Rockwell Automation Allen-Bradley Stratix 5950 Improper Input Validation (CVE-2018-0231)

A vulnerability in the Transport Layer Security TLS library of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a reload of the affected device, resulting in a denial of service DoS condition...

Cisco ASA OS Command Injection (CVE-2020-3167)

A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...

Atlassian Jira < 9.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JRASERVER-79546)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-79546 advisory. - h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,...

Atlassian Jira Service Management Data Center and Server < 5.12.40 / 10.3.x < 10.3.26 / 11.3.x < 11.3.12 (JSDSERVER-16809)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16809 advisory. - This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Da...

Spring Office Hours Podcast: S5E25 - Future of Software Development with Josh Long

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by the legendary Josh Long. In this episode, we will look into the future of software development. We will also address at least one hot take that recently made the round...

CVE-2026-105773: Concurrent Execution using Shared Resource with Improper Synchronization

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...

CVE-2026-21589: Files or Directories Accessible to External Parties

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...

Characterizing Security Effects of OSS Vulnerabilities in Agent Systems

Software agents increasingly depend on open-source components when executing tools and interacting with external systems. Security flaws in these dependencies may therefore influence more than the software process in which they occur: their consequences can be carried through tool outputs, agent...

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat...

PAN-OS Management Web Interface - Authentication Bypass

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

PRTG Network Monitor - Local File Inclusion

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges including administrator. A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local...

PT-2026-106255

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center versions 4.6.0 through 9.4.25, 10.2.7, and 10.5.0 Confluence Data Center versions 5.10.0 through 9.2.25 and 10.2.18 Crowd Data Center versions 2.11.0 through 6.3.6, 7.0.2, 7.1.6, and 7.2.3 Jira Software Data Center versio...

CVE-2026-85215: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09...

CVE-2026-47519

A flaw was found in nvidia-vgpu-software's Virtual GPU vGPU Manager for Linux. A local user with basic privileges can trigger an out-of-bounds read in the kernel-mode driver, accessing memory outside designated boundaries. A successful exploit could allow the attacker to execute arbitrary code,...

CVE-2026-63686

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...

CVE-2026-63292

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

CVE-2026-48005

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver...

How Financial Services Companies Can Modernize Their Software Supply Chain

Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else...

CVE-2026-103264

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...