A high-severity heap out-of-bounds write in FreeRDP versions prior to 3.32.0 enables unauthenticated attackers to exploit the NTLM authentication path without needing valid credentials.
An authenticated command injection flaw in ZoneMinder versions before 1.39.2 allows arbitrary code execution via monitor device paths, posing a high risk to CCTV environments.
A high-severity heap buffer overflow in GPAC’s MP4Box allows attackers to manipulate sample metadata, requiring user interaction to trigger the flaw in affected builds.
Attackers can execute code on WordPress sites running ELEX HelpDesk v3.3.7 or earlier by uploading executable files via email attachments.
A flaw in FastapiAdmin through version 3.0 exposes a static signing key, enabling registered users to forge tokens and assume superuser privileges.
Authenticated users with migration rights in older Countly server versions can trigger recursive file deletion outside intended directories, risking data loss.
A critical flaw in MariaDB allows remote attackers to corrupt memory via crafted GIS objects, risking code execution in unpatched server versions.
Progress released patches for 12 MOVEit Transfer vulnerabilities, including high-severity authentication bypass and privilege escalation flaws.
A low-severity flaw in Apache Kylin versions 4.0.0 through 5.0.4 leaves default startup profiles without required security settings, exposing misconfigured deployments.
A high-severity flaw in kin-openapi allows unauthenticated users to bypass security checks by manipulating URL encoding, affecting versions prior to the recent patch.
A high-severity vulnerability in X.Org Server allows local attackers to gain root access through improper data validation in XKB handling.
Attackers compromise CI/CD pipelines by injecting malicious code into build artifacts, bypassing application security controls entirely and gaining persistent access to production environments.
You must assume the host kernel is compromised because a container escape grants direct access to underlying system resources and processes.
Network traffic patterns and server resource spikes often reveal exploitation attempts before standard intrusion detection systems flag the specific protocol anomalies.
Unsupported software creates a permanent attack surface that no firewall can close, requiring a structured lifecycle to prevent silent data exposure.
Properly tuning your web application firewall reduces false positives by isolating traffic patterns and validating rule triggers against known application behavior.
Heap overflows corrupt program control by poisoning adjacent metadata rather than overwriting the instruction pointer directly, creating a silent failure mode that standard stack protections ignore entirely.
Server-side template injection allows attackers to execute arbitrary code by tricking the server into processing user input as executable template logic rather than static text.
OpenSSH flaws often stem from configuration errors rather than code bugs, meaning default settings frequently expose systems to remote code execution without any exploit code needed.
Most AI serving flaws stem from unchecked input parsing and container misconfigurations, not the model weights themselves.
Misconfigured sudoers files often grant implicit root access through environment variable inheritance, bypassing standard privilege separation controls.
Java deserialization flaws allow attackers to execute arbitrary code on your server without needing credentials or finding other entry points.
CERT/CC reports inconsistencies in how thirteen TLS libraries enforce X.509 name constraints, creating potential delegation bypass risks across diverse software stacks.
Attackers can execute code on WooCommerce sites by uploading PHP files through a bypassed Google Drive integration endpoint without logging in.