The Sandbox Desk CVE Desk is the part of the Sandbox Desk newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 27 articles so far. See the editorial policy or report an error.
A critical flaw in Vanus versions 0.8.0 through 0.9.0 allows attackers to use a fixed Bearer token to gain full administrative control over event streaming clusters.
Developers using the @aws-amplify/codegen-ui-react library must upgrade to version 2.20.6 to fix a code injection flaw allowing authenticated users to run arbitrary JavaScript.
A critical buffer overflow in the RIOT OS ATWINC15x0 driver allows nearby attackers to trigger remote code execution through oversized network names.
A critical vulnerability in Eclipse Vert.x allows attackers to execute code via crafted database responses, affecting multiple major versions of the client.
A critical stored cross-site scripting vulnerability in the Cronicle task scheduler allows attackers to hijack administrator accounts and execute commands on managed servers.
A code injection flaw in Visual Studio Tools for Applications allows network-based execution, impacting versions prior to specific patch levels.
A critical heap overflow in the SVR component allows unauthenticated attackers to disrupt services on affected Junos OS versions via crafted network traffic.
A critical stack-based buffer overflow in Juniper SRX devices allows attackers to run code as root through crafted packets on GRE tunnels.
An unpatched command injection flaw in the @mborne/extract npm package allows remote attackers to execute arbitrary system commands with Node.js privileges.
A heap overflow in the Windows System Information Console allows unauthorized network attackers to run code, rated critical by NVD.
Microsoft’s advisory details a use-after-free flaw in the CCFFilter driver that permits unauthorized network-based code execution.
A critical vulnerability in Active Directory Federation Services allows network-based spoofing due to improper cryptographic signature verification.
A critical authorization bypass in Adobe Experience Manager allows arbitrary code execution in the current user's context, requiring no interaction to exploit.
A critical OS command injection flaw in Adobe Experience Manager allows low-privileged users to execute arbitrary code without requiring any user interaction.
A broken authorization issue in FortiSIEM allows authenticated attackers to execute commands via crafted HTTP requests, posing a low-severity risk.
A critical path traversal vulnerability in IBM DataStage 5.4.0.0 allows authenticated attackers to disrupt service, posing significant operational risk.
A critical authorization flaw in Obsidian-TC allows any valid token to read, write, or delete data in any configured vault prior to version 1.3.1.
A critical vulnerability in Square Squash allows attackers to execute arbitrary code through crafted YAML data stored via an API endpoint.
A critical vulnerability in TOZED X300 firmware versions up to 6.01.3 allows remote attackers to execute arbitrary operating system commands.
An unauthenticated PHP object injection flaw in WineShop versions up to 3.20 carries a 9.8 CVSS score, requiring immediate attention from development teams.
Threat actors are targeting unpatched AhsayCBS backup platforms to install webshells and cryptocurrency miners, exposing organizations to significant operational risk.
A high-severity bug in the fast-jwt library allows attackers to skip expiry and issuer checks by submitting tokens with array payloads.
A missing authorization check in Hazelcast’s IMap Predicates API allows arbitrary code execution. Patches are available for affected versions.
A flaw in Nginx UI versions 2.0.0 through 2.5.0 exposes the master credential in URLs and logs, allowing attackers to bypass authentication and gain persistent administrative control.