Vulnerabilities
GitPython Argument Injection Flaw Lets Attackers Read Files via Branch Names
A high-severity flaw in GitPython before 3.2.0 allows attackers to leak arbitrary files by manipulating branch names during repository checkout operations.
NetSec Tribune Exposure Desk
The NetSec Tribune Exposure Desk is the part of the NetSec Tribune newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 35 articles so far. See the editorial policy or report an error.
Vulnerabilities
Slican patches CVE-2026-35088 in IPx v6.62.0100; legacy models require hardware upgrades to fix
Slican patches a high-severity flaw allowing decryption of telephone exchange traffic, but legacy models remain at risk without hardware upgrades.
Vulnerabilities
Slican IPx WebCTI Service Exposes Subscriber Passwords in Plaintext
A high-severity flaw in Slican IPx telephone systems allows database access to reveal stored user credentials, enabling account takeover.
Vulnerabilities
High-severity Jetty flaw CVE-2026-18661 allows security bypass in versions up to 12.1.11
A high-severity vulnerability in Eclipse Jetty allows security bypasses when web.xml and annotations are used together, affecting versions up to 12.1.11.
Vulnerabilities
Unauthenticated YAML Requests Crash Symfony Processes in High-Severity CVE-2026-109413 Flaw
A stack exhaustion flaw in Symfony YAML allows unauthenticated attackers to crash processes via deeply nested inline collections in affected versions.
Vulnerabilities
OPNsense XSS Flaw Allows Admin Session Hijack via OpenVPN Widget
A high-severity cross-site scripting issue in OPNsense OpenVPN widgets enables attackers to execute code in administrator browsers and take full control of the firewall.
Vulnerabilities
Fortinet Confirms Wild Exploitation of EMS Bypass; Public PoC Targets Versions 7.4.5 and 7.4.6
Public exploit scripts for the critical FortiClient EMS flaw are available, prompting urgent verification for organizations running versions 7.4.5 and 7.4.6.
Vulnerabilities
AWS urges immediate jsii-diff version check to block shell command execution via CVE-2026-15895
Security teams should verify jsii-diff versions immediately, as unpatched instances allow shell command execution through crafted arguments.
Vulnerabilities
Unauthenticated RCE Threatens Office 365 and LTSC via High-Severity Access Heap Overflow CVE-2026-102850
A high-severity flaw in Microsoft Office Access allows network-based remote code execution, affecting Enterprise and LTSC builds until specific updates are applied.
Vulnerabilities
Better Auth OAuth flaw lets attackers bypass login as any user
Unauthenticated attackers can hijack sessions in Better Auth versions before 1.7.7 by reusing OAuth state values as magic link tokens.
Vulnerabilities
SharePoint Server Subscription Edition Patched for CVE-2026-102860 Network Privilege Escalation
An authorized attacker can elevate privileges in SharePoint Server Subscription Edition before build 16.0.20326.20190 via a network-accessible flaw.
Vulnerabilities
Hestia Panel Users Can Escalate to Root via Search Feature
A flaw in Hestia Control Panel versions 1.9.7 through 1.10.4 allows authenticated users to execute arbitrary code as root by manipulating search paths.
Vulnerabilities
Unauthenticated Attackers Gain Root Access to Cisco Secure Email Gateway via File Reputation Service
Unauthenticated attackers can write arbitrary files on the OS if the file reputation service is enabled on affected versions.
Vulnerabilities
Microsoft Patches High-Severity .NET DoS Flaw CVE-2026-96960 in Cryptography Package
Microsoft released updates for System.Security.Cryptography.Xml to address a network-accessible denial of service vulnerability affecting multiple .NET versions.
Vulnerabilities
Microsoft Patches .NET WPF Out-of-Bounds Write in CVE-2026-96224
Microsoft released updates for .NET WPF runtimes to fix a high-severity remote code execution flaw triggered by crafted pixel shaders.
Vulnerabilities
Microsoft warns of critical Windows Schannel spoofing flaw CVE-2026-105008
A critical vulnerability in Windows Schannel allows network spoofing by unauthorized attackers. Microsoft has published an advisory for CVE-2026-105008.
Vulnerabilities
NVD Rates Microsoft Word Untrusted Pointer Flaw CVE-2026-70300 Critical With 9.8 CVSS Score
An untrusted pointer dereference in Microsoft Office Word allows unauthorized attackers to execute code over a network, rated critical by NVD.
Vulnerabilities
NVD Rates Windows Failover Cluster Use-After-Free Vulnerability as Critical RCE
A use-after-free flaw in Windows Failover Cluster allows remote code execution, rated CVSS 9.8 by the National Vulnerability Database.
Vulnerabilities
Unauthenticated API Access Flaw in Esri Portal for ArcGIS Rated Critical
A critical vulnerability allows attackers to bypass authentication in Esri Portal for ArcGIS, granting access to administrative endpoints without credentials.
Vulnerabilities
Pro-me3us Tool Roots Fire TV Cube 3 Via Bootloader Flaw, Wipes Data and Risks Bricking on PS7717
A public tool by developer Pro-me3us allows persistent root access on Amazon Fire TV Cube 3 devices running firmware PS7717 or older, carrying bricking risks.
Vulnerabilities
VMware HyperArmor blocks exploit traffic with virtual patching to counter AI-driven vulnerability discovery surge
VMware introduces HyperArmor to help users manage the surge of patches triggered by AI vulnerability discovery, offering virtual patching and strict access controls.
Vulnerabilities
CVSS 9.9 SAP S/4HANA flaw CVE-2026-89107 risks full compromise via ABAP execution in versions 105-108
Critical vulnerability in SAP S/4HANA allows authenticated attackers with specific privileges to execute arbitrary ABAP code via rule definitions.
Vulnerabilities
Flock Security's CVE authority role sparks transparency and credibility concerns
The surveillance vendor gained authority to assign vulnerability IDs to its own cameras and license plate readers, raising questions about transparency.
Vulnerabilities
Edimax BR-6208AC Firmware 1.32 Has Critical Remote Buffer Overflow Flaw
A published exploit targets an unpatched buffer overflow in the Edimax BR-6208AC router, affecting unsupported devices with no vendor response.