Everything Patch Observer has reported about CVSS 9.3: 4 stories, newest first. Part of our Vulnerabilities coverage.
A critical flaw in DB-GPT versions up to 0.8.2 allows attackers to execute arbitrary code as root without credentials, posing an immediate risk to exposed instances.
Unauthenticated attackers can seize full control of FlyCms instances using hardcoded default credentials, requiring immediate credential rotation and access restriction.
An unauthenticated flaw in Misaka Danmu Server through version 2.8.9 allows attackers to rewrite configuration keys and seize full administrative access to the platform.
A critical vulnerability in Eclipse EthereumAuthenticator allows attackers to bypass authentication checks if request paths match specific patterns.