Vulnerabilities
CVSS 9.3: Critical Stored XSS in Adobe Commerce and Magento Allows Session Hijacking
A severe vulnerability in Adobe Commerce and Magento Open Source allows attackers to inject malicious scripts into customer forms.
Vulnerabilities
Vulnerabilities coverage from Patch Herald holds 27 articles, 10 of them reference guides. The newest was published on October 13, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include MITRE CWE and CISA Known Exploited Vulnerabilities Catalog.
Vulnerabilities
CVSS 9.8: Windows 11 Needs Urgent QUIC Patches to Block Unauthenticated Remote Code Execution
Windows 11 users across multiple versions must install immediate updates to block unauthenticated network attacks targeting the QUIC protocol.
Vulnerabilities
Microsoft Patches Critical Windows Text Shaping Flaw With 9.8 CVSS Score
A heap overflow in Windows Text Shaping allows remote code execution. Microsoft has released updates for Windows 10 and 11 builds to address the critical vulnerability.
Vulnerabilities
1,500 npm packages spared takeover as GitHub expires unvalidated publishing configs in 48 hours
A validation gap in npm’s automated publishing feature allowed attackers to hijack packages by reclaiming old GitHub repository names.
Vulnerabilities
How WordPress Plugin Vulnerabilities Exploit Your Site Step by Step
Plugin flaws bypass web server defenses by executing code within the trusted application context, turning a simple form submission into a full system compromise without external network access.
Vulnerabilities
MFA: Low-Cost Fix for Small Practices as FortiBleed Lingers and Hospital CISOs Vet Fintech Vendors
A healthcare security executive outlines how hospitals should vet financial technology partners to protect patient data and funds, while FortiBleed activity continues.
Vulnerabilities
CVSS 9.8: Tonda Membership 1.0.1 CWE-266 Flaw Enables Unauthenticated Full Control
A CVSS 9.8 critical vulnerability in Tonda Membership versions 1.0.1 and below lets attackers gain full control without logging in.
Vulnerabilities
WatchTowr Labs Discloses Four PaperCut Vulnerabilities Enabling Unauthenticated Remote Code Execution
Researchers identified a chain of flaws in PaperCut software that allows attackers to run code remotely without needing user credentials or login access.
Vulnerabilities
Secure Software Development Lifecycle: 6 Common Misconceptions
Treating security as a final quality check introduces hidden costs and creates false confidence in applications that remain vulnerable to logic flaws.
Vulnerabilities
AWS QnABot Sandbox Flaw Allows Arbitrary Code Execution
A vulnerability in AWS QnABot lets attackers bypass security sandboxes and run unauthorized code on the platform.
Vulnerabilities
CVSS 9.1: Privasys rustls v0.8.1 patches missing RA-TLS session binding in CVE-2026-108266
A critical vulnerability in the Privasys rustls TLS library allows attackers to bypass security checks. Version 0.8.1 fixes the quote relay issue.
Vulnerabilities
Exposed Admin Panels: Response and Recovery Steps
Leaving admin interfaces open invites automated scanners to harvest credentials, often bypassing perimeter defenses entirely.
Vulnerabilities
Bug Bounty Programs: How External Researchers Secure Your Code
Bug bounty programs turn the global developer community into your external security team, finding flaws before attackers do.
Vulnerabilities
Out-of-Band Patches: Meaning, Risks, and Deployment Reality
Out-of-band patches bypass standard testing cycles, creating a hidden operational debt that often exceeds the security gain if deployment automation is weak.
Vulnerabilities
CWE Weakness Categories: Meaning, Definition, and Practical Use
The Common Weakness Enumeration provides a standardized language for flaws, allowing teams to track defects across different software components without ambiguity.
Vulnerabilities
Prototype Pollution Risks and Protection for Small Businesses
Prototype pollution allows attackers to manipulate core JavaScript objects, creating persistent backdoors that survive standard input validation and restarts.
Vulnerabilities
CSRF Risks and Protection: Secure Your Business Web Apps
Cross-site request forgery exploits user trust rather than code flaws, making it a silent threat that standard firewalls often miss entirely.
Vulnerabilities
Dependency Confusion Attacks Explained: How Private Code Gets Hijacked
Attackers trick build systems into downloading malicious public packages by mimicking internal private package names, bypassing standard security checks.
Vulnerabilities
Warning Signs of Cross-Site Request Forgery Attacks
CSRF attacks often succeed without any visible error messages, leaving only subtle state changes as evidence of unauthorized command execution.
Vulnerabilities
CVSS 9.3: Blind SQL Injection in EduAdmin Booking Pre-6.0.0 (CVE-2026-96809)
A severe vulnerability in EduAdmin Booking before version 6.0.0 allows attackers to execute blind SQL injection attacks against the system.
Vulnerabilities
CVE-2026-108157: Pingvin Share X OAuth Flaw Bypasses 2FA, Grants Admin Access
A critical vulnerability in Pingvin Share X allows attackers to bypass authentication and seize control of admin accounts by exploiting OAuth email linking flaws.
Vulnerabilities
CVE-2026-107378: CairoSVG Fixes CVSS 8.7 DoS Bug in Versions Before 2.9.1
A high-severity bug in CairoSVG allows small SVG files to consume excessive CPU time, causing denial-of-service for rendering services.
Vulnerabilities
CVSS 9.8 Flaw in openPDC Docker Images Before 2.9.477, 2.9.482 Grants Admin Access
A critical vulnerability in openPDC Docker images allows attackers to seize full administrative control using fixed credentials.
Vulnerabilities
CVE-2026-106446: Update Handlebars to 4.7.10 to Block Critical RCE via Template Data Injection
A critical remote code execution vulnerability in Handlebars allows attackers to inject malicious JavaScript via manipulated template data, requiring an immediate update to version 4.7.10.