows LLM-generated code to access all environment variables, bypassing intended sandbox protections.
Vulnerabilities
Nginx UI Middleware Gap in CVE-2026-107813 Skips 2FA for Node Management With Valid JWT
A missed middleware wrapper in Nginx UI allows attackers with valid JWTs to restart clusters and manage nodes without second-factor authentication.
Vulnerabilities
OSS Scanner auto-generates vulnerability reports for critical open-source software using AI
The company’s new opt-in service uses advanced models to generate security reports for critical software, marking a shift in automated vulnerability detection.
Vulnerabilities
IBM Security Verify Access Critical Auth Bypass Flaw CVE-2026-16823 Lacks Patch
IBM warns that improper authentication in Security Verify Access allows remote attackers to bypass security restrictions without a confirmed patch.
Vulnerabilities
NetScaler SAML Memory Overflow Flaw Triggers RCE or DoS on Identity Providers and Service Providers
A CVSS 9.5 vulnerability in NetScaler ADC and Gateway allows remote code execution or denial-of-service when SAML is configured, affecting multiple versions.
Vulnerabilities
IBM Guardium Path Traversal Flaw in v12.0-12.2 Lets Hackers Run Code With No Login
Unauthenticated attackers can exploit a path traversal flaw in IBM Guardium v12.0-12.2 to execute arbitrary code, posing severe risk.