A critical flaw in GPT-SoVITS allows attackers to run system commands via the UVR5 web interface without authentication, affecting versions up to 20250606v2pro.
A critical flaw allows unauthenticated access to admin APIs in Esri Portal for ArcGIS, requiring immediate attention from managed service providers.
A critical flaw in PraisonAI allowed anyone to access agent systems. Version 1.6.59 patches the missing access controls that exposed workflows and data.
A critical vulnerability in IBM DataStage on Cloud Pak for Data enables attackers to run arbitrary code via path traversal, posing a severe risk to managed environments.
The U.S. CISA has added five specific software vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling urgent action for managed service providers.
The NVD rates CVE-2026-93927 as critical, warning that Axiomthemes Veto versions up to 1.6.0 allow object injection through untrusted data.
Proton’s SimpleLogin service allows users to generate disposable email aliases, keeping primary addresses private while supporting self-hosted deployments.
A critical deserialization vulnerability in ThemeREX Group Smart Casa allows remote object injection, requiring immediate attention for users on versions up to 1.0.12.
A critical vulnerability in openPDC Docker images allows remote attackers to bypass authentication using hardcoded administrative credentials.
Attackers are exploiting two unpatched AhsayCBS flaws to bypass authentication, run OS commands, and install disguised cryptocurrency miners on backup servers.
A patch for the popular Node.js library inadvertently restored a critical flaw, allowing attackers to forge tokens using public keys as secrets.
A critical deserialization flaw in Microsoft Dataverse allows network-based code execution, posing severe risks to managed service providers.
CISA has added CVE-2025-5477 to its catalog, mandating that federal agencies mitigate the high-severity flaw by October 11, 2026.
Unauthenticated attackers can exploit CVE-2026-105830 to freeze PHP workers via malicious markdown input, requiring immediate patching.