Vulnerabilities
Siemens Industrial Edge Device Kit Flaw Allows Unauthorized Internal API Access
A critical CVE in Siemens Industrial Edge Device Kit versions through 1.15 permits authenticated attackers to access restricted internal APIs.
Critical Vulnerability
Everything Threat Times has reported about Critical Vulnerability: 21 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
SAP S/4HANA Rule Processing Flaw Allows Arbitrary ABAP Code Execution
A critical vulnerability in SAP S/4HANA allows authenticated attackers with specific privileges to execute arbitrary ABAP code via crafted input.
Vulnerabilities
IBM DataStage on Cloud Pak for Data Has Critical Remote Info Leak
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a critical flaw allowing remote authenticated attackers to access sensitive information.
Vulnerabilities
IBM i HTTP Server Admin Flaw Rated Critical, Allows Remote Code Execution
A critical vulnerability in IBM i versions 7.3 through 7.6 enables authenticated attackers to execute arbitrary code via improper data sanitization.
Vulnerabilities
IBM Db2 Mirror for i Faces Critical Privilege Escalation Flaw
A critical vulnerability in IBM Db2 Mirror for i allows authenticated attackers to bypass checks and execute code with elevated privileges.
Vulnerabilities
Grav Login OAuth Plugin Vulnerability Allows Unauthenticated Admin Access
A critical flaw in the Grav Login OAuth plugin enables attackers to guess credentials and seize administrative control of affected websites.
Vulnerabilities
MarkLogic Server Flaw Allows Code Execution Without Extra Privileges
A critical vulnerability in Progress MarkLogic Server lets attackers with query access run code with elevated permissions, according to NVD data.
Vulnerabilities
Critical Flaw in MarkLogic Server Lets Admins Access Data Outside Scope
Progress MarkLogic Server versions before 11.3.7 and 12.1.0 contain a critical vulnerability allowing privileged users to manipulate data beyond authorized limits.
Vulnerabilities
Critical OS Command Injection Flaw Found in Linksys E1700 Firmware
A CVSS 9.4 critical vulnerability in Linksys E1700 firmware allows remote OS command injection via the DMZ function, with no vendor response reported.
Vulnerabilities
OTRS Community Edition 6 Has Critical Authentication Bypass Vulnerability
A critical flaw in OTRS Community Edition 6 allows remote attackers to bypass authentication and impersonate users without valid credentials.
Vulnerabilities
Critical Privilege Escalation Flaw Found in Sergey AIWU Versions Up to 1.5.9
The National Vulnerability Database lists CVE-2026-39801 as a critical severity issue allowing subscriber privilege escalation in AIWU software.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw Rated Critical in Kalles CMS
A critical vulnerability in Kalles CMS versions up to 1.1.7.1 allows unauthenticated attackers to inject PHP objects, posing significant security risks.
Vulnerabilities
Critical Deserialization Flaw Found in Axiomthemes Veto Plugin Up to 1.6.0
The National Vulnerability Database rates CVE-2026-93927 as critical, warning that untrusted data deserialization allows object injection in Axiomthemes Veto.
Vulnerabilities
TinaCMS Patch Fixes Critical Auth Bypass in Admin Preview Route
A critical vulnerability in TinaCMS allows attackers to hijack editor sessions via crafted links, but a patch is now available for affected versions.
Vulnerabilities
Astron Agent Critical Flaw Allows Low-Privilege Users to Execute Code as Root
A critical vulnerability in Astron Agent versions prior to 1.1.2 enables authenticated users to bypass tenant isolation and execute arbitrary code with root privileges.
Vulnerabilities
Citrix Urges Immediate Patching for New NetScaler Remote Code Execution Vulnerability
Citrix warns administrators to immediately patch NetScaler ADC and Gateway appliances to address a newly disclosed critical remote code execution flaw.
Vulnerabilities
Critical Pingvin Share X Flaw Allows Unauthenticated Admin Account Takeover
A critical vulnerability in Pingvin Share X permits attackers to bypass authentication and seize control of user accounts, including administrative roles.
Vulnerabilities
Critical Account Takeover Flaw Found in PHPNuxBill Password Reset Flow
Unauthenticated attackers can brute-force OTP codes in PHPNuxBill to hijack customer accounts without triggering lockouts or rate limits.
Vulnerabilities
Critical Web Shell Upload Vulnerability Found in PX-lab Zombify Plugin
A critical security flaw in PX-lab Zombify allows attackers to upload malicious web shells, affecting versions up to 1.7.7.
Vulnerabilities
IBM Guardium Data Protection Has Critical Unauthenticated Remote Code Execution Flaw
A CVE-9.8 rated vulnerability in IBM Guardium allows attackers to run arbitrary container images without credentials.
Vulnerabilities
IBM DataPower Gateway Faces Critical Remote Code Execution Flaw
A heap-based buffer overflow in IBM DataPower Gateway allows unauthenticated remote attackers to execute arbitrary code on affected systems.