#Critical Vulnerability
All CosmicBytez Labs articles tagged #Critical Vulnerability, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-109432: Camunda 7 Expression Injection via orQueries Bypasses Ad-Hoc Query Restriction
Camunda 7.24/7.23 lets authenticated users bypass expression restrictions via orQueries sub-queries, enabling JUEL injection and RCE (CVSS 9.8).
- News
F5 Releases Out-of-Band Patches for Three Critical NGINX Vulnerabilities
F5 shipped emergency patches for 11 NGINX flaws, including three critical bugs (CVSS 9.2) that allow unauthenticated DoS or code execution.
- Security
CVE-2026-109894: Booktics WordPress Plugin Unauthenticated SQL Injection
Arraytics' Booktics plugin lets unauthenticated attackers inject SQL through unsanitized input, risking full database compromise.
- Security
CVE-2026-110372: OttoKit (SureTriggers) WordPress Plugin Unauthenticated Privilege Escalation
A critical incorrect-privilege-assignment flaw in Brainstorm Force's OttoKit lets unauthenticated attackers escalate privileges on WordPress sites.
- Security
CVE-2026-110886: QuantumCloud Conversational Forms for ChatBot PHP Object Injection
Insecure deserialization in the Conversational Forms for ChatBot plugin lets unauthenticated attackers inject PHP objects on WordPress sites.
- Security
CVE-2026-111998: Vanus Event Platform Hardcoded Admin Token Grants Cluster-Wide Takeover
A fixed Bearer token baked into Vanus's gateway gRPC proxy gives unauthenticated attackers full cluster-admin access.
- Security
CVE-2026-108983: GeoVision GV-ASManager Unauthenticated OS Command Injection
A critical OS command injection in GeoVision GV-ASManager's GeoWebServer.exe web server, exploitable over the network with no authentication.
- Security
CVE-2026-105279: dcm4chee-arc-light DICOM Archive Accepts Unauthenticated Peer Connections
dcm4chee-arc-light trusts any DICOM peer by default, letting attackers enumerate patients, pull images, and plant fabricated studies.
- Security
CVE-2026-95182: DeepSeek Harness (dsh) Untrusted Search Path Enables Arbitrary Code Execution
DeepSeek's experimental AI coding agent harness can be tricked into launching attacker-planted executables instead of legitimate tools.
- Security
CVE-2026-110957: Critical OS Command Injection in Wavlink WL-WN530BE2-A Routers
A maximum-severity CVSS 10.0 flaw lets unauthenticated attackers run OS commands on Wavlink WL-WN530BE2-A routers via the REMOTE_ADDR parameter.
- Security
CVE-2026-47168: Authenticated PHP Object Deserialization in EspoCRM
A critical CVSS 9.1 flaw lets authenticated EspoCRM admins trigger unsafe PHP deserialization via MassAction/Export params for RCE.
- Security
CVE-2026-108587: Unauthenticated Arbitrary File Upload in 10Web Booster Leads to RCE
A leaked REST nonce lets unauthenticated attackers upload executable files via 10Web Booster's compressCustom function, enabling full RCE.
- Security
CVE-2026-110911: Unauthenticated SQL Injection in Wheels CFML Framework
Wheels 1.1.8 through 4.1.1 lets attackers break out of dynamic finders and query-builder calls to inject arbitrary SQL. No auth required.
- Security
CVE-2026-104192: Dragonfly In-Memory Database Double-Free RCE
A CVSS 9.6 double-free in Dragonfly's RDB stream loader lets unauthenticated clients trigger memory corruption; auth is off by default.
- Security
CVE-2026-104800: Unauthenticated RCE in AGE-GATE WordPress Plugin
A critical 9.8 CVSS flaw lets unauthenticated attackers execute arbitrary code on WordPress sites via AGE-GATE's exposed admin.php endpoint.
- Security
CVE-2026-87855: JTL-Connector for WooCommerce Arbitrary File Upload
Unauthenticated arbitrary file upload in JTL-Connector for WooCommerce (≤ 2.4.3) via saveImage() enables webshell upload and RCE.
- Security
CVE-2026-97657: Abandoned Cart Pro for WooCommerce Authentication Bypass
Malleable AES-CTR encryption and a bypassable HMAC let attackers forge cart-recovery tokens and take over any WooCommerce account.
