The TechSec Feed Vulnerability Desk is the part of the TechSec Feed newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 19 articles so far. See the editorial policy or report an error.
A critical vulnerability in e107 CMS versions prior to 2.3.7 allows attackers to execute arbitrary code via the install.php script, risking full server compromise.
An out-of-bounds write in DateTime parsing can crash .NET Core apps across Windows, Linux and macOS. Microsoft has issued fixes for versions 8 through 11.
Microsoft has updated .NET runtimes to fix a high-severity remote code execution flaw in System.Net.Sockets affecting Windows applications using specific versions.
A critical vulnerability in Windows OLE allows remote code execution via untrusted pointer dereference, posing immediate risk to networked systems.
A severe authorization flaw in Adobe Experience Manager allows attackers to run code without user interaction, affecting specific 6.5 versions.
A critical authorization flaw in Adobe ColdFusion allows low-privileged attackers to bypass security controls and write data without any user interaction.
IBM released version 1.0.2 to address a critical flaw that lets attackers forge admin tokens without credentials in older builds.
A critical vulnerability in Wazuh allows compromised cluster workers to overwrite configuration files, granting attackers root access across the entire security infrastructure.
A critical authorization error in MarkLogic Server allows remote attackers with forest-management rights to spawn persistent admin accounts.
Self-managed GitLab administrators must upgrade to 19.4.2, 19.3.4 or 19.2.8 to address a remote code execution vulnerability and multiple authorization bypasses.
A critical vulnerability in Agnaistic Agnai allows unauthenticated attackers to assume full administrative control using exposed credentials in deployment files.
Citrix warns administrators to immediately patch NetScaler ADC and Gateway appliances due to a new critical remote code execution vulnerability.
A critical deserialization flaw in the Greeny WordPress theme allows object injection, impacting all versions up to 2.10.0 with a high severity score.
Threat actors are leveraging two unpatched AhsayCBS flaws to bypass authentication, deploy web shells, and install cryptocurrency miners disguised as Microsoft Edge.
The PPOM WooCommerce plugin contains a path traversal bug that allows attackers to delete server files and read sensitive data without logging in.
The National Vulnerability Database rates CVE-2026-93927 as critical, affecting Axiomthemes Veto versions up to 1.6.0 through untrusted data deserialization.
A critical vulnerability in Astron Agent versions prior to 1.1.2 allowed authenticated low-privilege users to execute code as root, compromising tenant isolation and shared services.
A critical flaw in Blocksy Companion versions up to 2.1.58 lets attackers bypass nonce checks and seize seller roles on WordPress sites.
Unauthenticated attackers can execute arbitrary SQL on Sybase backends, achieving remote code execution as LocalSystem through exposed admin endpoints.