Mage OSS through version 0.9.80 allows session initialization with unverified OAuth providers, creating a high-risk authentication bypass vector.
Read more
A high-severity flaw in FreeBSD allows local attackers to gain root access via a use-after-free error in file descriptor handling.
Read more
An unauthenticated remote vulnerability in gocsaf csaf_provider allows attackers to cause high CPU load and denial of service via resource exhaustion.
Read more
A critical flaw in self-hosted appliances enables unauthenticated attackers to gain root control and access stored credentials, prompting urgent patching.
Read more
A flaw in Nginx-UI allows authenticated users to bypass security controls by splitting directives on single lines, leading to potential code execution.
Read more
A heap-based buffer overflow in X.Org Server’s XFixes module lets local attackers escalate to root, with a vendor patch now available.
Read more
Pre-authenticated users bypass scope checks in Vert.x Web, enabling access to protected resources without required permissions in supported versions.
Read more
A high-severity flaw in Nodemailer allows malicious SMTP servers to freeze applications through regex backtracking, requiring an upgrade to version 10.0.13.
Read more
A quadratic complexity flaw in Nodemailer allows attackers to exhaust memory and block event loops during SMTP authentication.
Read more
Unpatched Znuny instances are vulnerable to SQL injection via the ContentSearch parameter, risking unauthorized access to ticket data.
Read more
Unbounded memory growth in Vert.x MQTT clients occurs when brokers withhold PUBREL packets, allowing attackers to consume all available system memory.
Read more
A high-severity flaw in Ansible Operator Plugins allows low-privileged users to execute code and escalate privileges within Red Hat Kubernetes stacks.
Read more
An authenticated user can execute arbitrary PHP code in OpenCATS versions prior to 0.10.0 by uploading a file that retains its original name.
Read more
Microsoft rates this Excel flaw as high severity, allowing network-based code execution in older Office versions before a specific security release.
Read more
A medium-severity buffer overflow in Panorama’s log handling can trigger maintenance mode. Only management-only appliances with collector groups are at risk.
Read more
Palo Alto Networks rates CVE-2026-0320 as medium severity. Authenticated administrators can bypass restrictions to execute arbitrary commands as root on affected firewalls.
Read more
Attackers can execute arbitrary shell commands in Stills versions before 25.24.2 by naming media files with special characters that trigger command execution.
Read more
Microsoft addresses a high-severity algorithmic complexity flaw in System.Security.Cryptography.Xml that allows remote denial of service attacks.
Read more
Microsoft patches a high-severity flaw in .NET Framework and WPF runtimes that allows attackers to execute code via crafted pixel-shader bytecode on Windows systems.
Read more
A critical XML external entity flaw in Adobe Experience Manager allows low-privileged attackers to escalate access without user interaction.
Read more
A critical flaw in Adobe ColdFusion allows low-privileged attackers to bypass authorization controls and gain write access without any user interaction.
Read more
A revised advisory details a low-severity double free bug in Fortinet devices that lets authenticated users crash the CLI daemon.
Read more
A hardcoded secret in IBM MCP Context Forge versions before 1.0.2 enables remote attackers to forge administrative tokens, granting full platform control without valid credentials.
Read more
Researchers found that abandoned GitHub repository names allowed attackers to hijack publishing rights for over 1,500 npm packages, a flaw now patched.
Read more