Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

CVSS 9.2

Everything RedTeam Tribune has reported about CVSS 9.2: 2 stories, newest first. Part of our Vulnerabilities coverage.

21 Oct
Vulnerabilities

PHP CVSS 9.2 Vulnerabilities Impact WordPress; Critical Patch Arrives October 21

Two high-severity vulnerabilities in PHP, both rated 9.2, will be patched in an update scheduled for October 21, 2026, affecting all dependent applications.

13 Oct
Vulnerabilities

Crawl4AI SSRF CVE-2026-109238 Leaks Cloud Metadata in Versions Before 0.9.4

A critical server-side request forgery flaw in Crawl4AI versions before 0.9.4 allows attackers to fetch private cloud metadata and internal addresses.