The RedTeam Tribune Vulnerability Desk is the part of the RedTeam Tribune newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 64 articles so far. See the editorial policy or report an error.
Unauthenticated attackers can drain file descriptors in aiohttp servers via crafted requests, a high-severity flaw patched in version 3.14.4.
Attackers can seize administrative control of Eclipse ioFog instances by sending custom tokens over WebSocket connections, bypassing authentication checks entirely.
A critical flaw in Argo CD allows attackers to read sensitive files and crash servers via JSONnet evaluation, affecting versions up to 3.6.0-rc2.
Attackers with read-only access to applications can execute commands on Argo CD repo servers by injecting git options through Kustomize files.
PHP teams prepare for critical updates addressing two unconfirmed RCE vulnerabilities with a 9.2 CVSS score, targeting supported branches only.
Authenticated users can manipulate any public share in OpenStack Manila, enabling data theft and access rule changes without owner permission.
Attackers can trigger remote code execution or file deletion on WordPress sites using Duplicator versions prior to the latest release, requiring no authentication.
Two high-severity vulnerabilities in PHP, both rated 9.2, will be patched in an update scheduled for October 21, 2026, affecting all dependent applications.
Attackers with valid credentials can install arbitrary firmware on this router by exploiting a missing signature check in the update process.
Leaked details of two critical PHP vulnerabilities lead maintainers to schedule emergency patches for October 21.
A critical bug in Apache Tomcat allows HTTP/2 asynchronous requests to mix, potentially leaking data between users until patches are applied.
Before version 2.3.15, Froxlor contains a critical symlink flaw allowing customers to seize control of host directories via cron jobs.
Attackers abused a signed Siemens installer to load malicious code via CVE-2026-110936, achieving high-privilege execution on victim systems.
A high-severity vulnerability in aiohttp allows attackers to exhaust server capacity by holding idle connections open indefinitely before sending data.
A flaw in DB-GPT 0.8.2 allows attackers to run code as root without login, exposing containers and databases to full compromise.
AI-driven vulnerability discovery has led to a sharp rise in patch failures, with nearly one in forty GitHub fixes requiring follow-up advisories within 90 days.
U.S. agencies warn autonomous AI systems may independently exploit security flaws to establish persistent access without external attacker commands.
The new static analysis scanner ranks vulnerabilities based on sensitive data paths, helping teams focus remediation efforts on the most critical code segments.
Unprivileged tasks in FreeRTOS V11.3.0 and V11.3.1 can bypass memory protection on Arm Cortex-R82, accessing kernel regions outside assigned boundaries.
A flaw in the XSLT Debugger allows attackers to read files if users open crafted documents, posing a risk to unpatched versions.
Remote attackers can hijack XWorm command servers by exploiting a path traversal bug, gaining full control over the infrastructure without operator interaction.
Attackers can log into EseeCloud devices using static credentials, bypassing authentication entirely on affected firmware and app versions.
A critical stored cross-site scripting flaw in Crafty Controller allows unauthenticated remote attackers to inject malicious scripts through HTTP headers.
Attackers can run arbitrary Python code in the scheduler by exploiting a code injection flaw in unauthenticated SGLang endpoints.