-
Vulnerability Watch No37
Discourse Rich Text Editor Flaw Enables Stored XSS • Multicluster Global Hub Flaw Lets Compromised Hubs Falsify Data • Malicious Git Config Can Trigger Code Execution in Goose Review • SPIP SQLite Installations Exposed to Authenticated Command Execution • Malicious use-context-selector Commits Compromised Developer Machines…
-
Vulnerability Watch No31
V-Secure Jingyun Antivirus Kernel Driver Access-Control Flaw • Jiangmin Antivirus Minifilter Driver Access-Control Vulnerability • DeepCool DisplayService Improper Access-Control Flaw • StableBit DrivePool Service Permission Flaw Exposes Local Systems • TrueBooker WordPress Flaw Lets Attackers Take Over Admin Accounts…
-
Vulnerability Watch No30
Quadratic HTML Traversal Enables Remote Resource Exhaustion • Malformed CSS Can Stall html_sanitize_ex Servers • Forged JWT Claims Bypass Neo4j GraphQL Subscription Controls • Unauthenticated Command Can Terminate Ground Station • OpenChamber Shutdown Endpoint Skips Authentication…
-
Vulnerability Watch No21
Hardcoded Backdoor Exposes WordPress Sites to Admin Takeover • Easy Digital Downloads Upload Flaw Could Enable Code Execution • WooCommerce Wholesale Plugin Lets Authors Become Administrators • Netty OCSP Race Can Leak Data to Revoked Servers • Netty Accepts Replayed Expired OCSP Responses…
-
Vulnerability Watch No20
TinyWeb Path Traversal Exposes Sensitive Server Files • Malformed Requests Can Crash TinyWeb Servers • Ordinary Requests Can Exhaust TinyWeb Memory • Rouille Request Smuggling Can Bypass Access Controls • QTI Neon Relay Amplification Threatens Game Hosts…
-
Vulnerability Watch No18
Malformed Chunk Size Can Crash facil.io Servers • Partial Multipart Request Freezes facil.io Workers • Empty Multipart Field Crashes facil.io • Critical TeamCity Agent Protocol Flaw Enables Remote Code Execution • NVIDIA NeMo Command Injection Exposes Linux Hosts…
-
Vulnerability Watch No10
Critical Unauthenticated RCE in Autel Maxi Charger • WordPress WP Foodbakery File Deletion Flaw Can Lead to RCE • Veeam Software Appliance Privilege Escalation to Root • Netty OCSP Validation Bug Enables Revocation Check Bypass • Netty HTTP2 Memory Leak Can Crash JVM…
-
Vulnerability Watch No9
PraisonAI Workspace Isolation Flaw Allows Cross-Tenant Access • PraisonAI Platform JWT Secret Flaw Enables Account Takeover • PraisonAI Platform Member Removal Authorization Bypass • PraisonAI Platform Critical Workspace Access Control Failure • PraisonAI Dependency API IDOR Exposes Workspace Boundaries…
-
Vulnerability Watch No4
Missing Authentication Flaw in SimpleUI AjaxAdmin • Gerapy Project Upload Endpoint Authentication Bypass • Authorization Bug Exposes RT-Claw RPC Handler • QueryWeaver Signup Flow Authentication Bypass • SQL Injection in Class and Exam Timetabling System…
-
Vulnerability Watch No2
Remote Buffer Overflow in Shibby Tomato Scheduler • Remote Stack Overflow Found in Shibby Tomato • Out-of-Bounds Write Threatens Shibby Tomato Routers • Directory Traversal Bug Hits VMware Avi Load Balancer • Privilege Escalation Can Lead to Remote Code Execution…