Vulnerabilities
Samsung QA-Board Critical OS Command Injection Vulnerability Earns 9.8 CVSS Rating in CVE-2026-110392
A critical flaw in the Samsung platform allows OS command injection, rated 9.8. No patch status is provided in the source material.
RedTeam Tribune Vulnerability Desk
Vulnerabilities
Vulnerabilities
CVE-2026-106621 Enables Arbitrary Code Execution in Adobe ColdFusion Without User Interaction
A critical code injection flaw in Adobe ColdFusion allows remote attackers to run arbitrary code without needing victim interaction.
Vulnerabilities
Cisco UCS UEFI Secure Boot flaw lets attackers run rogue code via shell memory edits
Attackers with physical access or valid credentials can bypass UEFI Secure Boot on Cisco UCS servers using shell memory commands.
Vulnerabilities
Windows Network Policy Server Heap Buffer Overflow Permits Unauthenticated Remote Code Execution
A critical buffer overflow in Network Policy Server lets attackers run code remotely on affected Windows versions without prior authentication.
Vulnerabilities
Microsoft QUIC Use-After-Free Flaw Enables Remote Code Execution on Windows 11
An unauthorized attacker can execute code over a network via a critical use-after-free vulnerability in the Microsoft QUIC protocol on multiple Windows 11 versions.
Vulnerabilities
IBM MCP Context Forge CVE-2026-53709 Allows Unauthenticated Admin Token Forgery
A critical flaw in IBM’s MCP Context Forge lets attackers create admin tokens without credentials. The issue persists until version 1.0.2 is deployed.
Vulnerabilities
npm Trusted Publishing Slug Reuse Vulnerability Left 1,500 Packages Exposed to Hijacking via Abandoned GitHub Repo Names
Attackers could hijack over 1,500 npm packages by reclaiming abandoned GitHub repository names, bypassing credential checks to push updates.
Vulnerabilities
Crawl4AI SSRF CVE-2026-109238 Leaks Cloud Metadata in Versions Before 0.9.4
A critical server-side request forgery flaw in Crawl4AI versions before 0.9.4 allows attackers to fetch private cloud metadata and internal addresses.
Vulnerabilities
NetEase Cloud Music Windows CVE-2026-109423 TLS Flaw Lets Attackers Steal Session Credentials
A critical flaw in the Windows client allows attackers to intercept traffic and steal session credentials without proper certificate checks.
Vulnerabilities
OpenSpug Spug File Transfer Component Suffers Critical Remote Command Injection
NVD rates CVE-2026-108540 as critical due to remote OS command injection in OpenSpug Spug up to version 4.0.1, with no vendor response.
Vulnerabilities
3D Product Configurator: Unauthenticated RCE via xpv_image Affects expivi <=2.16.2
A critical flaw in the 3D Product Configurator plugin allows unauthenticated attackers to execute arbitrary code on WordPress servers via a single POST request.
Vulnerabilities
Privasys Go Quote Relay Bug Bypasses Attestation Checks in Pre-v0.5.1 Versions
A critical vulnerability in Privasys Go allows attackers to relay enclave quotes, bypassing attestation checks in versions prior to v0.5.1.
Vulnerabilities
Praisonai AICoder 4.6.77 lacks path validation, enabling root command execution
Missing sanitization in Praisonai AICoder allows attackers to write files and run commands, prompting an urgent update to version 4.6.78.
Vulnerabilities
gvproxy Path Traversal Bug Lets Attackers Delete Host Files
A critical flaw in gvproxy allows unauthenticated attackers to delete arbitrary files on the host system via a vulnerable endpoint.
Vulnerabilities
ProFTPD Access Control Flaw: Federal Agencies Must Patch by Oct 11 After CISA KEV Addition
Federal agencies must remediate a critical ProFTPD access control flaw by October 11 after CISA added it to the KEV catalog.
Vulnerabilities
Apache Struts Remote Code Execution: CISA Mandates Federal Patch by Oct 11
CISA added a high-severity Apache Struts flaw to its catalog, forcing federal agencies to patch or mitigate by October 11 to prevent remote code execution.