- Security
CVE-2026-97668: Abandoned Cart Pro for WooCommerce Unauthenticated SQL Injection
Unauthenticated SQL injection in Abandoned Cart Pro's guest-cart meta_value lets attackers read data and escalate to full admin takeover.
- Security
CVE-2026-109110: Wavlink WL-WN592AX6 Unauthenticated OS Command Injection
A critical, unauthenticated command injection in Wavlink WL-WN592AX6 routers lets remote attackers run arbitrary OS commands as root.
- Security
CVE-2026-108895: Linksys E1700 setDMZ OS Command Injection
A public exploit targets Linksys E1700 routers via the setDMZ goform handler, letting remote attackers inject OS commands through the MAC_addr parameter.
- Security
CVE-2026-108896: Linksys E1700 setLinksysIpv6 OS Command Injection
The Linksys E1700's IPv6 configuration handler injects the 6rd_prefix parameter into a shell command, letting remote attackers run arbitrary code.
- Security
CVE-2026-108576: Unauthenticated OS Command Injection in TOZED X300 Router (CVSS 10.0)
A maximum-severity flaw in TOZED X300 firmware ≤ 6.01.3 lets unauthenticated attackers inject OS commands via the IPPingDiagnostics Host field.
- Security
CVE-2026-104028: Unrestricted File Upload in Anton Extensions Risks Full Site Takeover
Anton Extensions ≤ 1.2.2 skips capability, nonce, and file-type checks, letting unauthenticated attackers upload PHP shells for RCE.
- Security
CVE-2026-103694: Mobile Builder Plugin Lets Any Registered User Become a WordPress Administrator
Mobile builder ≤ 1.4.2 fails to restrict which user meta keys a logged-in user can update via REST, enabling self-promotion to admin.
- Security
CVE-2026-103695: Unauthenticated SQL Injection in Mobile Builder's vendor_id Parameter
Mobile builder ≤ 1.4.2 fails to sanitize the vendor_id parameter, letting unauthenticated attackers run SQL injection attacks.
- Security
CVE-2026-108551: Code Injection in openapi-typescript-codegen Risks Supply Chain Compromise
A flaw in openapi-typescript-codegen lets malicious OpenAPI documents inject JavaScript into generated API clients, risking RCE.
- Security
CVE-2026-108540: Critical OS Command Injection in OpenSpug Spug's File Transfer Component
OpenSpug Spug through 4.0.1 lets attackers inject OS commands via /exec/transfer, with public PoC exploit code and CVSS 9.9.
- Security
CVE-2026-104398: Critical Object Injection in WooCommerce AFFI Affiliate Marketing Plugin
A deserialization flaw in VillaTheme's AFFI WooCommerce plugin allows unauthenticated PHP object injection, risking full site takeover.
- Security
CVE-2026-105110: Iskratel Innbox GPON ONT Unauthenticated OS Command Injection
Unauthenticated OS command injection in Iskratel Innbox GPON ONT's login.xgi endpoint lets remote attackers execute commands as root.
- Security
CVE-2026-107510: Infoblox NIOS Argument Injection Enables Privilege Escalation
Infoblox NIOS lets authenticated high-privilege users inject arguments into troubleshooting commands, escalating to full administrative control.
- Security
CVE-2026-107779: Dromara Skyeye Unauthenticated RCE via Bundled xxl-job-admin
Unauthenticated POSTs to Skyeye's bundled xxl-job-admin let attackers run arbitrary GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs for remote code execution.
- Security
CVE-2026-107780: Unauthenticated OS Command Injection in Dromara Skyeye TTS Endpoint
Unauthenticated OS command injection in Dromara Skyeye's TTS endpoint lets attackers break out of a PowerShell string via the format parameter for RCE.
- Security
CVE-2026-107908: Unauthenticated Heap Overflow in FalkorDB's Bolt Protocol
An unauthenticated attacker can corrupt heap memory in FalkorDB's experimental Bolt endpoint via a crafted RESET message, risking RCE.
- Security
CVE-2026-107909: Heap Out-of-Bounds Write in FalkorDB's WebSocket Bolt Transport
A crafted WebSocket frame with an oversized payload length corrupts heap memory in FalkorDB's Bolt endpoint, risking DoS and RCE.
