Do Son Langflow 1.8.0 patches a critical 9.8 CVSS RCE vulnerability (CVE-2026-27966) where a hardcoded "allow_dangerous_code" setting enables prompt injection attacks.
Vulnerability
Angular patches a critical 9.2 CVSS SSRF vulnerability (CVE-2026-27739). Attackers can manipulate Host headers to steal credentials and probe internal networks.
Critical SQL injection flaw (CVE-2026-26198) in ormar Python ORM allows unauthenticated attackers to leak entire databases. Update to version 0.23.0 immediately!
Critical path traversal flaws (CVE-2026-26065, CVE-2026-26064) in the Calibre e-book manager allow RCE via malicious PDB and ODT files. Update to 9.3.0.
ASUS removes "File Shredder" from Business Manager due to CVE-2025-13348 (CVSS 8.5). The feature is gone in V3.0.37.0. Check your commercial PCs.
Microsoft patches "Reprompt," a critical Copilot flaw. Attackers could steal sensitive data with just one click on a legitimate link.
Apache Kyuubi patches a high-severity 8.8 CVSS flaw (CVE-2025-66518) that allows unauthorized local file access via path traversal. Update to v1.10.3!
D4mianWayne details CVE-2025-68615, a 9.8 critical flaw in Net-SNMP allowing unauthenticated RCE. Update to v5.9.5 or v5.10.pre2 now!
A zero-day in Quake III Arena engines (ioquake3, OpenArena) allows attackers to read sensitive system files and target players. Check RCON access now!
Eaton warns of critical 8.6 severity flaws in UPS Companion software (CVE-2025-59887 & 59888). Upgrade to v3.0 now to prevent hijacking!
Joseph Goydish uncovers a critical integer overflow in iOS 26.2’s WebKit. Proof of Concept shows how attackers can crash browsers or trigger RCE.
A High-severity flaw (CVE-2025-63387) in Dify v1.9.1 allows unauthenticated users to access sensitive system configurations via an unprotected API.
A Headlamp flaw allows unauthenticated users to reuse cached credentials to hijack Kubernetes Helm operations. Update to v0.39.0!
A Notepad++ flaw (now patched in v8.8.9) allowed attackers to hijack the WinGUp update process, serving malware instead of the legitimate executable. Manual update is urged.
A critical vulnerability in the abandoned lz4-java library exposes apps to DoS. Discover the fix and the mandatory fork migration path here.
CVE-2025-60718 lets attackers hijack Windows Administrator Protection to gain full control. Learn how the "Shadow Admin" exploit works.
A critical vulnerability in Apache bRPC (CVE-2025-59789) allows attackers to crash servers using deep JSON data. Upgrade to version 1.15.0 now to fix it.
A High-severity flaw (CVE-2024-21635) in Memos fails to invalidate Access Tokens upon password change, allowing attackers to maintain access to the knowledge base. Update to v0.25.2.
A patched 7-Zip path-traversal flaw (RCE) now has public exploit code. Users must update immediately, as 7-Zip lacks auto-updates.
SAP's October 2025 Security Patch Day addressed 13 new notes, including two critical 10.0 flaws in NetWeaver AS Java and Print Service, posing an RCE threat.
Splunk issued patches for six flaws, including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform.
NVIDIA released an urgent update for its Megatron-LM LLM framework, patching four high-severity code injection flaws that could allow attackers to compromise AI workflows.