Vulnerabilities
SGLang Sandbox Escape in Dumper Endpoint Enables Remote Code Execution
A critical code injection flaw in SGLang versions up to 0.5.22 allows unauthenticated attackers to execute arbitrary Python code via the scheduler process.
Firewall Chronicle Patch Watch Desk
Vulnerabilities
Apache Answer CVE-2026-86589: Session Persistence Bypasses Account Suspension
A flaw in Apache Answer allows suspended external user sessions to remain active, bypassing central account controls until timeout.
Vulnerabilities
DoubleScale CRM Plugin Permits Arbitrary File Uploads via Broken Validation
Authenticated users can upload executable files in DoubleScale CRM versions up to 1.5.1 due to a flawed extension check and missing capability restrictions.
Vulnerabilities
dio_http2_adapter CVE-2026-103030 leaks auth headers on cross-origin redirects
A high-severity flaw in dio_http2_adapter forwards sensitive credentials to third-party servers during redirects, exposing users to credential theft.
Vulnerabilities
Vert.x MSSQL Client CVE-2026-102462: Unauthenticated TDS Decoding Triggers OOM Crashes
A high-severity flaw in Vert.x allows remote SQL servers to trigger out-of-memory crashes by sending unlimited TDS packets before authentication.
Vulnerabilities
AWS Load Balancer Controller Priority Bug Lets HTTPRoutes Intercept gRPC Traffic Across Namespaces
A priority ordering bug in the AWS Load Balancer Controller allowed HTTPRoutes to intercept GRPCRoute traffic across Kubernetes namespaces.
Vulnerabilities
Drupal Field UI RCE CVE-2026-108097 Requires Contributed Modules for Access
Drupal patches a critical remote code execution flaw in the Field UI module. Exploitation requires specific contributed modules, but no-login paths exist.
Vulnerabilities
Next.js Image API and Cache Flaws Enable Unauthenticated Remote Code Execution
Vercel patches critical remote code execution bugs in Next.js image processing and caching components, urging immediate updates for all production deployments.
Vulnerabilities
Kanban Unauthenticated SSRF Flaw in v0.6.0 Exposes Cloud Metadata Due to Incomplete CVE Fix
An unauthenticated server-side request forgery flaw in Kanban versions up to 0.6.0 allows attackers to access internal services and cloud metadata when S3_ENDPOINT is unset.
Vulnerabilities
Hitachi Vantara Remote Ops Agent Pre-2.0 Exposes Admin Accounts to Brute-Force via Unrestricted Password Resets
A critical brute-force flaw in the password reset flow allows attackers to seize any account, including admin roles, in versions prior to 2.0.
Vulnerabilities
Microsoft SQL Server Heap Overflow Enables Remote Privilege Escalation
A high-severity flaw in SQL Server allows authorized users to elevate privileges via a heap-based buffer overflow, affecting multiple supported versions.
Vulnerabilities
FortiMail Webmail SQL Injection Vulnerability Allows Authenticated Code Execution
Fortinet reports a high-severity SQL injection flaw in FortiMail webmail that permits authenticated attackers to run unauthorized commands via crafted requests.
Vulnerabilities
Juniper Junos J-Web Authentication Bypass Grants Root Access to Networks
Unauthenticated attackers can seize control of Juniper devices via a critical flaw in the J-Web management interface and NETCONF session handling.
Vulnerabilities
Unauthenticated RCE in Juniper MX IKE via Stack Buffer Overflow
A stack-based buffer overflow in the kmd component allows remote attackers to execute code as root on affected Junos OS versions.
Vulnerabilities
Microsoft Patches .NET WPF Flaw Letting Attackers Execute Code Via Malicious XPS Hyperlinks on Windows
Microsoft patches a high-severity remote code execution flaw in .NET WPF that lets attackers bypass URI restrictions through crafted hyperlinks.
Vulnerabilities
CVE-2026-69634 Critical iSCSI Buffer Overflow in Windows
A heap-based buffer overflow in Windows iSCSI allows remote code execution by unauthorized attackers, rated CVSS 9.8 by the NVD.
Vulnerabilities
Xorbits Xoscar Critical RCE via Unauthenticated TCP Channel Deserialization in CVE-2026-49950
An unauthenticated flaw in Xorbits Xoscar allows attackers to run arbitrary code via crafted data on TCP channels before message validation occurs.
Vulnerabilities
ASP.NET Core Kestrel HTTP Request Smuggling Flaw CVE-2026-88092 Enables Network Tampering via Aborted Connections
Microsoft patches a critical HTTP request smuggling vulnerability in ASP.NET Core 8 through 11, enabling network tampering via aborted Kestrel connections.
Vulnerabilities
OTRS CE 6 Critical Header Injection Flaw Enables User Impersonation in CGI Environments
Unauthenticated attackers can impersonate users in OTRS Community Edition 6 by injecting crafted HTTP headers in CGI or mod_perl environments.
Vulnerabilities
GPT-SoVITS UVR5 Command Injection: Unauthenticated Shell Code in Output Fields Yields CVSS 9.3 RCE
Unauthenticated attackers can execute server commands in GPT-SoVITS by injecting shell code into UVR5 output folder fields, rated CVSS 9.3.
Vulnerabilities
D-Link DCS-930L Remote Code Execution Risk: Recovery Server Crypto Flaw Exposes Firmware to Tampering
A critical vulnerability in the D-Link DCS-930L recovery server allows improper signature verification via remote manipulation of firmware arguments.
Vulnerabilities
SonicWall SMA 1000 SSRF: Max-Severity Flaw Puts Customers in Unenviable Security Position
Dark Reading reports that threat actors are currently targeting a critical server-side request forgery vulnerability in SonicWall SMA 1000 security appliances.
Vulnerabilities
Privasys ra-tls-clients Identity Validation Flaw Enables Endpoint Impersonation in Pre-0.11.0 Builds
A critical flaw in Privasys remote attestation tools allowed verifiers to accept evidence from unauthorized platforms, risking endpoint impersonation.
Vulnerabilities
MarkLogic Authorization Bug Grants Full Control to Forest Managers on Versions Below 11.3.7 and 12.1.0
A critical authorization flaw in MarkLogic Server allows remote attackers with forest management rights to create persistent administrator accounts on affected versions.