Vulnerabilities
Microsoft Shell Zero-Day Bypasses Mark of the Web in Record Patch
Attackers exploit a Windows Shell flaw to bypass file warnings. Microsoft’s October update fixes this active threat among 1,413 vulnerabilities.
Vulnerabilities
Vulnerabilities
vlife Critical CVE-2026-110612: Hardcoded Signing Key Enables Token Forgery and Full System Control
A hardcoded signing key in vlife allows attackers to forge tokens and gain full system control without valid credentials.
Vulnerabilities
@mborne/extract Path Traversal Injection Grants Full Process Privileges Before 0.2.1
Attackers can run operating system commands via archive paths in versions before 0.2.1, gaining full process privileges.
Vulnerabilities
Juniper Junos BGP Buffer Overflow Allows Unauthenticated Root Access
A critical flaw in Juniper’s routing software lets remote attackers gain root control if monitoring is active, requiring immediate version checks.
Vulnerabilities
Juniper Junos OS Routing Daemon Stack Overflow Allows BGP Peers to Execute Root Code
A critical flaw in Juniper Junos OS routing daemons lets configured BGP peers run root code or crash services through valid route advertisements.
Vulnerabilities
Chrome Stable and Extended Stable Fix Critical Buffer Overflow and Use-After-Free Bugs
Google releases security updates for Chrome Stable and Extended Stable channels, addressing dozens of high and critical vulnerabilities.
Vulnerabilities
.NET Runtimes 8-11: Algorithmic Complexity Flaw in XML Library Patched to Prevent Network-Based DoS
Microsoft patches an algorithmic complexity vulnerability in .NET runtimes that allows unauthenticated network-based denial of service attacks.
Vulnerabilities
Windows SmartScreen Use-After-Free CVE-2026-85851 Allows Silent Local Privilege Escalation
A memory error in Windows SmartScreen allows local attackers to raise their access level without user interaction, prompting urgent patching.
Vulnerabilities
Coruna and DarkSword kits breach iOS sandbox to harvest credentials
Exploit chains allow attackers to bypass browser restrictions and steal sensitive data from iPhones through a single web visit.
Vulnerabilities
Collabora Online CODE Server Restart Command Injection Enables Full System Control
Attackers exploited a command injection bug in the built-in server during restarts, gaining full control of affected Nextcloud systems.
Vulnerabilities
Snazzy Social Media Feed RCE Risk: Subscriber Access Triggers Critical Upload Flaw
Authenticated users with low-level access can execute code on sites using Snazzy Social Media Feed versions up to 2.5 via a missing security check.
Vulnerabilities
Windows DNS Heap Buffer Overflow Enables Critical Remote Code Execution
An unpatched flaw in Microsoft’s DNS service allows remote attackers to run code, rated critical with a CVSS score of 9.8.
Vulnerabilities
Microsoft Shell Bypass and Critical RCE Flaws in October 2026 Patch
Microsoft releases updates for 1,415 flaws including an exploited Windows Shell bypass and critical remote code execution vulnerabilities across its ecosystem.
Vulnerabilities
Adobe ColdFusion Input Validation Bug Risks Remote Code Execution Without User Action
A critical input validation flaw in Adobe ColdFusion allows attackers to run code on servers without any user action required.
Vulnerabilities
Adobe ColdFusion Critical Auth Error Permits Remote Code Execution in Versions 2023 and 2025
A critical authorization error in ColdFusion allows low-privileged attackers to run arbitrary code without interacting with users.
Vulnerabilities
What Is EPSS Score: Predicting Exploit Risk for Faster Patching
The EPSS score separates the noise of thousands of vulnerabilities from the few that attackers actually exploit in the wild, allowing you to prioritise remediation based on real-world threat behaviour rather than theoretical severity.
Vulnerabilities
How a Software Bill of Materials Works: The Mechanism and Limits
An SBOM reveals the hidden supply chain depth of your software, exposing third-party risks that signature-based scanners miss entirely during deployment.
Vulnerabilities
Windows Message Queuing Vulnerability Enables Remote Code Execution Without Authentication on Multiple Versions
A critical vulnerability in Windows Message Queuing allows attackers to run code remotely without authentication, affecting multiple Windows versions.
Vulnerabilities
Ivanti Connect Secure spoofing flaw allows remote command execution without credentials in versions before 25.1.3.0
Attackers exploited a spoofing flaw in Ivanti VPN gateways to run commands without login credentials, affecting limited customers.
Vulnerabilities
Web Cache Deception vs Web Cache Poisoning: The Critical Difference
Cache deception steals session tokens by tricking servers into caching sensitive pages, while cache poisoning injects malicious code into benign responses for all users.
Vulnerabilities
Integer Overflow Prevention Checklist for Secure Software Development
Integer overflow errors bypass security controls by wrapping arithmetic results, allowing attackers to allocate negative memory sizes or skip authentication checks.
Vulnerabilities
Emergency Patching: Correcting Five Common Operational Errors
Emergency patching often fails because organisations treat speed as the only metric, ignoring the structural risks of bypassing standard validation and rollback procedures.
Vulnerabilities
PHP Object Injection: Exploitation, Mitigation and Code Audit
Deserialisation of untrusted data allows attackers to execute arbitrary code by triggering magic methods during object reconstruction in PHP applications.
Vulnerabilities
Wazuh Case-Sensitivity Logic Error Grants Root Privileges to Authenticated Manager Users
A logic error in Wazuh manager lets authorised users bypass controls to run root commands on agents, rated critical by security researchers.