- Security
CVE-2026-16823: Critical Authentication Bypass in IBM Verify Access and Identity Access
Critical CVSS 9.1 flaw (CVE-2026-16823) lets remote, unauthenticated attackers bypass security restrictions in IBM Verify Access/Identity Access.
- Security
CVE-2026-5759: FalkorDB Double-Free in RDB Decoder Enables Remote Code Execution
A crafted RDB replication stream triggers a double-free in FalkorDB's graph decoder, allowing DoS or RCE on unauthenticated instances.
- Security
CVE-2026-7826: FalkorDB Heap Out-of-Bounds Read in Buffer Serializer
A crafted replication stream exploits missing bounds checks in FalkorDB's buffer serializer, risking crashes and heap data disclosure.
- Security
CVE-2026-76268: Splunk Enterprise Patroni REST API Unauthenticated RCE
An unauthenticated network attacker can run OS commands via Splunk's Patroni REST API on search head cluster members. CVSS 9.8.
- Security
CVE-2025-70518, CVE-2025-70521, CVE-2025-70516: Fanvil X7A Firmware Unauthenticated Command Injection and Access Control Bypass
Three critical Fanvil X7A VoIP phone firmware flaws allow unauthenticated remote code execution and device data exposure.
- Security
CVE-2026-105812: AWS Bedrock AgentCore Starter Toolkit Code Injection Flaw
A critical flaw in AWS's Bedrock AgentCore Starter Toolkit lets an authenticated user inject arbitrary code via crafted agent-import configuration values.
- Security
CVE-2026-105793: Command Injection in Microsoft UFO's Mobile MCP Server via Unsanitized ADB Key Codes
A flaw in Microsoft UFO's mobile MCP server lets attackers inject arbitrary ADB shell commands on connected Android devices.
- Security
CVE-2026-54472: Hard-Coded Credentials in Dell CSM Docs Component Expose Sensitive Data
A hard-coded credential in Dell Container Storage Modules' csm-docs component lets unauthenticated attackers read sensitive data.
- Security
CVE-2026-61421: Hard-Coded JWT Signing Key in Dell CSM Authorization Enables Admin Token Forgery
A hard-coded JWT signing key in Dell CSM Authorization lets unauthenticated attackers forge admin tokens and seize control.
- Security
CVE-2026-63688: Missing Authentication in Dell CSM Authorization gRPC Server Exposes Storage Array Credentials
An unauthenticated gRPC server in Dell CSM Authorization lets attackers retrieve admin credentials for every registered storage array.
- Security
CVE-2026-63692: Dell CSM Authorization Proxy Missing Authentication Allows Cross-Tenant Admin Takeover
A missing authentication flaw in Dell CSM's authorization proxy lets unauthenticated attackers gain admin privileges across tenants.
- Security
CVE-2026-67269: Dell CSM Operator Flaw Lets Low-Privileged Users Escalate to Cluster Node Root
A Dell Container Storage Modules Operator flaw lets low-privileged Kubernetes users escalate to root via a crafted Custom Resource.
- Security
CVE-2026-105697: Langflow MCP Stdio RCE — Incomplete Fix Reopens Remote Code Execution
Langflow's 1.9.0 MCP Stdio RCE fix was incomplete — the same bash -c exec flaw stayed reachable until 1.10.3, which removed the shell entirely.
- Security
CVE-2026-105740: Langflow Authenticated RCE via MCP Stdio Transport
Authenticated Langflow users could run arbitrary OS commands by adding a malicious MCP Stdio server; the command hit bash -c exec unsanitized.
- Security
CVE-2026-79820: HPE Integrated Lights-Out 7 Remote User Validation Failure
Critical CVSS 9.0 authentication bypass in HPE iLO 7 firmware could let remote attackers gain full administrative control of affected BMCs.
- Security
CVE-2026-88391: Northstar H2 Console Exposed with Default Credentials Enables RCE
Northstar (dromara/northstar) exposes an unauthenticated H2 Console with default sa credentials, allowing network attackers to run SQL and achieve RCE.
- Security
CVE-2026-88395: GouGuOA SQL Injection in Keywords Parameter Enables Database Compromise
Critical SQL injection (CVSS 9.8) in GouGuOA ≤6.0.5 lets attackers compromise the OA database via the keywords parameter, no auth required.
