The Vector Tribune CVE Desk is the part of the Vector Tribune newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 22 articles so far. See the editorial policy or report an error.
A critical flaw in the D-Link DCS-930L allows remote attackers to bypass cryptographic checks and manipulate firmware via the emergency recovery service.
A critical vulnerability in Wazuh allows compromised cluster workers to overwrite master configuration files, leading to root remote code execution across the entire security infrastructure.
A critical SSRF flaw in the SAP Cloud SDK for Python allows attackers to steal OAuth2 client credentials from multi-tenant BTP applications.
A critical vulnerability in IBM DataStage version 5.4.0.0 allows authenticated attackers to execute arbitrary code via path traversal, posing significant operational risks.
Threat actors sent 135 exploitation attempts against the patched SMA1000 SSRF vulnerability just two days after SonicWall released the fix.
AWS reports a parsing flaw in FreeRTOS-Plus-TCP that could allow remote attackers to crash embedded devices via malformed DHCPv6 packets.
AWS addresses two security issues in Amazon Q and AWS language server plugins, urging users to review their plugin configurations immediately.
A high-severity cross-site request forgery flaw in Nginx UI versions 2.0.0 through 2.4.3 allows attackers to modify server configurations via authenticated admin sessions.
Unauthenticated attackers can execute code on Grid Protection Alliance servers via unsafe deserialization in service consoles.
Anthropic launches a free, opt-in security audit tool for open-source projects that uses AI models to identify and report vulnerabilities automatically.
Unauthenticated attackers can crash GPU monitoring services and disrupt AI workloads via a high-severity vulnerability in widely deployed NVIDIA infrastructure tools.
Threat actors are exploiting two unpatched AhsayCBS flaws to bypass authentication and deploy crypto miners disguised as legitimate software.
A critical vulnerability in mJobTime lets attackers execute code as LocalSystem via a single HTTP request without needing valid credentials.
A critical OS command injection flaw in ppt2png versions through 0.0.6 allows attackers to execute system commands via unsanitized path inputs.
A critical flaw in the @enmaso/node-convert Node.js library allows attackers to execute arbitrary operating system commands via unsanitized image conversion arguments.
The image_optimizer Ruby gem allows remote code execution via crafted file paths when the identify option is enabled, posing a critical risk to applications.
Unauthenticated attackers can seize full administrative control of TVU Receiver and Transceiver devices by exploiting a login flaw in firmware versions prior to 7.9.
An unauthenticated flaw in PHPNuxBill versions through 2025.3.20 allows attackers to steal customer data via time-based blind SQL injection.
A critical flaw in the Sipay OpenCart Virtual POS module allows attackers to spoof cryptographic signatures in versions prior to 26.9.1.
Cisco Talos researchers revealed security vulnerabilities across four major software vendors, all of which have since issued patches.
A critical flaw in PraisonAI Agents allows LLM-generated code to leak all environment variables, including API keys, even when sandboxing is enabled.
Unpatched NetScaler products could be exploited by attackers to run arbitrary commands, prompting immediate action from IT administrators.