The SecOps Monitor Vulnerability Desk is the part of the SecOps Monitor newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 40 articles so far. See the editorial policy or report an error.
Unauthenticated attackers can gain admin access via a flaw in WordPress User Profile Builder versions up to 4.0.3 if legacy role fields persist.
A use-after-free bug in X.Org Server allows local attackers to leak sensitive data, though a vendor patch is now available to close the gap.
Vercel released urgent patches for three vulnerabilities, including two critical remote code execution flaws, in Next.js versions 15 and 16.
SUSE Steve versions prior to specific releases lack certificate validation by default, creating a high-risk exposure for man-in-the-middle interception.
A path traversal issue in Eclipse Jetty HttpClient sends credentials to attacker-controlled endpoints on the same domain during redirects.
Vulnerability management strategies must shift from theoretical vendor scores to real-world exploit evidence specific to organizational environments.
CERT/CC warns that unauthenticated attackers can seize admin control of Bisheng LLM platforms via a legacy SSO bypass, while authenticated users face data exposure.
A stored cross-site scripting vulnerability in older Cronicle versions allows attackers to hijack administrator sessions and execute commands on managed servers.
A critical flaw in Wheels versions prior to 4.1.2 allows attackers to inject SQL code via dynamic finders, risking unauthorized data access.
Cisco warns of zero-day attacks on Secure Email Gateway appliances, urging immediate patching for systems with specific AMP configurations enabled.
Microsoft rates this Hyper-V use-after-free flaw as high severity. Authorized attackers can run code locally on affected Windows versions.
An uncaught exception in FortiSandbox allows privileged attackers to permanently block admin access via crafted HTTP requests.
An out-of-bounds write flaw in Windows DHCP Server allows remote code execution by unauthorized attackers over the network.
SAP released critical patches for S/4HANA and NetWeaver on October 13, addressing code injection and access control issues.
Microsoft confirms a heap-based buffer overflow in Windows Libarchive allows remote code execution, rated critical by NVD.
Microsoft confirms a critical remote code execution flaw in Outlook, rated 9.8 by NVD, allowing unauthorized network attacks via heap overflow.
A critical vulnerability in Microsoft Network Policy Server allows remote code execution via an integer underflow, requiring immediate attention from security teams.
A critical injection flaw in Omnispace Agora before version 26.10.0 allows attackers to execute arbitrary code without authentication via the installer.
A critical authorization flaw in Adobe ColdFusion enables low-privileged attackers to execute arbitrary code without any user interaction.
A critical use-after-free flaw in Windows Message Queuing allows remote code execution without authentication across multiple Windows 10 and 11 versions.
A critical heap-based buffer overflow in Windows Text Shaping allows unauthorized network attackers to execute arbitrary code on exposed systems.
Fortinet reports a broken authorization issue in FortiSIEM's web interface that permits authenticated attackers to execute unauthorized commands via HTTP requests.
A critical flaw in Docker Hub allowed attackers to impersonate users via personal access tokens. The vendor patched the issue rapidly and found no evidence of exploitation.
A critical flaw in Netherman Portal’s password recovery allows attackers to hijack accounts by exploiting distinct error messages and missing rate limits.