A critical vulnerability in Zulip Server allows attackers to hijack accounts if identity providers return unverified emails, exposing users to unauthorized access.
Unpatched Redash versions let users with query access read secrets or write files, risking full system compromise via DuckDB defaults.
A type confusion flaw in Microsoft RPC Runtime allows network-based remote code execution, rated 8.8 CVSS, affecting multiple Windows versions.
Attackers can run arbitrary code on Drupal sites via the Field UI module. Vendors urge immediate updates to stop unauthenticated exploitation.
An HTML injection flaw in Fortinet management interfaces allows cross-site scripting via the Identity Provider name field, requiring immediate upgrades for version 6.2 users.
FortiGuard confirms a hard-coded key flaw in FortiSandbox allows unauthenticated access to certain API endpoints via crafted HTTP requests.
Microsoft releases updates for CVE-2026-96231, a high-severity flaw in .NET runtimes that allows local attackers to gain elevated system privileges.
A critical gap in TR7 ASP allows attackers to run system commands without logging in, affecting versions below 1.0.1554.2331 and 1.6.1554.2331.
Microsoft releases fixes for a resource exhaustion flaw in ASP.NET Core SignalR that allows remote attackers to deny service.
Microsoft resolved three BitLocker issues in October 2026 updates, closing paths for open redirects, race conditions, and out-of-bounds reads that grant extra system rights.
Unauthenticated visitors can manipulate checkout fields to escalate accounts to administrator status in WooCommerce sites using plugin versions up to 10.8.0.
Microsoft patches a critical vulnerability in ASP.NET Core versions 8 through 11 that allows unauthorized network tampering via HTTP request smuggling.
Command injection occurs when untrusted input executes system commands, bypassing application logic to access files or control servers directly.
A severe stored cross-site scripting vulnerability in Adobe Commerce and Magento Open Source requires immediate attention to prevent session hijacking.
Most security fixes introduce new vulnerabilities because teams verify the patch but ignore the surrounding code paths that changed during the repair.
A critical heap overflow in Windows Text Shaping allows remote attackers to run code on affected devices without authentication.
Docker patched a critical flaw that let attackers use tokens they controlled to impersonate users and tamper with container images in the registry.
Output encoding stops most cross-site scripting attacks, while input validation alone leaves your application exposed to sophisticated injection techniques.
A high-severity flaw in Risesoft-y9 digital infrastructure allows attackers to write arbitrary files, potentially leading to remote code execution without authentication.
A critical flaw in Obsidian-TC versions before 1.3.1 allows attackers with valid tokens to access, modify, or delete data in any configured vault without proper authorization checks.
Large language models introduce prompt injection risks that traditional web security controls cannot detect or block effectively.
Disabling deserialization entirely eliminates the threat, while input validation alone fails because attackers bypass filters using encoded payloads that look harmless to basic checks.
Firmware flaws bypass operating system security controls and allow attackers to maintain persistent access even after a complete system reinstallation or hardware replacement.
Booz Allen reports frontier AI models achieved all eight attack goals in an isolated industrial control testbed, including moving a robotic arm.