Vulnerabilities
Pillow CVE-2026-112897 leaks heap memory via crafted TIFF images
Uninitialised memory in Pillow versions before 13.0.0 is exposed as image pixels when processing specific TIFF files, allowing data disclosure.
RedTeam Log CVE Desk
The RedTeam Log CVE Desk is the part of the RedTeam Log newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 72 articles so far. See the editorial policy or report an error.
Vulnerabilities
IBM App Connect Enterprise Critical CVE-2026-92559 Enables Remote Sensitive Data Theft via Unrestricted Network Bindings
A critical flaw in IBM App Connect Enterprise allows remote attackers to steal sensitive information through unrestricted network bindings.
Vulnerabilities
OpenStack Manila Cross-Project Share Manipulation Enables Data Exfiltration
Authenticated users can hijack public shares, altering access rules and backing up data without owner permission in vulnerable versions.
Vulnerabilities
Totolink X2000R HTTP Update Flaw Lets Authenticated Users Replace System Software Without Verification
A critical flaw in the X2000R router lets anyone with login access replace system software without cryptographic verification.
Vulnerabilities
Totolink X2000R Mcli Stack Overflow Grants Authenticated Remote Code Execution
A critical stack-based buffer overflow in the Mcli feature of this router allows authenticated attackers to run arbitrary code on the device.
Vulnerabilities
PHP RCE flaws leak early: Teams urged to prep for Oct 21 patches amid 9.2 severity risk
Security teams urge immediate preparation for critical PHP updates after embargoed vulnerability details leak ahead of scheduled release.
Vulnerabilities
Totolink X2000R boa web server stack overflows enable arbitrary code execution with CVSS 9.1 critical rating
Authenticated attackers can exploit stack overflows in the X2000R router’s boa web server to run arbitrary code on the device.
Vulnerabilities
Totolink X2000R PPPoE DNS Flaws Grant Authenticated Users Critical Code Execution Access
Flaws in firmware allow attackers with login access to run arbitrary code via malformed requests to the PPPoE DNS setup function.
Vulnerabilities
Oracle EBS TCF Servlets Vulnerable to Unauthenticated RCE in Versions 12.2.3-15
Horizon3 researchers found a critical flaw in Oracle EBS TCF servlets that lets attackers run code without credentials.
Vulnerabilities
Apache Tomcat Buffer Under-Read May Leak Data Between Requests
A flaw in Apache Tomcat could cause response data to bleed into subsequent requests, risking information disclosure for unpatched servers.
Vulnerabilities
DrayTek Vigor2960 Command Injection Patch Released Amid Persistent Public Exploit Risk for End-of-Support Units
A critical remote code execution flaw in end-of-support DrayTek routers has been patched, but public exploits remain a risk for unupdated devices.
Vulnerabilities
Eptura Archibus Auth Bypass and RCE Vulnerabilities Grant Unauthenticated Database Access
Rapid7 found three vulnerabilities in Eptura Archibus allowing unauthenticated remote code execution and full database access.
Vulnerabilities
Eptura Archibus Critical Upload Bug Permits Server Command Execution Before 2025.02 Patch
Attackers can run server commands via uploaded files in Eptura Archibus versions before the 2025.02 update, exploiting a critical flaw rated 9.6 by NVD.
Vulnerabilities
Letta RCE Flaw: Insecure Defaults in v0.16.8 Enable Unauthenticated Code Execution and DB Access
A critical flaw in Letta allows remote attackers to execute code and access databases without credentials due to insecure default settings.
Vulnerabilities
GitHub Prototype Pollution and SSRF Patches Broken 4x More Likely to Reach CISA's Exploit List
Terra Security reports that nearly 2.3% of GitHub patches are broken within three months in 2026, a significant jump from previous years.
Vulnerabilities
H3C Magic NX15 OS Command Injection CVE-2026-112370: Public Exploit Code Fuels Critical RCE Threat
A critical OS command injection flaw in H3C Magic NX15 firmware allows remote exploitation, with public exploit code available for use.
Vulnerabilities
Craft CMS Token Flaw Risks Cross-Site Data Mutation in Pre-5.11.0 Versions
A critical flaw in Craft CMS allows attackers to use valid tokens from one site to alter content on another, affecting versions prior to 5.11.0.
Vulnerabilities
FlyCms Critical CVE-2026-112296 Hardcoded Credentials Flaw Enables Unauthenticated Full Site Control
A critical vulnerability in FlyCms allows unauthenticated users to seize full site control using hardcoded login details and a simple captcha challenge.
Vulnerabilities
NetScaler RCE CVE-2026-88771: Unauthenticated Access Grants Full Control
Attackers exploit a critical flaw in NetScaler ADC and Gateway to execute commands without credentials, prompting urgent global patching efforts.
Vulnerabilities
Broadcom WPS Reassembly Bug: 2010 Flaw Enables Unauthenticated Router Control
A legacy vulnerability in Broadcom’s Wi-Fi setup code allows attackers to seize control of routers without passwords, affecting millions of devices.
Vulnerabilities
Nextcloud richdocumentscode flaw grants unauthenticated RCE on servers with stopped CODE
Attackers gain system command execution on Nextcloud servers via a flaw in the Collabora app, requiring no login credentials.
Vulnerabilities
ELEX HelpDesk Plugin Permits Remote Code Execution via Unchecked File Uploads
Unauthenticated attackers can run arbitrary code on WordPress sites using the ELEX HelpDesk plugin, rated CVSS 9.8 by the NVD.
Vulnerabilities
Tektronix 3 Series MDO OS Command Injection: Urgent Firmware Check Required for Lab Environments
Remote attackers can execute system commands on affected oscilloscopes, demanding urgent firmware checks for managed lab environments.
Vulnerabilities
AWS tough and tuftool flaws allow repository tampering
Attackers can compromise TUF metadata integrity using unpatched versions of AWS’s tough library and tuftool utility, requiring immediate upgrades.