-
Vulnerability Watch No73
vLLM Loader Flaw Enables Remote Code Execution • AVideo Scheduler Bug Exposes Email Jobs • MemberPress Flaw Allows Administrator Account Takeover • YayPricing Plugin Enables Stored Script Attacks • Zonify Plugin Leaks Authentication Tokens…
-
Vulnerability Watch No72
GitLab Duo Chat Flaw Exposes Sensitive Search Credentials • GitLab Repository API Bug Allows Unauthenticated File Reads • stb_vorbis Heap Overflow Can Corrupt Memory • OpenStack Keystone Delegated Tokens Expose Credentials • Default Admin Password Leaves Inventory Component Exposed…
-
Vulnerability Watch No67
DeepSeek Harness Authentication Bypass Grants Full Agent Control • MongoDB Router Resource Exhaustion Bug Can Cause Service Disruption • MongoDB Storage Configuration Flaw Risks Crashes and Code Execution • MongoDB Authorization Bug Could Allow Administrative Takeover • MongoDB Replica Set Assertion Issue Triggers Remote Crashes…
-
Vulnerability Watch No66
YouTrack REST API Authorization Gap Exposes Resources • YouTrack Link Controls Allow Unauthorized Entity Changes • YouTrack Whiteboard Clone Flaw Exposes Issue Links • YouTrack Token Cache Issue Enables Cross-Tenant Token Theft • YouTrack Group Management Bug Enables Privilege Escalation…
-
Vulnerability Watch No65
undici Cache Bug Enables Cross-Origin Data Exposure • undici TLS Validation Bypass Hits BalancedPool • PowerJob Worker Unauthenticated RCE Exposes Servers • IBM ContextForge Session Leak Exposes Data • IBM ContextForge Bug Allows Credential Theft…
-
Vulnerability Watch No56
Splunk flaw lets lower-privileged users write arbitrary dispatch metadata • Splunk Monitoring Console link flaw enables unauthorized searches • Splunk authentication weakness can enable forged admin sessions • Splunk SPL2 API issue allows unauthorized module deletion • Splunk Web XML weakness enables operating system command execution…
-
Vulnerability Watch No45
CrateDB Blob API Bypasses Table Privileges • Malicious Projects Can Trigger Code Execution in Cortex MCP • Recursive Jinja Rendering Enables Command Execution in compliance-trestle • Public Exploit Targets TOTOLINK A800R DHCP Handler • Public Exploit Exposes TOTOLINK A800R IPv6 Stack Overflow…
-
Vulnerability Watch No14
Exim .forward Flaw Enables Privilege Escalation • Exim Directory Traversal Leads to Privilege Gain • OpenStack Ironic Agent Exposed to Code Execution • WordPress Wpify Woo Plugin Allows Admin Takeover • Azure DNS Authorization Flaw Rated Critical…
-
Topics Everyone Is Talking About No345
I Sell Onions on the Internet: A Southern Success Story • Toys with the Highest Play-Time and Lowest Clean-Up-Time • Mattermost Limits Message History to 10,000: Community Pushback Grows • The HTML Elements Time Forgot: A Journey Through Web History • Introducing rules_img: Faster Container Builds for Bazel Developers…
-
Topics Everyone Is Talking About No342
Tell HN: Merry Christmas • Nvidia buying AI chip startup Groq for about 20B in cash • Show HN: Vibium Browser automation for AI and humans, by Seleniums creator • When Compilers Surprise You • Why We Abandoned Matrix 2024…