Microsoft rates this Excel flaw as high severity, allowing network-based code execution in older Office versions before a specific security release.
Read more
A medium-severity buffer overflow in Panorama’s log handling can trigger maintenance mode. Only management-only appliances with collector groups are at risk.
Read more
Palo Alto Networks rates CVE-2026-0320 as medium severity. Authenticated administrators can bypass restrictions to execute arbitrary commands as root on affected firewalls.
Read more
Attackers can execute arbitrary shell commands in Stills versions before 25.24.2 by naming media files with special characters that trigger command execution.
Read more
Microsoft addresses a high-severity algorithmic complexity flaw in System.Security.Cryptography.Xml that allows remote denial of service attacks.
Read more
Microsoft patches a high-severity flaw in .NET Framework and WPF runtimes that allows attackers to execute code via crafted pixel-shader bytecode on Windows systems.
Read more
A critical XML external entity flaw in Adobe Experience Manager allows low-privileged attackers to escalate access without user interaction.
Read more
Mismatched parsers between proxies and backends allow attackers to inject hidden requests that bypass security controls and access other users' data without detection.
Read more
A critical flaw in Adobe ColdFusion allows low-privileged attackers to bypass authorization controls and gain write access without any user interaction.
Read more
Rushing patches without testing causes more downtime than leaving systems exposed to known exploits, creating a false sense of security.
Read more
Server-side request forgery lets attackers trick your server into accessing internal resources or external services without your permission.
Read more
Many developers believe modern frameworks prevent SQL injection, yet raw string concatenation in dynamic queries remains a persistent and easily overlooked vulnerability in enterprise applications.
Read more
A revised advisory details a low-severity double free bug in Fortinet devices that lets authenticated users crash the CLI daemon.
Read more
A hardcoded secret in IBM MCP Context Forge versions before 1.0.2 enables remote attackers to forge administrative tokens, granting full platform control without valid credentials.
Read more
PHP object injection turns harmless data into executable code by tricking the server into reconstructing objects with malicious properties.
Read more
Researchers found that abandoned GitHub repository names allowed attackers to hijack publishing rights for over 1,500 npm packages, a flaw now patched.
Read more
Broadcom introduces a new tool to help organizations handle the surge of monthly patches driven by AI vulnerability discovery.
Read more
The controversial surveillance vendor gained authority to assign vulnerability IDs to its own cameras and license plate readers, sparking trust concerns.
Read more
A critical remote code execution vulnerability in NetEase Cloud Music for Windows allows attackers to run arbitrary code via manipulated URLs.
Read more
A critical flaw in Quarkus allows attackers to bypass endpoint security controls when developers use specific annotations without re-declaring roles.
Read more
A race condition in Discourse’s image processing allows low-privilege users to read and write server files, requiring immediate attention for self-hosted deployments.
Read more
Threat modeling maps attack paths before code exists, while risk assessment calculates the financial impact of known vulnerabilities after deployment.
Read more
Threat actors are exploiting two unpatched flaws in Ahsay Cloud Backup Server to gain SYSTEM-level control without credentials, deploying miners and web shells.
Read more
PortSwigger researchers demonstrate how overlapping CSS fragments bypass token limits to exfiltrate data via CSS injection attacks, a significant risk for web applications.
Read more