A critical authorization error in Progress MarkLogic Server allows attackers with forest-management rights to establish persistent administrator accounts.
Automated tools leveraged the GodPotato privilege escalation flaw to achieve full SYSTEM access on Windows servers within a single day.
The National Vulnerability Database rates CVE-2026-93943 as critical, exposing WordPress sites using the Convex plugin to remote object injection risks.
Researchers disclosed a critical OS command injection flaw in OpenSpug’s file transfer endpoint, affecting versions up to 3.4.0 and 4.0.1 with no vendor fix.
A critical vulnerability in Booster for WooCommerce versions up to 8.4.0 allows unauthenticated attackers to inject PHP objects and potentially execute arbitrary code.
NVD records a critical deserialization flaw in ThemeREX Rosalinda versions up to 1.2.4, exposing sites to object injection attacks.
Researchers exposed 2,100 servers with a high-severity vulnerability allowing remote disruption of GPU monitoring services without authentication.
The @enmaso/node-convert library contains a critical flaw allowing arbitrary command execution via unsanitized inputs in versions through 1.0.0.
Attackers exploit time-based blind SQL injection in PHPNuxBill radius.php to steal customer data and credentials without authentication.
Federal agency lists CVE-2016-3081 in KEV, setting a strict compliance deadline for federal systems to mitigate the risk.
Microsoft Security publishes a new guide outlining how CISOs can leverage AI to mitigate risks and strengthen organizational resilience.