Security notes, platform updates, and practical defensive guidance.
Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH pat...
Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT A...
Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a remote attacker to brute-force the resulting SSH login via TCP/22. Affected version...
A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple...
About CSAInformation forAlerts & AdvisoriesNews & EventsLegislationOur ProgrammesResourcesHomeAlerts & AdvisoriesAlertsCritical Vulnerability in Gitea DockerAlertsCritical Vulnerability in Gitea Docker8 July 2026
Attackers can exploit multiple vulnerabilities in BeyondTrust's Remote Support and Privileged Remote Access products to bypass access controls and gain unauthorised access, cause a denial of service, or access unintended...
The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of suff...
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validation on the plugin_settings function. This ma...
The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site...
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress...
The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross...
The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up...