A critical remote command injection flaw in Edimax BR-6208AC firmware 1.32 allows attackers to execute commands through the automatic update interface.
A critical flaw in Neo4j GraphQL versions prior to 7.6.4 allows unauthenticated users to execute Cypher queries, bypassing intended security controls.
A critical flaw in SWUpdate allows attackers to bypass certificate checks by embedding untrusted intermediates in CMS signatures, enabling unauthorized firmware installation.
Unauthenticated attackers can forge bearer tokens in BotSharp 5.2.0 using a hardcoded secret to impersonate administrators and access protected API routes.
A critical object injection flaw in Travesia versions up to 1.1.16 allows untrusted data deserialization, posing severe risks to site security.
Citrix urges immediate patching for a 9.5 severity flaw in NetScaler ADC and Gateway appliances that allows remote code execution.
A critical CVE-2026-105889 flaw in Tickera Event Ticketing System versions up to 3.6.0.6 allows blind SQL injection attacks.
A critical flaw in Privasys Enclave OS Mini allows attackers to relay valid SGX quotes, bypassing attestation checks in versions prior to wasm-v0.40.0.
A critical flaw in the Advanced IP Blocker plugin allows attackers to bypass two-factor authentication and seize full WordPress admin access without a password.
The NVD rates this deserialization flaw as critical with a 9.8 score, impacting ThemeREX Smash versions up to 1.12.0 through object injection.
A critical flaw in the x64dbg-MCP Server plugin allows unauthenticated remote attackers to execute arbitrary commands and access memory before version 1.1.
JetBrains Exposed versions prior to 1.5.1 contain a critical SQL injection flaw. Admins must upgrade to mitigate remote code execution risks immediately.
A critical flaw in PHPNuxBill allows unauthenticated attackers to guess password reset codes without limits, risking full account takeover for customers.
CISA mandates federal patching of a high-severity ISC BIND denial-of-service vulnerability by October 11, 2026.
The ppt2png npm package versions up to 0.0.6 contain a critical OS command injection flaw allowing attackers to run arbitrary system commands via unsanitized input.
Google releases Chrome 155 for desktop, fixing 24 security issues including four critical memory safety bugs.