Vulnerabilities
PraisonAI Fixes Critical Auth Bypass in Agent Teams Before 1.6.59
Unauthenticated users could exploit missing access controls in PraisonAI to enumerate agents and trigger workflows remotely.
Threat Times Exposure Desk
Vulnerabilities
Wordfence Argus Finds Critical Ghostscript Flaw Allowing Remote Code Execution
A heap buffer overflow in Ghostscript allows attackers to execute code remotely via crafted PDFs, according to new research from Wordfence.
Vulnerabilities
Critical Command Injection Flaw Found in Unsupported Edimax BR-6208AC Router Firmware
Public exploit available for CVE-2026-108918 allows remote attackers to execute commands on Edimax routers running firmware version 1.32.
Vulnerabilities
Obsidian-TC Critical Flaw Allows Cross-Vault Data Theft Before 1.3.1
A critical authorization bypass in obsidian-tc versions prior to 1.3.1 lets attackers access any vault with a single valid token.
Vulnerabilities
Edimax BR-6208AC 1.32 Has Critical Remote Code Injection Flaw
A critical vulnerability in Edimax BR-6208AC firmware allows remote attackers to inject commands via a file upgrade form.
Vulnerabilities
Public exploit targets unpatched buffer overflow in Edimax BR-6208AC router firmware
A critical remote buffer overflow in the Edimax BR-6208AC has a known public exploit, with the vendor failing to respond to early contact.
Vulnerabilities
Grav Login OAuth Plugin Vulnerability Allows Unauthenticated Admin Access
A critical flaw in the Grav Login OAuth plugin enables attackers to guess credentials and seize administrative control of affected websites.
Vulnerabilities
Edimax BR-6208AC Vulnerability CVE-2026-108914 Allows Remote Exploitation via Buffer Overflow
A critical remote buffer overflow in Edimax BR-6208AC firmware 1.32 enables public exploit use, affecting unsupported devices with no vendor response.
Vulnerabilities
UK expands AI vulnerability scanning program after pilot finds 407 flaws
The British government will extend a frontier AI security pilot that identified hundreds of weaknesses in public sector code at low cost.
Vulnerabilities
Crawl4AI 0.9.4 Patch Fixes Critical SSRF Flaw in Web Scraping Library
The National Vulnerability Database rates CVE-2026-109238 as critical because attackers can force the tool to fetch internal network resources.
Vulnerabilities
Netcore NR268 Router Has Critical Remote Auth Bypass Vulnerability CVE-2026-108907
Netcore NR268 firmware 1.7.121109 contains a critical improper authentication flaw in CGI execution that allows remote attacks.
Vulnerabilities
MarkLogic Server Flaw Allows Code Execution Without Extra Privileges
A critical vulnerability in Progress MarkLogic Server lets attackers with query access run code with elevated permissions, according to NVD data.
Vulnerabilities
Critical Flaw in MarkLogic Server Lets Admins Access Data Outside Scope
Progress MarkLogic Server versions before 11.3.7 and 12.1.0 contain a critical vulnerability allowing privileged users to manipulate data beyond authorized limits.
Vulnerabilities
Critical MarkLogic Server Flaw CVE-2026-9191 Allows Session Hijacking
Progress MarkLogic Server versions before 12.1.0 and 11.3.7 contain a critical isolation flaw that permits attackers to compromise authenticated sessions.
Vulnerabilities
Progress MarkLogic Server Authorization Flaw Allows Remote Admin Takeover
A critical authorization flaw in Progress MarkLogic Server lets attackers with forest-management privileges create unauthorized administrator accounts and seize full server control.
Vulnerabilities
Progress patches MarkLogic Server to fix critical CVE-2026-85948 XQuery injection vulnerability
Progress releases updates for MarkLogic Server to address a critical vulnerability that allows remote attackers to seize persistent administrative control.
Vulnerabilities
Neo4j GraphQL Library Fixes Critical Authentication Bypass in Version 7.6.4
A critical flaw in Neo4j’s GraphQL library allowed unauthenticated users to execute Cypher queries, a vulnerability now patched in version 7.6.4.
Vulnerabilities
Critical Deserialization Flaw in Square Squash Allows Remote Code Execution
An unauthenticated attacker can trigger arbitrary Ruby code execution in Square Squash by storing crafted YAML data via a public API endpoint.
Vulnerabilities
Thirty bees 1.7.0 authentication bypass allows guest account takeover
A critical flaw in Thirty bees enables attackers to reset customer passwords using guest checkout tokens, affecting versions through 1.7.0.
Vulnerabilities
SWUpdate flaw allows malicious updates via improper certificate validation
A critical vulnerability in SWUpdate permits attackers to install malicious firmware by bypassing certificate trust checks through embedded intermediates.
Vulnerabilities
AnyDesk Heap Overflow Flaw Allows Unauthenticated Root Code Execution
A critical vulnerability in AnyDesk versions prior to 8.0.3 enables unauthenticated remote attackers to execute arbitrary code as root on Linux systems without user approval.
Vulnerabilities
CERT/CC Details 8 Thelia 2.6 Flaws Enabling RCE, XSS and Admin Account Enumeration
The CERT/CC advisory details eight vulnerabilities in Thelia 2.6.0 and 2.6.1 that enable remote code execution, cross-site scripting, and account enumeration.
Vulnerabilities
GitLab Patches Critical Remote Code Execution Flaw in CI/CD Regex Compiler
GitLab released urgent updates on October 12 to fix a maximum-severity vulnerability allowing unauthenticated attackers to run arbitrary code on servers.
Vulnerabilities
Critical OS Command Injection Flaw Found in Linksys E1700 Firmware
A CVSS 9.4 critical vulnerability in Linksys E1700 firmware allows remote OS command injection via the DMZ function, with no vendor response reported.