Skip to content

Breaking

Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan
Attackers Hijack Staples and Dell Order Notifications for Voice Phishing
aiohttp multipart requests cause unbounded file descriptor retention in versions up to 3.14.3
Eclipse ioFog WebSocket Authentication Bypass Leaves Admin Control Unprotected in Unpatched Versions
Argo CD JSONnet Flaw Risks Server Crash and File Read for Low-Priv Users Up to 3.6.0
Argo CD Kustomize Injection Bug Lets Read-Only Users Run Code on Repo Servers
PHP Remote Code Execution Flaws Rated 9.2 Trigger Emergency Patch Plan

unauthenticated

Everything RedTeam Tribune has reported about unauthenticated: 2 stories, newest first. Part of our Vulnerabilities coverage.

20 Oct
Vulnerabilities

DB-GPT 0.8.2 Endpoint Error Grants Unauthenticated Root Code Execution

A flaw in DB-GPT 0.8.2 allows attackers to run code as root without login, exposing containers and databases to full compromise.

16 Oct
Vulnerabilities

Theme My Login Privilege Escalation Allows Unauthenticated Account Takeover

Unauthenticated attackers can reset passwords for any user in WordPress multi-site installations running vulnerable versions of the Theme My Login plugin.