Do Son Ivanti Neurons ITSM RCE: 8 CVEs including unauthenticated code execution flaws (CVSS 9.8-9.9). Patch on-prem deployments now - cloud already fixed.
Missing Authorization
JetBrains patched CVE-2026-75045, letting an unauthenticated attacker download YouTrack database backups. Eight flaws fixed. Update now.
A missing authorization flaw in Event-Driven Ansible (CVE-2026-11807, CVSS 9.6) leaks credentials like OAuth tokens, vault passwords, and SSH keys.
CVE-2026-55518 is a critical Avo authorization bypass flaw enabling privilege escalation in Ruby on Rails admin panels. Update to Avo 3.32.1 now.
AVEVA alerts on a 9.3 critical flaw in Pipeline Simulation. Unauthenticated users can hijack admin roles and alter data. Upgrade to version 2025 SP1 P01 now.
Apache OpenOffice 4.1.16 fixes seven security flaws, including a memory corruption bug and six issues that allow unprompted loading of remote content via documents, risking system info leak and malware delivery.
Urgent patch for Post SMTP plugin. A CVSS 9.8 flaw lets unauthenticated attackers read email logs and steal password reset links to take over accounts.
Juniper warns of a critical flaw (CVE-2025-52950, CVSS 9.6) in Security Director 24.4.1, allowing unauthenticated attackers to read or tamper with sensitive resources. Update immediately.