Vulnerabilities
Can phpMyFAQ Users Bypass Permissions to Edit Restricted Articles?
A broken object-level authorisation flaw in phpMyFAQ allows authenticated users with edit rights to modify any FAQ entry, bypassing moderation checks.
Honeypot Daily Patch Watch Desk
Vulnerabilities
How Does Improper Hostname Validation in Coder Proxy Redirects Steal Workspace API Keys?
A high-severity flaw in older Coder versions allows attackers to steal workspace API keys by exploiting improper hostname validation in proxy redirects.
Vulnerabilities
Does LibreOffice PDF Flaw Enable Remote Code Execution?
A heap overflow in PDF parsing permits arbitrary code execution, requiring user interaction with a malicious document to trigger the exploit.
Vulnerabilities
How does cifs-utils mount-option injection affect your systems?
A vulnerability in cifs-utils versions 4.2 through 7.8 allows local privilege escalation via mount-option injection, with a fix available in version 7.9.
Vulnerabilities
Is Your Crafty Controller Audit Log Vulnerable to Stored XSS?
A critical output escaping flaw in Crafty Controller allows remote attackers to inject scripts via HTTP headers, exposing all versions up to 4.10.8.
Vulnerabilities
Does Search Regex Plugin Vulnerability Permit Code Execution?
The WordPress Search Regex plugin allows authenticated users to inject PHP objects, risking code execution via a deserialization flaw in version 3.5.
Vulnerabilities
Does X.Org Server Buffer Overflow Expose Local Privilege Escalation?
A heap-based flaw in X.Org Server allows local attackers to gain root access after executing low-privileged code on the system.
Vulnerabilities
Is your FortiSandbox vulnerable to authenticated denial-of-service?
Fortinet has released a patch for a flaw that allows remote attackers to crash the system after logging in.
Vulnerabilities
Does Your Vert.x App Vulnerable to HTTP Request Smuggling?
Eclipse Vert.x HTTP decoder flaw allows header confusion, enabling request smuggling in versions 5.0, 5.1, and 5.2. Teams must check for affected builds.
Vulnerabilities
Does Gitingest symlink flaw expose server files to unauthenticated access?
An unauthenticated file-read flaw in Gitingest versions up to 0.3.1 allows attackers to retrieve server files via crafted blob URLs.
Vulnerabilities
Can attackers bypass FileRise TOTP limits to guess second factors?
High-severity flaw in FileRise < 3.23.0 allows credential holders to reset TOTP attempt counts via session manipulation.
Vulnerabilities
Will Your Eclipse Vert.x App Crash? Malicious PostgreSQL Servers Trigger Heap Exhaustion in Versions Up to 5.2.0
A high-severity flaw in Eclipse Vert.x allows remote servers to crash clients via heap exhaustion, affecting versions up to 5.2.0.
Vulnerabilities
Does PAN-OS DoS flaw CVE-2026-0317 expose your management interfaces?
Palo Alto Networks confirms a low-severity denial of service vulnerability in PAN-OS requiring read-only admin access via crafted API requests.
Vulnerabilities
Does GYM One <1.4.1 Risk Admin Privilege Escalation via Stored XSS?
A high-severity flaw in GYM One allows attackers to inject scripts that run with administrator privileges.
Vulnerabilities
Is your Tianji instance vulnerable to SQL injection via timezone header?
Authenticated users can exploit CVE-2026-55239 in Tianji versions below 1.31.29 to execute arbitrary SQL against the shared database.
Vulnerabilities
Will CVE-2026-84731 Allow Attackers to Seize Full Administrative Control of Nutanix AOS Clusters via Crafted Headers?
A critical flaw in Prism Element allows attackers to bypass authentication and gain full administrative control via crafted headers.
Vulnerabilities
How does Wavlink's api.cgi heap overflow fix resolve CVE-2026-110958?
A critical flaw in older Wavlink router firmware allows remote heap overflow attacks via a public exploit, with a vendor patch now available to resolve the issue.
Vulnerabilities
Can AI agents upgrade vulnerable dependencies without breaking builds?
Snyk research shows specialised agents achieve higher success rates in fixing vulnerable packages while maintaining build stability.
Vulnerabilities
Does your Komodo Periphery agent allow root command injection via container names?
Komodo Periphery versions up to 2.2.0 contain an OS command injection flaw that allows authenticated non-admin users to execute arbitrary commands as root on the host server.
Vulnerabilities
Can attackers hijack Znuny accounts by forging HTTP headers in vulnerable versions?
Znuny versions before 7.3.7 and 6.5.25 contain a critical authentication bypass that lets attackers impersonate any user via a forged HTTP request header.
Vulnerabilities
Does Visio Heap Overflow CVE-2026-102856 Expose Enterprise Environments?
Microsoft confirms a high-severity remote code execution flaw in Visio, affecting LTSC and Microsoft 365 users who have not applied recent security updates.
Vulnerabilities
Does SharePoint CVE-2026-102866 Expose Your Server to Privilege Escalation?
Microsoft confirms a high-severity flaw in SharePoint Server allows remote attackers to bypass cryptographic checks and gain elevated privileges.
Vulnerabilities
Which Windows 10 and 11 builds face high-severity WebDAV privilege escalation risk?
An authorized attacker can elevate privileges via a high-severity WebDAV flaw in Windows 10 and 11, affecting several supported versions.
Vulnerabilities
Does Junos OS BGP Flaw CVE-2026-33789 Expose Your Routers to Root Access?
A critical buffer overflow in Juniper Junos OS allows unauthenticated BGP peers to execute commands when BMP is enabled.