Tag
#vulnerability
EPICS Base Heap Overflow, Fixed in 7.0.11 (CVE-2026-114595)
Unauthenticated Channel Access messages corrupt memory in EPICS Base 7.0.10 and earlier; the batch is fixed in 7.0.11, and no exploitation is known.
Nov 03, 2026
Telerik UI for ASP.NET AJAX File Read to RCE Chain (CVE-2026-18672)
Telerik UI for ASP.NET AJAX reads web.config unauthenticated and chains to RCE on sites with stat...
Nov 03, 2026
BTCPay Server Hot Wallet Thefts, Fixed in 2.4.2
Attackers stole Bitcoin and Litecoin from hot wallets on BTCPay Server 2.4.1 and earlier through ...
Nov 03, 2026
Siemens IoT2050 Node-RED RCE, Exploited in the Wild (CVE-2026-58115)
An unauthenticated Node-RED interface on Siemens SIMATIC IoT2050 gateways lets attackers run comm...
Nov 03, 2026
More tagged #vulnerability
libexpat Billion Laughs Bypass, Fixed in 2.10.0 (CVE-2026-115506)
libexpat through 2.9.0 detects some billion-laughs attacks too late. Learn the affected parser paths, four flaws, and how upgrading to 2.10.0 helps.
Nov 02, 2026
Control Web Panel Unauthenticated RCE Chain (CVE-2026-73696)
Control Web Panel before 1.12 exposes user-panel code without login; learn the three-CVE chain, affected versions, and checks before updating CWP.
Nov 02, 2026
Barracuda ESG Pre-Auth Bypass to Root, Patched (CVE-2026-116606)
A pre-authentication bypass in Email Security Gateway chains with a root command injection across six Barracuda products; patches shipped November 2, 2026.
Nov 02, 2026
SMS of Death: Android Zero-Click Telephony DoS (CVE-2026-58882)
One malformed WAP Push SMS crashes Android telephony and drops calls with no tap from the victim; the fix ships at the November patch level.
Nov 02, 2026
TeamViewer RCE via Screen Size, Fixed in 15.83 (CVE-2026-111585)
A malicious TeamViewer host runs code on the viewer that connects to help it, through one truncated screen-size multiply; update every client to 15.83.
Nov 02, 2026
TightVNC Viewer Pre-Auth RCE, Fixed in 2.8.90
A malicious VNC server runs code on the TightVNC Viewer before any password prompt; upgrade the Viewer to 2.8.90 and restrict listening mode on TCP 5500.
Nov 02, 2026
EDK II PXE Driver RCE Before Secure Boot (CVE-2026-97631)
An oversized ICMP error message corrupts memory while a server PXE-boots, running attacker code before the OS loads. Isolate PXE networks now.
Nov 01, 2026
LXD and Incus mTLS Authentication Bypass (CVE-2026-112816)
LXD and Incus mTLS authentication bypass lets network attackers impersonate trusted clients using public certificates. Check exposure and fixed versions.
Nov 01, 2026
CakePHP SQL Injection, Fixed in 5.4.4 (CVE-2026-119418)
CakePHP window offsets and collation names allow SQL injection when fed untrusted input. Check exposure and upgrade to 5.4.4, 5.3.8 or 5.2.16.
Nov 01, 2026
imgproxy ICO Loader RCE, Fixed in 4.0.16 (GHSA-hff9-5pqw-6w9f)
imgproxy 4.0.0 to 4.0.15 allocates ICO data with a wrapping size that unauthenticated crafted-image requests turn into heap corruption; fixed in 4.0.16.
Oct 31, 2026