Vulnerabilities
Linksys E1700 IPv6 Command Injection in 1.0.0.4.003 Firmware Lacks Vendor Patch
Firmware 1.0.0.4.003 allows remote attackers to inject OS commands through IPv6 settings. No vendor patch exists for this critical flaw.
Firewall Chronicle Patch Watch Desk
Vulnerabilities
Stack Overflow Devs Demand AI Source Attribution Despite Using Tools
New survey data indicates a majority of software developers require clear source attribution for AI training, highlighting tension between adoption and transparency.
Vulnerabilities
FortiBleed Activity Continues as Healthcare Fintech Security Protocols Face Scrutiny
Help Net Security reports that the FortiBleed vulnerability remains active while hospital CISOs evaluate fintech vendor security practices for patient data and funds.
Vulnerabilities
Tickera Blind SQL Injection CVE-2026-105889 Threatens Versions Through 3.6.0.6 With Database Exposure
A critical blind SQL injection flaw in Tickera versions up to 3.6.0.6 allows attackers to extract database information without immediate visual confirmation.
Vulnerabilities
ThemeREX Let's Play CWE-502 Deserialization Bug CVE-2026-93935 Critical to v1.1.15
A critical deserialization flaw in ThemeREX Let's Play versions through 1.1.15 enables object injection attacks, posing severe risks to affected installations.
Vulnerabilities
TOZED X300 Firmware Has Critical Remote OS Command Injection Flaw
A critical CVE-2026-108576 allows remote attackers to execute arbitrary commands in TOZED X300 devices running firmware versions up to 6.01.3.
Vulnerabilities
Lightwell Clearinghouse Launches to Scan Java Dependencies for Hidden Flaws
IBM and Red Hat invite developers to submit Java libraries to a new service that identifies and helps fix undiscovered security vulnerabilities.
Vulnerabilities
Sergey AIWU CWE-266 Vulnerability: Subscribers Gain Privileges in Versions Up to 1.5.9
A CVSS 9.8 flaw in Sergey AIWU allows subscribers to escalate privileges, affecting all versions up to 1.5.9.
Vulnerabilities
SoftBank Founder Masayoshi Son In UAE Talks For $100B AI Upgrade Fund
SoftBank founder Masayoshi Son is negotiating with UAE officials to raise a massive fund aimed at buying and upgrading companies using artificial intelligence.
Vulnerabilities
Anthropic Automates AI Vulnerability Reports for Open Source Maintainers
Anthropic’s new scanner sends unreviewed AI-generated bug reports directly to opt-in open source maintainers, aiming to speed up patch cycles.
Vulnerabilities
Wizarr Server Critical RCE Vulnerability Lets Authenticated Users Execute Code in Pre-2026.9.1 Versions
A critical vulnerability in Wizarr Server allows authenticated users to execute arbitrary code and steal secrets before version 2026.9.1.
Vulnerabilities
Advanced IP Blocker Zero-Day Lets Attackers Steal Session Cookies to Bypass 2FA
A critical flaw in the Advanced IP Blocker WordPress plugin lets attackers bypass two-factor authentication and seize full site control without passwords.
Vulnerabilities
Avada Builder Hook Injection Flaw Lets Attackers Wipe Site Content Without Login
Unauthenticated attackers can trigger arbitrary WordPress hooks in Avada Builder versions up to 7.16.1, causing irreversible site damage.
Vulnerabilities
Dromara Skyeye RCE: Unauthenticated Attackers Exploit Job Endpoints in Critical 9.3 Flaw
A critical vulnerability in Dromara Skyeye allows unauthenticated attackers to execute arbitrary code on executor hosts via exposed job scheduling endpoints.
Vulnerabilities
gvproxy Auth Bypass Flaw Deletes Host Files on RHEL 10, Podman Desktop and Edge Manager
A critical flaw in the gvproxy network forwarder allows attackers to delete arbitrary host files via an unvalidated endpoint without authentication.
Vulnerabilities
Microsoft Partner Center Certificate Validation Bug Lets Network Attackers Elevate Privileges
A critical certificate validation error in Microsoft Partner Center allows network-based attackers to elevate privileges without proper authorization.