Do Son Broadcom released updates to fix a critical VMware authentication bypass (CVE-2026-59309). A directory traversal flaw (CVE-2026-59310) was also patched.
Directory Traversal
A new Exim vulnerability lets a local attacker escape the spool directory and escalate privileges. Upgrade to Exim 4.99.5 to close the hole now.
Esri released a critical ArcGIS Server security patch addressing a severe directory traversal vulnerability. Protect your enterprise data and apply it now.
CISA updates its KEV Catalog with critical flaws in Langflow (CVE-2025-34291) and Trend Micro Apex One. Federal agencies ordered to patch by June 4, 2026.
Spring Cloud Config fixes a 9.1 CVSS directory traversal (CVE-2026-40982) and a GCP secret leak. Secure your distributed system—upgrade to the latest patches!
Spring Cloud Config faces a high-severity CVSS 8.6 flaw (CVE-2026-22739). Attackers can manipulate profiles to access local files or launch SSRF attacks.
Trend Micro issues a critical patch for Apex One to fix 9.8 severity vulnerabilities (CVE-2025-71210) that allow remote code execution. Update your console now!
A zero-day in Quake III Arena engines (ioquake3, OpenArena) allows attackers to read sensitive system files and target players. Check RCON access now!
CISA added two actively exploited zero-days to the KEV: a WinRAR directory traversal (CVE-2025-6218) planting malware in Startup folder, and a Windows Cloud Files UAF for SYSTEM privileges.
A Critical (CVSS 9.3) LPE flaw in cPanel's Team Manager API allows a standard user to break out of their directory via path traversal and compromise the shared hosting server. Update immediately.
IBM patched four critical flaws in AIX/VIOS. The RCE (CVSS 10.0) in nimesis and CVE-2025-36096 allow remote attackers to execute commands and obtain NIM private keys. Update immediately.
Sauter patched six flaws in modulo 6 devices. The Critical CVE-2025-41723 (CVSS 9.8) flaw allows unauthenticated file upload via the SOAP interface, risking RCE. Update to v3.2.0.
The Zero Day Initiative (ZDI) has published details of two critical vulnerabilities in the popular open-source compression...
The Django team released urgent updates (v5.2.7, 5.1.13, 4.2.25) to fix a High-severity SQL Injection flaw (CVE-2025-59681) affecting QuerySet methods in MySQL/MariaDB.
Today, SAP released 21 new Security Notes and 4 updates as part of its monthly Security Patch...
A critical directory traversal vulnerability (CVE-2025-48387) in the popular NPM package tar-fs allows attackers to write arbitrary files and gain RCE.
A flaw (CVE-2025-6218, CVSS 7.8) in WinRAR allows remote code execution via directory traversal when opening crafted archives. Update to 7.12 Beta 1 immediately!
A critical flaw (CVE-2025-52562, CVSS 10.0) in Convoy KVM panel allows unauthenticated remote code execution via directory traversal.
CrushFTP vulnerabilities CVE-2025-32102 & CVE-2025-32103 enable SSRF and directory traversal. Update now to secure your file transfer server