A missing comma in Mercury versions 3.0.0 through 3.2.3 allows attackers to access terminal shells. Version 3.2.4 resolves the critical vulnerability.
A zero-width image processing error in Pillow versions before 13.0.0 allows attackers to crash applications. The vendor has released a fix for this high-severity vulnerability.
A high-severity stack buffer overflow in IBM MQ allows remote attackers to execute code when processing malformed TLS certificates during channel setup.
A high-severity flaw in aiohttp allows attackers to exhaust server resources via crafted requests, requiring immediate upgrades to version 3.14.4 for all exposed clients.
Security updates address five vulnerabilities in Drupal core and modules, including two critical remote code execution bugs with known exploit paths.
A vulnerability in the JQ::Lite Perl module allows remote code execution via regular expressions, affecting versions prior to 2.51.
Unauthenticated attackers can seize full control of FlyCms instances using hardcoded default credentials, requiring immediate credential rotation and access restriction.
A high-severity flaw in the latest MobaXterm version allows local attackers to execute arbitrary code via tampered plugin libraries.
A critical flaw in early alpha versions of Google Agent Mesh SAM allows unauthenticated remote attackers to enroll and execute arbitrary tools on backend nodes.
A critical vulnerability in Linux KVM allows virtual machines to escape isolation via malformed packets, threatening cloud infrastructure security.
A high-severity flaw in OpenTelemetry HTTP exporters disables certificate checks, allowing attackers to intercept sensitive metrics and logs.
Unauthenticated attackers can exploit a stack overflow in Netcore NR256CN routers running up to version 1.5.140116 to crash services or run code.
Unauthenticated attackers can forge admin session tokens in OpenBMB StaffDeck versions up to 0.5.6, granting full tenant administration access via a hard-coded secret.
A high-severity privilege escalation in phpMyFAQ allows delegated administrators to assign categories outside their scope, affecting versions prior to 4.2.0-beta.
Unauthenticated users can create forged JWT tokens to access admin functions in ZKEACMS versions up to 4.4. No fix status is provided in the source material.
A high-severity flaw in bbs-go allows remote attackers to impersonate users by replaying Google tokens, affecting all versions through 4.4.6.
An unauthenticated flaw in Misaka Danmu Server through version 2.8.9 allows attackers to rewrite configuration keys and seize full administrative access to the platform.
A high-severity flaw in the Rust lopdf library enables denial of service through crafted files, with a patch available in version 0.42.0 for affected applications.
Organizations using Countly Server must update to 24.05.50 or 25.03.44 to block a critical stored cross-site scripting flaw that exposes admin session tokens.
A high-severity path traversal flaw in Countly server versions before 24.05.50 and 25.03.44 lets authenticated users delete files.
A critical buffer overread in older RIOT OS versions allows malicious DHCPv6 servers to crash embedded systems and leak memory data.
An unauthenticated remote peer can trigger an infinite CPU loop or process abort in libiec61850 versions prior to 1.6.2 by sending malformed association data.
A new update addresses a use-after-free bug in X.Org Server that allows local attackers to leak sensitive data from affected systems.
A high-severity flaw in libp2p-rust allows remote peers to exhaust memory via unbounded topic handling. Version 0.49.5 patches the issue.