The CloudSec Press Advisory Desk is the part of the CloudSec Press newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 25 articles so far. See the editorial policy or report an error.
A critical cross-site scripting flaw in TanStack Router allows unauthenticated attackers to inject scripts. Patches are available for affected npm packages.
A critical remote code execution flaw in Drupal core requires contributed modules for access, with patches released on October 14 for supported versions.
CERT/CC reports parsing inconsistencies in X.509 name constraints across major TLS libraries, creating validation gaps that operators must audit.
A high-severity code injection bug in Microsoft development tools allows network-based attacks, requiring urgent checks for specific version ranges.
A critical vulnerability in Stirling-PDF allows authenticated administrators to execute arbitrary commands via a flawed SQL import mechanism.
A high-severity out-of-bounds read in Windows Text Shaping allows network-based remote code execution across multiple versions.
Palo Alto Networks reports path traversal flaws in Checkov 3.3 that let local users write to arbitrary filesystem locations without authentication.
A critical OS command injection flaw in the thumbnail library lets attackers run system commands by manipulating file names passed to its generation functions.
Microsoft patches a high-severity cross-site scripting flaw in ASP.NET Core that allows attackers to inject scripts via the debug endpoint.
Microsoft patches a high-severity denial of service flaw in ASP.NET Core that allows unauthenticated attackers to exhaust server memory resources.
A stale cache flaw in Linux vhost allows local users with device access to gain root access and lets virtual guests escape to the host system.
A critical double free flaw in Microsoft Outlook allows remote attackers to execute code, posing a severe risk to enterprise email operations.
Microsoft patches a high-severity command injection flaw in Windows Shell that was exploited in the wild as a zero-day.
A critical code injection flaw in Adobe ColdFusion allows attackers to run arbitrary code without user interaction across multiple versions.
A critical vulnerability in ASP.NET Core allows unauthorized network tampering, requiring immediate updates for versions 8 through 11 across all operating systems.
Researchers showed that attackers could hijack npm packages by claiming abandoned GitHub repository names, exposing over 1,500 packages to unauthorized updates.
A critical vulnerability in IBM i HTTP Server Administration allows authenticated attackers to run arbitrary code on affected systems.
A logic flaw in HAProxy Data Plane API allows unauthenticated access when mutual TLS is enabled, bypassing credentials on other listeners.
IBM Db2 Mirror for i faces a critical privilege escalation flaw that lets authenticated attackers bypass checks and run code.
A critical flaw in Agnaistic Agnai through version 1.0.555 exposes fixed admin passwords and JWT secrets, allowing unauthenticated attackers to seize full control of server configurations.
A critical PHP object injection flaw in the Tipsy WordPress theme allows attackers to execute code without logging in, affecting versions up to 1.6.
A critical deserialization flaw in ThemeREX Dwell versions through 1.16.0 allows attackers to inject objects via untrusted data.
IBM Security Verify Access and related identity products contain a critical flaw allowing remote attackers to run arbitrary code without credentials.
The US government requires federal agencies to mitigate a high-severity ISC BIND vulnerability by October 11 to prevent remote server crashes.