Security notes, platform updates, and practical defensive guidance.
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory ca...
Microsoft has released security patches to address multiple vulnerabilities in their software and products.
Attackers are exploiting a critical vulnerability in N-Able N-Central remote management and monitoring tool to execute code remotely without authentication. Patch immediately.
Attackers are exploiting a critical vulnerability in Adobe Commerce, Adobe Commerce B2B and Adobe Magento to execute arbitrary code. Patch immediately.
Attackers can exploit multiple vulnerabilities in SAP Products to execute arbitrary commands, obtain sensitive credentials, replace or delete tenant data and perform unauthorised actions. Patch immediately.
Attackers can exploit a high-severity vulnerability in PostgreSQL to execute arbitrary code on the affected system. Patch promptly.
Joker linter executed project-local .jokerd/linter.* files during linting
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
@openhop/server: Path Traversal in Flow ID File Operations
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Perf...