A high-severity heap out-of-bounds write in FreeRDP versions prior to 3.32.0 enables unauthenticated attackers to exploit the NTLM authentication path without needing valid credentials.
An authenticated command injection flaw in ZoneMinder versions before 1.39.2 allows arbitrary code execution via monitor device paths, posing a high risk to CCTV environments.
A high-severity heap buffer overflow in GPAC’s MP4Box allows attackers to manipulate sample metadata, requiring user interaction to trigger the flaw in affected builds.
Attackers can execute code on WordPress sites running ELEX HelpDesk v3.3.7 or earlier by uploading executable files via email attachments.
A flaw in FastapiAdmin through version 3.0 exposes a static signing key, enabling registered users to forge tokens and assume superuser privileges.
Authenticated users with migration rights in older Countly server versions can trigger recursive file deletion outside intended directories, risking data loss.
A critical flaw in MariaDB allows remote attackers to corrupt memory via crafted GIS objects, risking code execution in unpatched server versions.
Progress released patches for 12 MOVEit Transfer vulnerabilities, including high-severity authentication bypass and privilege escalation flaws.
A low-severity flaw in Apache Kylin versions 4.0.0 through 5.0.4 leaves default startup profiles without required security settings, exposing misconfigured deployments.
A high-severity flaw in kin-openapi allows unauthenticated users to bypass security checks by manipulating URL encoding, affecting versions prior to the recent patch.
A high-severity vulnerability in X.Org Server allows local attackers to gain root access through improper data validation in XKB handling.
CERT/CC reports inconsistencies in how thirteen TLS libraries enforce X.509 name constraints, creating potential delegation bypass risks across diverse software stacks.
Attackers can execute code on WooCommerce sites by uploading PHP files through a bypassed Google Drive integration endpoint without logging in.
Security advisories on October 13, 2026, identify six vulnerabilities in Citrix XenServer and UniconOS, requiring immediate attention from infrastructure administrators.
A high-severity stack-based buffer overflow in SQL Server allows network-based privilege escalation for attackers who already have authorization.
A high-severity heap-based buffer overflow in Office Access lets remote attackers run code without authentication, affecting specific LTSC and M365 builds.
Microsoft confirms a heap-based buffer overflow in the Windows Media Video Decoder allows remote code execution on multiple operating system versions.
Cisco releases critical hardening updates for its email gateway after internal testing revealed two vulnerabilities currently under active exploitation in the wild.
A stack-based buffer overflow in Juniper SRX devices permits unauthenticated attackers to run code as root or disrupt service via GRE tunnels.
A severe flaw in the git-diff package allows attackers to run arbitrary shell commands via crafted diff strings, affecting versions prior to 2.0.7.
Fortinet disclosed a critical flaw in October 2026 that allows remote attackers to bypass GUI authentication and execute unauthorized code on vulnerable appliances and PaaS instances.
Microsoft confirms a heap-based buffer overflow in Windows Error Reporting allows remote attackers to execute code without authentication.
Microsoft confirms a heap-based buffer overflow in Windows Media Foundation enables remote code execution by unauthorized attackers via network access.
Attackers can exploit a high-severity flaw in Risesoft-y9 Digital-Infrastructure to write arbitrary files, potentially leading to remote code execution without authentication.