Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

NVD

Everything RedTeam Tribune has reported about NVD: 2 stories, newest first. Part of our Vulnerabilities coverage.

16 Oct
Vulnerabilities

Archon AI Remote Code Execution Flaw Affects Versions 0.2.13 to 0.11.1

Unauthenticated access to the Archon AI coding agent API allows remote attackers to execute commands on the host system without credentials.

11 Oct
Vulnerabilities

OpenSpug Spug File Transfer Component Suffers Critical Remote Command Injection

NVD rates CVE-2026-108540 as critical due to remote OS command injection in OpenSpug Spug up to version 4.0.1, with no vendor response.