Coverage tagged "Vulnerability".
Serial number: AV26-1078 Date: October 22, 2026 As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product: C# Driver Prior to 3.13.0 The Cyber Centre encourages users…
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code…
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in…
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was…
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler. Sweet Security adds one-click protection for vulnerable…
arXiv:2610.30400v1 Announce Type: new Abstract: Modern heterogeneous computing platforms, which integrate general-purpose processors with specialized accelerators such as FPGAs, have become the…
arXiv:2610.30914v1 Announce Type: new Abstract: Despite recent advances, deepfake detectors remain vulnerable to adversarial examples, particularly in diverse, real-world settings. We propose…
CVE-2026-76268 is a critical missing authentication vulnerability in Splunk Enterprise. An unauthenticated attacker with network access to the Patroni REST API on a search head cluster member could…
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service…
Serial number: AV26-1077 Date: October 22, 2026 As of October 21, 2026, Splunk is affected by vulnerabilities in the following products: Splunk Enterprise Prior to 10.0.11 Prior to 10.2.8 Prior to…
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on…
Welcome to this week’s edition of the Threat Source newsletter. Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’.
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.
Serial number: AV26-1076 Date: October 22, 2026 As of October 20, 2026, Atlassian is affected by vulnerabilities in the following products: Bamboo Data Center and Server Version 12.1.12 and prior…
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.