- Security
CVE-2026-105209: ZITADEL Cross-Organization Account Takeover via Passkey Enrollment
ZITADEL checks only the caller's org header, not the target user's org, letting low-privileged admins enroll passkeys on other orgs' accounts.
- Security
CVE-2026-105215: ZITADEL Account Pre-Hijacking via Forged External IdP Callback
Unauthenticated attackers can forge IdP identity fields in ZITADEL's Login V1 UI to pre-hijack victim accounts before they ever log in.
- Security
CVE-2026-105207: ZITADEL Unauthenticated Account Takeover via Unverified IdP Linking
ZITADEL links accounts to external identity providers without verifying a primary factor, letting attackers sign in as any known user.
- Security
CVE-2026-105105: NASA AIT-Core ZeroMQ Broker Unauthenticated Command Injection
AIT-Core's ait-server ZeroMQ broker binds without authentication, letting a network attacker inject spacecraft commands and forge telemetry.
- Security
CVE-2026-90970: GitLab AI Gateway Prompt Template Sandbox Escape
A CVSS 9.9 flaw lets an authenticated Duo Agent Platform user escape the AI Gateway's prompt template sandbox and run commands on self-hosted servers.
- Security
CVE-2026-102268: PyJWT is_pem_format PEM Validation Bypass
A PEM-detection gap in PyJWT lets mutated public-key PEMs slip past its HMAC guard, enabling JWT signature forgery.
- Security
CVE-2026-101187: Ziroom ZHOME A0101 Command Injection via USB Device Management API
A high-privilege command injection flaw in Ziroom ZHOME A0101's USB Device Management API allows OS command execution via a crafted path argument.
- Security
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
CISA added CVE-2026-5430 to its KEV catalog after active exploitation of a critical, unauthenticated WSO2 API management flaw.
- Security
CVE-2026-55158: Conflibot Command Injection via Pull Request Branch Name
Conflibot before 1.2.1 interpolates attacker-controlled PR branch names into shell commands, enabling RCE with repo secrets and a write-scoped GitHub token.
- Security
CVE-2026-39919: Ghostscript JPEG 2000 Heap Buffer Overflow
Ghostscript before 10.08.0 has a critical heap overflow in its JPEG 2000 decoder, triggered by a crafted PDF; update to 10.08.0 now.
- Security
CVE-2026-90699: D-Link DWR-M920 OS Command Injection via PIN Manage Setup
D-Link DWR-M920 1.1.7 lets remote attackers inject OS commands through the formPinManageSetup handler; a public exploit is already available.
- Security
CVE-2026-90702: D-Link DWR-M921 OS Command Injection via Disk Format Handler
D-Link DWR-M921 1.1.52 lets remote attackers inject OS commands through the formDiskFormat handler; a public exploit is already available.
- Security
CVE-2026-90703: D-Link DWR-M921 OS Command Injection via Disk Share Handler
D-Link DWR-M921 1.1.52 lets remote attackers inject OS commands through the formDiskCreateShare handler; a public exploit is already available.
- Security
CVE-2026-85025: Langflow MCP Endpoint Flaw Enables Unauthenticated RCE
Langflow OSS 1.0.0-1.11.5 lets unauthenticated attackers run arbitrary code via public MCP project endpoints due to broken session isolation.
- Security
CVE-2026-85706: GitLab Path Traversal Flaw Hit CVSS 10.0, Added to CISA KEV
Unauthenticated attackers can read arbitrary files via GitLab's commits API. Exploited a day after disclosure; now in CISA's KEV catalog.
- Security
CVE-2026-89094: Forgejo Template Repository Flaw Enables Remote Code Execution
Forgejo before 16.0.4 mishandles template expansion, letting a malicious template repository achieve RCE on the Forgejo host. CVSS 9.9.
- Security
CVE-2026-36433: Actions Semiconductor Media Player Utilities RCE
A physically-proximate attacker can execute arbitrary code via Production.dll and RdiskUpgrade.exe in Actions Semiconductor's Media Player Utilities v4.46.
- Security
CVE-2026-71805: LZ-litchi Unauthenticated Arbitrary File Upload
LZ-litchi 1.0.0 lets unauthenticated attackers upload arbitrary files outside the storage directory via a path-traversal flaw in its upload API.
