https://netsectribune.com/category/vulnerabilities/dompurify-3-4-17-patches-flaw-letting-event/NetSec Tribuneen2026-10-22T17:26:44ZDOMPurify 3.4.17 patches flaw letting event handlers fire after parent nodes are removedhttps://netsectribune.com/category/vulnerabilities/graphql-tools-utils-patches-cve-2026-114604/NetSec Tribuneen2026-10-22T17:22:15Z@graphql-tools/utils patches CVE-2026-114604 prototype pollution vulnerability in version 12.0.2https://netsectribune.com/category/vulnerabilities/pillow-13-0-0-patch-stops-jpeg-icc-profile-heap/NetSec Tribuneen2026-10-22T16:42:33ZPillow 13.0.0 Patch Stops JPEG ICC Profile Heap Overflow Crashes and Code Execution Riskshttps://netsectribune.com/category/vulnerabilities/cleanshot-x-patches-high-severity-deserialization/NetSec Tribuneen2026-10-22T15:48:40ZCleanShot X patches high-severity deserialization flaw CVE-2026-16477https://netsectribune.com/category/vulnerabilities/webpack-dev-server-websocket-proxy-flaw-exposes/NetSec Tribuneen2026-10-22T10:15:08Zwebpack-dev-server WebSocket proxy flaw exposes loopback to cross-origin attackshttps://netsectribune.com/category/vulnerabilities/fortinet-warns-of-ai-assisted-vulnerabilities-in/NetSec Tribuneen2026-10-22T09:29:50ZFortinet warns of AI-assisted vulnerabilities in FortiOS, FortiManager, and FortiAnalyzerhttps://netsectribune.com/category/vulnerabilities/unauthenticated-takeover-flaw-in-oracle-bpm-suite/NetSec Tribuneen2026-10-22T04:32:27ZUnauthenticated Takeover Flaw in Oracle BPM Suite Hits Specific Versionshttps://netsectribune.com/category/cloud-security/datadog-pathrunner-automates-aws-iam-escalation/NetSec Tribuneen2026-10-22T03:33:21ZDatadog Pathrunner automates AWS IAM escalation to guide remediation prioritieshttps://netsectribune.com/category/vulnerabilities/roundcube-webmail-header-injection-flaw-cve-2026/NetSec Tribuneen2026-10-22T02:12:18ZRoundcube Webmail Header Injection Flaw CVE-2026-114716 Rated Highhttps://netsectribune.com/category/vulnerabilities/robots-validate-flaw-misidentifies-perl-clients/NetSec Tribuneen2026-10-21T22:54:43ZRobots-Validate Flaw Misidentifies Perl Clients as Imposter Botshttps://netsectribune.com/category/vulnerabilities/google-sam-auth-bypass-lets-attackers-steal/NetSec Tribuneen2026-10-21T22:54:43ZGoogle SAM Auth Bypass Lets Attackers Steal Tokens in Alpha Versionshttps://netsectribune.com/category/vulnerabilities/rex-1-16-1-hardcodes-ssh-to-disable-host-key/NetSec Tribuneen2026-10-21T22:40:23ZRex 1.16.1 Hardcodes SSH to Disable Host Key Checks, Risking Man-in-the-Middle Attackshttps://netsectribune.com/category/vulnerabilities/vaadin-charts-fixes-highcharts-xss-and-prototype/NetSec Tribuneen2026-10-21T18:49:25ZVaadin Charts Fixes Highcharts XSS and Prototype Pollution in Versions 22 Through 25https://netsectribune.com/category/vulnerabilities/ai-driven-vulnerability-discovery-shrinks-exploit/NetSec Tribuneen2026-10-21T18:46:14ZAI-Driven Vulnerability Discovery Shrinks Exploit Window to Five Dayshttps://netsectribune.com/category/vulnerabilities/php-patches-released-for-critical-cve-2026-109618/NetSec Tribuneen2026-10-21T18:06:07ZPHP patches released for critical CVE-2026-109618 and CVE-2026-109619https://netsectribune.com/category/vulnerabilities/apostrophe-cms-import-module-allows/NetSec Tribuneen2026-10-21T16:04:10ZApostrophe CMS import module allows unauthenticated denial of servicehttps://netsectribune.com/category/cyber-attacks/nigerian-man-gets-8-years-for-hacking-tax-firms/NetSec Tribuneen2026-10-21T07:19:27ZNigerian Man Gets 8 Years for Hacking Tax Firms, Fraud; $10.8M Forfeiture Orderedhttps://netsectribune.com/category/vulnerabilities/nvd-rates-totolink-x2000r-authenticated-command/NetSec Tribuneen2026-10-21T02:56:11ZNVD Rates TOTOLINK X2000R Authenticated Command Injection Flaw Critical With 9.1 CVSS Scorehttps://netsectribune.com/category/vulnerabilities/cve-2026-9814-allows-authenticated-code-execution/NetSec Tribuneen2026-10-21T02:27:26ZCVE-2026-9814 Allows Authenticated Code Execution on Totolink X2000R Routerhttps://netsectribune.com/category/vulnerabilities/trigger-dev-flaw-lets-restricted-keys-expose-root/NetSec Tribuneen2026-10-21T02:19:14ZTrigger.dev Flaw Lets Restricted Keys Expose Root Secrets and Admin Tokenshttps://netsectribune.com/category/vulnerabilities/cve-2026-40615-authenticated-stack-overflow-in/NetSec Tribuneen2026-10-21T00:28:21ZCVE-2026-40615: Authenticated Stack Overflow in Totolink X2000R Firmware Rated CVSS 9.1https://netsectribune.com/category/vulnerabilities/mozilla-and-chrome-strip-trust-for-emudhra-roots/NetSec Tribuneen2026-10-20T23:39:49ZMozilla and Chrome Strip Trust for eMudhra Roots After Intermediate Compromisehttps://netsectribune.com/category/vulnerabilities/perl-dbi-type-confusion-crash-in-versions-before/NetSec Tribuneen2026-10-20T22:30:57ZPerl DBI Type Confusion Crash in Versions Before 1.656 Exposed in Oct 20 Advisoryhttps://netsectribune.com/category/vulnerabilities/shadowserver-sees-unauthenticated-sql-injection/NetSec Tribuneen2026-10-20T21:20:08ZShadowserver Sees Unauthenticated SQL Injection Attacks Against FooSun DotNetCMShttps://netsectribune.com/category/vulnerabilities/apache-tomcat-11-0-27-fixes-critical-cross/NetSec Tribuneen2026-10-20T18:38:04ZApache Tomcat 11.0.27 Fixes Critical Cross-Request Data Leak in Versions 11.0.0-M25 Through 11.0.26https://netsectribune.com/category/vulnerabilities/angular-router-ssr-flaw-crashes-node-js-workers/NetSec Tribuneen2026-10-20T18:33:15ZAngular Router SSR Flaw Crashes Node.js Workers via Query Parameter Amplificationhttps://netsectribune.com/category/cyber-attacks/qilin-and-inc-exploit-pan-os-bypass-to-bypass-mfa/NetSec Tribuneen2026-10-20T18:16:05ZQilin and Inc exploit PAN-OS bypass to bypass MFA and deploy ransomwarehttps://netsectribune.com/category/vulnerabilities/apache-urges-immediate-upgrade-to-couchdb-3-5-3/NetSec Tribuneen2026-10-20T17:55:21ZApache Urges Immediate Upgrade to CouchDB 3.5.3 to Block Critical Shell Command Execution