Vulnerabilities
Argo CD PostDelete Hook Flaw Bypasses Auth Checks
A critical vulnerability in Argo CD allows Git users to create unauthorized Kubernetes resources by bypassing authorization during deletion events.
Sandbox Dispatch Flaw Tracker Desk
The Sandbox Dispatch Flaw Tracker Desk is the part of the Sandbox Dispatch newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 20 articles so far. See the editorial policy or report an error.
Vulnerabilities
How Does SWUpdate CVE-2026-109399 Bypass Certificate Checks?
A critical flaw in SWUpdate allows attackers to install malicious firmware by exploiting improper validation of sibling intermediate certificates.
Vulnerabilities
Why do specific TLS settings disable HAProxy Data Plane API authentication for critical CVE-2026-109575?
A critical flaw in HAProxy Data Plane API allows unauthenticated access to administrative functions when specific TLS settings are active.
Vulnerabilities
How a Leaked Flask Secret Enabled Remote Code Execution on Google Dev Sites
A researcher found that Google developer documentation sites used an OAuth secret as a Flask session key, allowing forged cookies to trigger arbitrary code execution.
Vulnerabilities
Does D-Link DCS-930L Firmware Recovery Flaw Require Immediate Network Action?
A critical CVE-2026-108971 allows remote signature bypass on D-Link DCS-930L cameras, with public exploit code now available.
Vulnerabilities
Does Wavlink WL-WN530BE1-A Firmware Have a Critical Remote Command Injection Flaw?
A CVSS 9.4 vulnerability in Wavlink router firmware allows remote OS command injection via a CGI script, with public exploits available and no confirmed patch.
Vulnerabilities
Metasploit Web Service Exposes Credentials Without Authentication
A critical flaw in the Metasploit Framework allows attackers to steal or delete stored credentials without logging in, affecting all versions prior to 6.5.5.
Vulnerabilities
Can Linux AnyDesk Users Below 8.0.3 Be Compromised by Critical CVE-2026-109390?
A critical flaw in AnyDesk versions prior to 8.0.3 enables remote attackers to run code as root on Linux without user approval, scoring 9.8 on the CVSS scale.
Vulnerabilities
Why do subscribers pose a CVSS 9.9 threat to CodeBard Help Desk via CVE-2026-62024?
The NVD rates this arbitrary file upload flaw in CodeBard Help Desk versions up to 1.1.2 as critical due to the low privilege required for exploitation.
Vulnerabilities
What is the 9.5-severity NetScaler RCE risk?
Citrix urges immediate patching for a 9.5-severity remote code execution flaw in NetScaler ADC and Gateway products, though exploitation status remains unclear.
Vulnerabilities
How Does CVE-2026-62045 Endanger Booklovers WordPress Sites With Untrusted Data Deserialization?
A critical CVE-2026-62045 flaw in the Booklovers WordPress theme allows unauthenticated object injection through version 2.13.0, posing severe risks to site integrity.
Vulnerabilities
How can attackers seize full server control of your WordPress site with just one unauthenticated POST request?
A critical vulnerability in the 3D Product Configurator plugin lets attackers run server code without login credentials, posing severe risks to WordPress sites.
Vulnerabilities
Will Your Site Fall Victim To The Critical Let's Play Plugin Vulnerability?
A CVSS 9.8 vulnerability in the Let's Play plugin allows object injection, posing severe risks to websites using versions up to 1.1.15.
Vulnerabilities
How does Advanced IP Blocker flaw CVE-2026-104732 let attackers bypass 2FA to seize WordPress admin control?
A critical authentication bypass in the Advanced IP Blocker plugin allows unauthenticated attackers to brute-force 2FA codes and seize full admin control of WordPress sites.
Vulnerabilities
Avada Builder Critical Bypass Lets Attackers Destroy WordPress Sites
Unauthenticated users can trigger arbitrary hooks in Avada Builder 7.16.1, causing permanent content deletion and denial of service without a login.
Vulnerabilities
How do forged TinaCMS preview iframes let attackers run GraphQL mutations with editor credentials?
A critical vulnerability in TinaCMS allows attackers to forge preview iframes and execute GraphQL mutations using a logged-in editor's credentials.
Vulnerabilities
What Critical Risk Does Missing Authentication Pose to Azure App Service for Linux?
A missing authentication flaw in Azure App Service for Linux allows unauthenticated remote code execution, posing severe risks to organizational security.
Vulnerabilities
How do pipe-free lines in commonmark tables cause quadratic CPU scans in PHP apps?
Unauthenticated inputs can trigger repeated buffer scans in the commonmark library, leading to high-severity denial of service attacks on PHP workers.
Vulnerabilities
Can Attackers Run OS Commands via image_optimizer Gem's Identify Option in CVE-2026-107704?
A severe vulnerability in the image_optimizer Ruby gem allows attackers to execute arbitrary OS commands via crafted file paths.
Vulnerabilities
Can SageMaker SDK flaws let attackers run tampered ML models by bypassing integrity checks?
Two vulnerabilities in the SageMaker Python SDK allow attackers to bypass integrity verification, potentially leading to the execution of tampered machine learning models.