- Security
CVE-2026-79697: Advantech WISE-6610 Unauthenticated Command Injection
A CVSS 9.9 command injection flaw in Advantech WISE-6610 industrial gateways lets remote attackers run arbitrary OS commands; a public exploit exists.
- Security
CVE-2026-86148: Tenda CP3 OS Command Injection via AlarmVoiceURL
A critical unauthenticated OS command injection flaw in Tenda CP3 Wi-Fi cameras lets remote attackers run arbitrary commands via the AlarmVoiceURL parameter.
- Security
CVE-2026-86149: Tenda CP3 OS Command Injection via NetCheckPing
A second critical command injection flaw in Tenda CP3 cameras lets remote attackers execute OS commands through the ping utility's host/interface argument.
- Security
CVE-2026-16310: MemberDash WordPress Plugin Unauthenticated Account Takeover
MemberDash ≤ 1.8.5 has an IDOR letting unauthenticated attackers change any WordPress user's password via a crafted registration request.
- Security
CVE-2026-86152: Max-Severity Tenda CP3 Command Injection via AutoAddWifi
CVSS 10.0 flaw in Tenda CP3's Kylin AutoAddWifi thread lets remote attackers inject and execute arbitrary OS commands.
- Security
CVE-2026-86151: Tenda CP3 OS Command Injection via Network Config Handler
Tenda CP3 firmware 27.5.57.101 lets remote attackers inject OS commands through its network configuration handler, no authentication noted.
- Security
CVE-2026-86153: Tenda CP3 Improper Privilege Management in Redirect Service
Tenda CP3's SetRedirectEnable function lacks authorization checks, letting remote attackers alter port-forwarding without admin access.
- Security
CVE-2026-75925: IXON VPN Client CRLF Injection Enables Root/SYSTEM Command Execution
IXON VPN Client before v1.4.7 lets a local attacker inject CRLF sequences into a config file consumed by a privileged process, gaining root or SYSTEM.
- Security
CVE-2026-85061: MapLibre GL JS DOM Sanitizer Bypass Enables Stored XSS
A live-collection iteration bug in MapLibre GL JS's DOM.sanitize() lets attacker-supplied attribution strings smuggle an event handler past sanitization.
- Security
CVE-2026-85181: CAT Session Cookie Forgery Grants Admin Access
CAT relies solely on an unkeyed Java hashCode for session integrity, letting attackers forge admin cookies and bypass IP binding via X-Forwarded-For.
- Security
CVE-2026-85222: D-Link DNS-340L Command Injection Has No Fix Coming
An unauthenticated OS command injection in the DNS-340L's Add-On Center CGI grants root — and D-Link has declared the device end-of-life.
- Security
CVE-2026-82854: Nodemailer SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 lets attackers inject SMTP commands via unsanitized envelope.size, silently adding recipients to outbound mail.
- Security
CVE-2026-82855: @hulumi/policies Cross-Resource Evidence Validation Bypass
hulumi/policies before 1.3.2 let attackers suppress guardrail violations using compliant evidence from an unrelated resource in the same stack.
- Security
CVE-2026-82856: @hulumi/policies GitHub OIDC Trust Policy Bypass
hulumi/policies before 1.3.2 missed set-qualified IAM operators, letting wildcard GitHub Actions OIDC conditions slip past guardrails.
- Security
CVE-2026-82857: hulumi Privilege Escalation via Weekly Integration IAM Policy
hulumi before 1.3.2 let attackers create persistent higher-privilege af-e2e-* roles in the sandbox account via a flawed IAM boundary.
- Security
CVE-2026-37751: Critical Command Injection in AI Maestro
A CVSS 9.8 OS command injection in AI Maestro's session-kill function lets attackers run arbitrary commands on self-hosted orchestrator hosts.
- Security
CVE-2026-42007: Critical Use-After-Free in Dovecot's Sieve Editheader Extension
Dovecot's Sieve editheader extension has a critical use-after-free (CVSS 9.1) letting authenticated users corrupt memory during mail delivery.
- Security
CVE-2026-50152: Ceph Monitor Flaw Exposes Cluster SSH Keys and Disk Encryption Secrets
A low-privilege, read-only CephX role can read Ceph's entire config-key store, exposing cephadm SSH keys and OSD LUKS passphrases.
