Microsoft patches a high-severity remote code execution flaw in .NET WPF that lets attackers bypass URI restrictions through crafted hyperlinks.
A heap-based buffer overflow in Windows iSCSI allows remote code execution by unauthorized attackers, rated CVSS 9.8 by the NVD.
An unauthenticated flaw in Xorbits Xoscar allows attackers to run arbitrary code via crafted data on TCP channels before message validation occurs.
Microsoft patches a critical HTTP request smuggling vulnerability in ASP.NET Core 8 through 11, enabling network tampering via aborted Kestrel connections.
DLL hijacking exploits the predictable order in which Windows searches for libraries, allowing malicious code to run before legitimate components load.
Modern browsers block many CSRF vectors by default, yet state-changing requests without proper anti-forgery tokens remain exploitable through legacy protocols or same-site bypasses.
Updating libraries rarely fixes security flaws; it often introduces new surface area and breaks existing logic if you do not verify the change.
Default software settings prioritize ease of use over security, leaving hidden endpoints and verbose error messages exposed to attackers who scan for these common oversights.
Insecure direct object references expose data when applications trust user-supplied identifiers without verifying ownership or access rights.
Misconfigured application delivery controllers often expose internal services directly to the internet, bypassing firewall rules that assume traffic is already authenticated.
Unauthenticated attackers can impersonate users in OTRS Community Edition 6 by injecting crafted HTTP headers in CGI or mod_perl environments.
Small teams reduce breach risk by combining automated scanning with targeted manual reviews, avoiding the high cost of full-scale enterprise assessments.
Unauthenticated attackers can execute server commands in GPT-SoVITS by injecting shell code into UVR5 output folder fields, rated CVSS 9.3.
A critical vulnerability in the D-Link DCS-930L recovery server allows improper signature verification via remote manipulation of firmware arguments.
Dark Reading reports that threat actors are currently targeting a critical server-side request forgery vulnerability in SonicWall SMA 1000 security appliances.
A critical flaw in Privasys remote attestation tools allowed verifiers to accept evidence from unauthorized platforms, risking endpoint impersonation.
A critical authorization flaw in MarkLogic Server allows remote attackers with forest management rights to create persistent administrator accounts on affected versions.
Firmware 1.0.0.4.003 allows remote attackers to inject OS commands through IPv6 settings. No vendor patch exists for this critical flaw.
New survey data indicates a majority of software developers require clear source attribution for AI training, highlighting tension between adoption and transparency.
Help Net Security reports that the FortiBleed vulnerability remains active while hospital CISOs evaluate fintech vendor security practices for patient data and funds.
A critical blind SQL injection flaw in Tickera versions up to 3.6.0.6 allows attackers to extract database information without immediate visual confirmation.
A critical deserialization flaw in ThemeREX Let's Play versions through 1.1.15 enables object injection attacks, posing severe risks to affected installations.
A critical CVE-2026-108576 allows remote attackers to execute arbitrary commands in TOZED X300 devices running firmware versions up to 6.01.3.
IBM and Red Hat invite developers to submit Java libraries to a new service that identifies and helps fix undiscovered security vulnerabilities.