Vulnerabilities
Archon AI Remote Code Execution Flaw Affects Versions 0.2.13 to 0.11.1
Unauthenticated access to the Archon AI coding agent API allows remote attackers to execute commands on the host system without credentials.
RedTeam Tribune Vulnerability Desk
Vulnerabilities
Vulnerabilities
Theme My Login Privilege Escalation Allows Unauthenticated Account Takeover
Unauthenticated attackers can reset passwords for any user in WordPress multi-site installations running vulnerable versions of the Theme My Login plugin.
Vulnerabilities
SPIP odt2spip os command injection via filenames patched in 4.4.0
A high-severity flaw in the SPIP odt2spip plugin allows authenticated authors to execute arbitrary commands on the web server via crafted filenames, a risk mitigated in version 4.4.0.
Vulnerabilities
Trivy, govulncheck False Positives: Source Flaw Missing in Binary Highlights Assessment Gaps
Security scanners flagged a flaw in source code that does not appear in the final compiled binary, raising questions about vulnerability assessment accuracy.
Vulnerabilities
Windows 11 Remote Desktop Bypass Flaw Exposes Admin Protection Weakness
A cryptographic vulnerability in Windows Remote Desktop allows attackers to bypass security features, complicating recent update issues for managed devices.
Vulnerabilities
Wavlink WL-WN530BE2-A Router Exposed to Remote Code Execution via Login Handler
Attackers could execute arbitrary commands remotely on this router by exploiting a flaw in how login requests process client addresses.
Vulnerabilities
Mitsubishi GENESIS64 DCOM Flaw Grants Local Admin Remote Execution Rights
A critical privilege assignment error in Mitsubishi Electric GENESIS64 allows attackers with admin access to launch remote DCOM objects without elevation.
Vulnerabilities
Qualys TruRisk Eliminate 2.0 AI Closes Vulnerability Gap With Machine-Speed Patch Deployment
Qualys launches TruRisk Eliminate 2.0 with TruConfidence to automate patch deployment and risk reduction at machine speed using AI-driven orchestration.
Vulnerabilities
AWS Athena Synapse Connector Flaw May Return Unintended Data
A vulnerability in the AWS Athena Federated Query Synapse Connector could cause unintended data returns when querying specially crafted table names.
Vulnerabilities
Unauthenticated gRPC Flaw in MyReport Updater Enables SYSTEM Code Execution
Attackers exploit an exposed service in MyReport Updater to redirect updates and run code with SYSTEM privileges on affected servers.
Vulnerabilities
Hitachi Vantara Remote Ops Agent Brute-Force Flaw Allows Account Takeover
Attackers can reset any account password without rate limits on versions up to 2.0, gaining administrative control over service configurations.
Vulnerabilities
Printcart Store: Arbitrary File Upload Bug Lets Attackers Write Executables to WooCommerce Servers Without Credentials
Attackers can write executable files to WooCommerce servers without credentials in Printcart Store versions up to 2.9.1.
Vulnerabilities
SharePoint CVE-2026-88164 Missing Authorization Flaw Enables Privilege Escalation
Microsoft confirms a high-severity flaw in SharePoint that lets authenticated users elevate privileges over the network, impacting Subscription Edition versions.
Vulnerabilities
Microsoft .NET Type Confusion Vulnerability Allows Remote Privilege Escalation
Microsoft confirms a high-severity type confusion vulnerability in .NET that allows unauthorized network attackers to elevate privileges.
Vulnerabilities
Chrome Sandbox Escape: AI-Assisted Chain of Three Zero-Days Impacts Windows Users
Xbow researchers used an AI model to chain three Chrome flaws, escaping the Windows sandbox in six days and earning a $250,000 bounty from Google.
Vulnerabilities
WeGIA 3.8.6 Patches Unauthenticated SQL Injection in Billing Module
LabRedesCefetRJ released version 3.8.6 to fix a critical SQL injection flaw that allowed attackers to steal or delete data without logging in.
Vulnerabilities
Unauthenticated Heap Overflow in Juniper SVR Enables Remote Denial of Service
Malformed IPv4 packets targeting Secure Vector Routing interfaces allow attackers to crash Juniper SRX firewalls via a critical buffer overflow vulnerability.
Vulnerabilities
.NET Improper Link Resolution Vulnerability Enables Local Privilege Escalation on Linux and macOS
An authorized attacker can exploit improper link resolution in .NET to elevate privileges locally on Linux and macOS systems running affected runtime versions.
Vulnerabilities
Linux vhost stale cache flaw CVE-2026-74580 grants root and enables VM escape to host
A stale cache bug in Linux vhost allows local users to gain root privileges or lets virtual machines break out to the host system.
Vulnerabilities
.NET WPF Patch Fixes High-Severity RCE Flaw in Framework 8-11 Preview Requiring User Interaction
Microsoft patches a high-severity vulnerability in .NET WPF that allows attackers to run arbitrary code if users engage with crafted content.
Vulnerabilities
.NET WPF Out-of-Bounds Write in CVE-2026-70007 Allows Remote Code Execution
Microsoft patches high-severity heap corruption flaw in .NET WPF runtime that enables remote attackers to execute code via crafted pixel-shader bytecode.
Vulnerabilities
ASP.NET Core Unbounded Memory Growth in Localization Logic
Unauthenticated requests can exhaust memory via synthetic culture names in ASP.NET Core, leading to denial of service across multiple platforms.
Vulnerabilities
.NET WPF Deserialization Flaw Enables Remote Code Execution on Windows Systems
A high-severity deserialization flaw in .NET WPF lets attackers run code on Windows systems if a user interacts with a crafted link.
Vulnerabilities
Ivanti Zero-Day Chain Grants Unauthenticated Root Access to Patched Gateways
Threat actor UTA0576 chained three Ivanti zero-days to bypass authentication and execute commands as root on fully patched remote access gateways.