- Security
CVE-2026-40541: Cross-Site Scripting Flaw in Synology Chat Server Enables File Tampering
Synology Chat Server's unsanitized link-preview domain lets authenticated users read/write arbitrary DSM files and cause denial-of-service.
- Security
CVE-2026-82082: Critical Unauthenticated OS Command Injection in NUMail
Unauthenticated OS command injection in Green-Computing's NUMail lets remote attackers run arbitrary commands on the mail server. CVSS 9.8.
- Security
CVE-2026-59682: OpenRGB Arbitrary File Overwrite via SAVE_PROFILE
OpenRGB's network protocol lets remote attackers overwrite (and delete) arbitrary files through the SAVE_PROFILE message, up to v1.0rc3.
- Security
CVE-2026-77533: UniFi Protect Command Injection via Improper Input Validation
A critical flaw in UniFi Protect lets a low-privileged, network-adjacent attacker inject OS commands on the host device. Patch to 7.2.105+.
- Security
CVE-2026-80235: EFence Unauthenticated Arbitrary File Upload to RCE
EFence by Thinking Software Technology allows unauthenticated remote attackers to upload web shells and achieve full code execution.
- Security
CVE-2026-16286: Unauthenticated Web Shell Upload in TRtek Software Repository Management
Unrestricted file upload flaw lets attackers plant a web shell on TRtek's Software Repository Management with no authentication required.
- Security
CVE-2026-63586: Unauthenticated Root RCE in Weidmueller IE-SR-2TX-WL Industrial Routers
Critical OS command injection via the HTTP Basic Auth username lets unauthenticated attackers run root commands on Weidmueller security routers.
- Security
CVE-2026-7808: justhtml HTML Sanitization Bypass (Critical XSS)
Critical XSS in justhtml before 1.16.0. Multiple bypass paths let dangerous content survive sanitization, enabling script injection with no auth required.
- Security
CVE-2026-8445: justhtml Markdown Conversion XSS via Unescaped Angle Brackets
Critical XSS in justhtml <=1.11.0. The to_markdown() function leaves angle brackets unescaped, allowing raw HTML to reach downstream Markdown renderers.
- Security
CVE-2026-73570: Zimbra ZCS OS Command Injection via SMTP
Zimbra Collaboration Suite contains a critical unauthenticated OS command injection flaw allowing RCE as the Zimbra user via crafted SMTP requests.
- News
Adobe Patches Three CVSS 10.0 Flaws in ColdFusion and Campaign Classic
Adobe's August 2026 patch cycle fixes 3 maximum-severity RCE vulnerabilities across ColdFusion and Campaign Classic. Priority 1 — patch within 72 hours.
- Security
CVE-2026-47865: Critical Authentication Bypass in VMware Avi Load Balancer
A CVSS 9.8 authentication bypass vulnerability allows unauthenticated remote attackers to gain full access to the VMware Avi Load Balancer Control Plane....
- Security
CVE-2026-14890: SGLang ZeroMQ Unauthenticated RCE via Pickle Deserialization
A critical unauthenticated remote code execution vulnerability in the SGLang AI inference framework allows attackers to deliver malicious pickle payloads...
- Security
CVE-2026-45695: Kopia Backup Tool Exposes Unauthenticated HTTP API
A critical authentication bypass in Kopia, a cross-platform backup tool for Windows, macOS, and Linux, allows unauthenticated access to repository API...
- News
Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…
- Security
CVE-2026-46775 — Oracle REST Data Services Critical Compromise via HTTPS
A CVSS 9.9 critical vulnerability in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows a low-privileged network attacker to fully...
- News
Fortinet Warns of Critical RCE Flaws in FortiSandbox and FortiAuthenticator
Fortinet has released emergency security patches for two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to...
- Security
CVE-2026-42569: phpVMS Critical Unauthenticated Legacy
A critical vulnerability (CVSS 9.4) in phpVMS before version 7.0.6 allows unauthenticated attackers to access a legacy import feature, potentially...
- News
Cisco Patches Critical Webex Vulnerability Allowing Remote
Cisco has released emergency patches for a critical vulnerability in Webex that could allow unauthenticated remote code execution. Organizations urged to...