Vulnerabilities
IBM DataStage flaw lets attackers bypass encryption and poison tenant data
A critical vulnerability in IBM DataStage 5.4.0.0 allows unauthenticated users to write to shared Redis stores, collapsing credential encryption boundaries.
Patch Observer CVE Desk
The Patch Observer CVE Desk is the part of the Patch Observer newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 127 articles so far. See the editorial policy or report an error.
Vulnerabilities
Critical Command Injection Flaw in Totolink X2000R Firmware Exposes Users to Remote Code Execution
A CVSS 9.1 critical vulnerability in specific Totolink firmware allows authenticated attackers to execute arbitrary code via crafted HTTP requests.
Vulnerabilities
Apache CouchDB 3.5.3 Fixes High-Severity Decompression Bomb Vulnerability
A remote denial-of-service flaw in Apache CouchDB versions below 3.5.3 is fixed in the latest release, requiring immediate updates for exposed systems.
Vulnerabilities
Apostrophe CMS Prototype Pollution Causes Persistent Denial of Service
A high-severity flaw in Apostrophe CMS allows low-privileged users to crash the entire Node process by deleting shared runtime methods via crafted requests.
Vulnerabilities
Orgs Using Apache Tomcat 11 Must Upgrade to 11.0.27 to Stop Data Leaks From Buffer Under-Read Flaw
Organizations running Apache Tomcat 11.0.0-M25 through 11.0.26 must upgrade to version 11.0.27 to address a critical buffer under-read flaw that risks data exposure.
Vulnerabilities
Python certifi Update Removes emSign Root Certificate in Critical Patch
A critical update for the Python certifi library removes the emSign root certificate. Organizations using affected versions must review their dependencies.
Vulnerabilities
SolarWinds Observability Self-Hosted Authorization Flaw Allows Data Modification
A high-severity broken authorization flaw in SolarWinds Observability Self-Hosted allows low-privileged users to access and modify information beyond permissions.
Vulnerabilities
Stirling-PDF administrators face high-risk SQL bypass vulnerability in versions through 3.2.0
Authenticated admins can bypass import restrictions in Stirling-PDF using crafted SQL backups, allowing Java execution in versions up to 3.2.0.
Vulnerabilities
NetX Secure TLS 1.3 parser flaw allows pre-auth heap read
A high-severity vulnerability in NetX Secure enables remote attackers to trigger heap out-of-bounds reads during standard TLS handshakes.
Vulnerabilities
Crass Ruby Gem Vulnerable to CPU Exhaustion via CSS Parsing Flaw
A high-severity flaw in the Crass gem allows attackers to crash applications by exploiting unbounded exponentiation in CSS parsing.
Vulnerabilities
DrayTek Vigor2960 Critical Remote Code Execution Flaw Lacks Active Vendor Support
A critical command injection flaw in end-of-life DrayTek Vigor2960 routers allows remote exploitation, with no active patching support confirmed for affected versions.
Vulnerabilities
Fortinet FortiSIEM Faces Critical Unauthenticated RCE via gRPC Flaw
A new vulnerability allows remote attackers to execute code on FortiSIEM systems without credentials, exploiting a path traversal issue in an exposed service.
Vulnerabilities
On-prem and Cloud Unblu Spark Users Face Config Tampering via CVE-2026-9589 in Versions Before 8.37.0
A critical flaw in Unblu Spark allows authenticated attackers to read and modify configuration data for other users and accounts across on-premises and cloud deployments.
Vulnerabilities
Organisations boost security coverage with ThreatBook's RedAgents multi-AI parallel testing platform
The new SaaS service combines four distinct AI agents to run parallel security assessments, aiming to improve vulnerability coverage and reduce false positives for authorized targets.
Vulnerabilities
Organizations in Israel, UK, and US hire senior security experts amid high demand
Three organizations open senior security positions in Israel, the UK, and the US, signaling ongoing demand for specialized expertise.
Vulnerabilities
Organisations Urged to Patch Pillow 13.0.0 to Block Critical Arbitrary Code Execution Flaw CVE-2026-112398
A critical flaw in Pillow versions before 13.0.0 allows arbitrary code execution via crafted files, requiring immediate updates for exposed systems.
Vulnerabilities
Coze Studio Users Face High-Risk Command Execution Flaw Before 0.5.0
An insecure default in Coze Studio allows registered users to run unsandboxed code, risking API key theft and database access until version 0.5.0 is deployed.
Vulnerabilities
DB-GPT 0.8.2 Vulnerability Grants Unauthenticated Root Access to Containers
A critical flaw in DB-GPT versions up to 0.8.2 allows attackers to execute arbitrary code as root without credentials, posing an immediate risk to exposed instances.
Vulnerabilities
Qilin, Inc Ransomware Bypasses MFA on PAN-OS Gateways via CVE-2026-0257
Threat actors use CVE-2026-0257 to bypass MFA on PAN-OS gateways, enabling VPN access and subsequent ransomware deployment in targeted networks.
Vulnerabilities
aiohttp users must patch keepalive flaw before servers run out of connections
A high-severity flaw in aiohttp versions below 3.14.4 allows attackers to hold connections open indefinitely, exhausting server capacity until the fix is applied.
Vulnerabilities
Archibus Critical Flaw Allows Unauthenticated Remote Code Execution
A severe vulnerability in Eptura Archibus permits attackers to upload executable files and run commands on servers without logging in.
Vulnerabilities
H3C Magic NX15 Remote Code Injection Flaw Exposes Networks to Public Exploit
A critical remote code injection vulnerability in H3C Magic NX15 firmware allows arbitrary code execution. The exploit code is publicly available and may be utilized by attackers.
Vulnerabilities
Organisations urged to patch Plex as attackers chain flaws to deploy cryptominers and proxy malware
Attackers are chaining four vulnerabilities in Plex Media Server to execute remote code and deploy malware on unpatched systems.
Vulnerabilities
Orgs Urged to Patch Mercury 3.2.4 to Stop Terminal Shell Access via Missing Comma CVE-2026-111057
A missing comma in Mercury versions 3.0.0 through 3.2.3 allows attackers to access terminal shells. Version 3.2.4 resolves the critical vulnerability.