Vulnerabilities
6 Citrix Flaws Expose XenServer 8.4 and 9 in October Update
Security advisories on October 13, 2026, identify six vulnerabilities in Citrix XenServer and UniconOS, requiring immediate attention from infrastructure administrators.
Vulnerabilities
Vulnerabilities
SQL Server Buffer Overflow Flaw Lets Authorized Users Escalate Privileges
A high-severity stack-based buffer overflow in SQL Server allows network-based privilege escalation for attackers who already have authorization.
Vulnerabilities
CVSS 8.8: Unauthenticated RCE in Office Access Heap Overflow Threatens M365 and LTSC Users
A high-severity heap-based buffer overflow in Office Access lets remote attackers run code without authentication, affecting specific LTSC and M365 builds.
Vulnerabilities
CVE-2026-100220: High-Severity Media Video Decoder Flaw Hits Windows 10 and 11
Microsoft confirms a heap-based buffer overflow in the Windows Media Video Decoder allows remote code execution on multiple operating system versions.
Vulnerabilities
Two Actively Exploited Flaws Hit Cisco Email Gateway; Updates Available Now
Cisco releases critical hardening updates for its email gateway after internal testing revealed two vulnerabilities currently under active exploitation in the wild.
Vulnerabilities
CVSS 9.8: Juniper SRX GRE Tunnel Flaw Lets Attackers Run Code as Root
A stack-based buffer overflow in Juniper SRX devices permits unauthenticated attackers to run code as root or disrupt service via GRE tunnels.
Vulnerabilities
CVSS 9.3: Critical Command Injection in git-diff <2.0.7 Requires Immediate Patching
A severe flaw in the git-diff package allows attackers to run arbitrary shell commands via crafted diff strings, affecting versions prior to 2.0.7.
Vulnerabilities
9.6-rated FortiSandbox Bypass Lets Attackers Skip Login to Run Commands
Fortinet disclosed a critical flaw in October 2026 that allows remote attackers to bypass GUI authentication and execute unauthorized code on vulnerable appliances and PaaS instances.
Vulnerabilities
CVSS 9.8: Unauthenticated Windows Error Reporting Buffer Overflow Enables Remote Code Execution
Microsoft confirms a heap-based buffer overflow in Windows Error Reporting allows remote attackers to execute code without authentication.
Vulnerabilities
CVE-2026-85814: Critical Heap Overflow in Windows Media Foundation Allows Network-Based RCE
Microsoft confirms a heap-based buffer overflow in Windows Media Foundation enables remote code execution by unauthorized attackers via network access.
Vulnerabilities
How Security Misconfigurations Work: Step-by-Step Exploitation Path
Default settings and forgotten permissions create open doors that attackers exploit without needing to break encryption or inject malicious code into your software.
Vulnerabilities
Unauthenticated Path Traversal in Risesoft-y9 v9.6.5-9.6.11 Allows Arbitrary File Write
Attackers can exploit a high-severity flaw in Risesoft-y9 Digital-Infrastructure to write arbitrary files, potentially leading to remote code execution without authentication.
Vulnerabilities
What Causes a Buffer Overflow Vulnerability: The Memory Logic Breakdown
A buffer overflow occurs when code writes data beyond a memory block's boundary, corrupting adjacent instructions and allowing attackers to hijack execution flow.
Vulnerabilities
CVE-2026-109412: Ivanti Neurons Patch for Intune Flaw Leaks Auth Data to Remote Attackers
A critical flaw in Ivanti Neurons Patch for Intune allows remote authenticated attackers to leak sensitive authentication data via an exposed dangerous endpoint.
Vulnerabilities
Software Composition Analysis: 6 Misunderstandings That Leave You Exposed
Software composition analysis identifies known weaknesses in third-party code, but it cannot detect logical flaws or runtime configuration errors within those components.
Vulnerabilities
Obsidian-TC 9.9 Flaw Exposes All Vaults in Versions Before 1.3.1
A critical authentication bypass in obsidian-tc allows any valid user token to read, write, or delete data in any configured vault prior to version 1.3.1.
Vulnerabilities
Integer Overflow Vulnerabilities: Risks and Protection for Small Businesses
Integer overflow vulnerabilities allow attackers to bypass security checks by wrapping numbers around to negative values, enabling unauthorized memory access.
Vulnerabilities
WordPress Page Builder Vulnerabilities: What to Know
Page builders execute code on the server side, turning visual design tools into high-risk entry points for attackers who bypass standard input validation.
Vulnerabilities
CVSS 9.1: Netherman Portal's Missing Rate Limits Enable Password Reset Brute-Force Attacks
A critical authentication flaw in Netherman Portal allows unauthenticated attackers to hijack accounts by exploiting missing rate limits and verbose error messages.
Vulnerabilities
PraisionAI 1.6.59 Patches CVSS 9.8 Auth Bypass Exposing Private Context and Agent Workflows
A critical flaw in PraisonAI allows remote attackers to bypass authentication, access private context, and trigger agent workflows without any credentials.
Vulnerabilities
CVSS 9.8 Ghostscript Heap Overflow in PDFs Fixed in 10.08.0 Update by Artifex
Wordfence Argus identified a heap buffer overflow in Ghostscript that allows attackers to execute code on servers processing uploaded PDF documents.
Vulnerabilities
Crawl4AI SSRF Flaw CVSS 9.2 Exposes Internal Cloud Metadata to API Users
A critical vulnerability in Crawl4AI allows attackers to bypass network boundaries and extract sensitive internal data through manipulated web scraping requests.
Vulnerabilities
openapi-typescript-codegen Critical Flaw Allows Arbitrary JS Execution via OpenAPI Inputs
A CVSS 9.3 vulnerability in openapi-typescript-codegen lets attackers inject JavaScript through malicious OpenAPI documents, risking remote code execution in generated clients.
Vulnerabilities
CVE-2026-68582: Vikunja 2.4.0 Patches Critical IDOR Exposing User Data via Share Links
A critical identity flaw in Vikunja versions prior to 2.4.0 lets attackers use valid share links to scrape task data and user details from any project on the server.