Vulnerabilities
CVSS 9.3: Critical Stored XSS in Adobe Commerce and Magento Allows Session Hijacking
A severe vulnerability in Adobe Commerce and Magento Open Source allows attackers to inject malicious scripts into customer forms.
Patch Herald Patch Watch Desk
The Patch Herald Patch Watch Desk is the part of the Patch Herald newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 17 articles so far. See the editorial policy or report an error.
Vulnerabilities
CVSS 9.8: Windows 11 Needs Urgent QUIC Patches to Block Unauthenticated Remote Code Execution
Windows 11 users across multiple versions must install immediate updates to block unauthenticated network attacks targeting the QUIC protocol.
Vulnerabilities
Microsoft Patches Critical Windows Text Shaping Flaw With 9.8 CVSS Score
A heap overflow in Windows Text Shaping allows remote code execution. Microsoft has released updates for Windows 10 and 11 builds to address the critical vulnerability.
Vulnerabilities
1,500 npm packages spared takeover as GitHub expires unvalidated publishing configs in 48 hours
A validation gap in npm’s automated publishing feature allowed attackers to hijack packages by reclaiming old GitHub repository names.
Vulnerabilities
MFA: Low-Cost Fix for Small Practices as FortiBleed Lingers and Hospital CISOs Vet Fintech Vendors
A healthcare security executive outlines how hospitals should vet financial technology partners to protect patient data and funds, while FortiBleed activity continues.
Vulnerabilities
CVSS 9.8: Tonda Membership 1.0.1 CWE-266 Flaw Enables Unauthenticated Full Control
A CVSS 9.8 critical vulnerability in Tonda Membership versions 1.0.1 and below lets attackers gain full control without logging in.
Vulnerabilities
WatchTowr Labs Discloses Four PaperCut Vulnerabilities Enabling Unauthenticated Remote Code Execution
Researchers identified a chain of flaws in PaperCut software that allows attackers to run code remotely without needing user credentials or login access.
Vulnerabilities
AWS QnABot Sandbox Flaw Allows Arbitrary Code Execution
A vulnerability in AWS QnABot lets attackers bypass security sandboxes and run unauthorized code on the platform.
Vulnerabilities
CVSS 9.1: Privasys rustls v0.8.1 patches missing RA-TLS session binding in CVE-2026-108266
A critical vulnerability in the Privasys rustls TLS library allows attackers to bypass security checks. Version 0.8.1 fixes the quote relay issue.
Vulnerabilities
CVSS 9.3: Blind SQL Injection in EduAdmin Booking Pre-6.0.0 (CVE-2026-96809)
A severe vulnerability in EduAdmin Booking before version 6.0.0 allows attackers to execute blind SQL injection attacks against the system.
Vulnerabilities
CVE-2026-108157: Pingvin Share X OAuth Flaw Bypasses 2FA, Grants Admin Access
A critical vulnerability in Pingvin Share X allows attackers to bypass authentication and seize control of admin accounts by exploiting OAuth email linking flaws.
Vulnerabilities
CVE-2026-107378: CairoSVG Fixes CVSS 8.7 DoS Bug in Versions Before 2.9.1
A high-severity bug in CairoSVG allows small SVG files to consume excessive CPU time, causing denial-of-service for rendering services.
Vulnerabilities
CVSS 9.8 Flaw in openPDC Docker Images Before 2.9.477, 2.9.482 Grants Admin Access
A critical vulnerability in openPDC Docker images allows attackers to seize full administrative control using fixed credentials.
Vulnerabilities
CVE-2026-106446: Update Handlebars to 4.7.10 to Block Critical RCE via Template Data Injection
A critical remote code execution vulnerability in Handlebars allows attackers to inject malicious JavaScript via manipulated template data, requiring an immediate update to version 4.7.10.
Vulnerabilities
9.3 CVSS: CVE-2026-107699 RCE in ppt2png 0.0.6 Node.js apps via shell metacharacter injection in path args
A critical flaw in the ppt2png tool lets attackers run system commands by manipulating file path inputs, posing a severe risk to Node.js applications.
Vulnerabilities
WordPress 7.1.3 Fixes Seven Security Issues; Users Urged to Update Sites Immediately
The latest maintenance release for WordPress resolves seven security vulnerabilities and four bugs. Site owners should apply the update now to protect their platforms.
Vulnerabilities
Cisco Patches Critical CVE-2026-76471 NX-API RCE Flaw in NX-OS Software
Attackers can now execute code with root privileges on Cisco NX-OS devices via a critical unauthenticated remote code execution flaw.