Vulnerabilities
Organisations urged to audit npm trust configs after GitHub patches flaw risking 10M downloads
Abandoned GitHub repository names allowed attackers to hijack package publishing trust, risking millions of downloads.
Phish Herald Advisory Desk
The Phish Herald Advisory Desk is the part of the Phish Herald newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 17 articles so far. See the editorial policy or report an error.
Vulnerabilities
Organisations Face Critical CVE-2026-87744 Risk as Quarkus Panache Drops Role Checks for Unauthenticated Access
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls by exploiting how the code generator handles method properties.
Vulnerabilities
Orgs Face Impersonation Risk: Privasys ra-tls-clients 0.11.0 Patches Critical CVE-2026-108362
A critical flaw in Privasys ra-tls-clients allowed impersonation of attested endpoints. Version 0.11.0 resolves the issue by enforcing strict platform identity checks.
Vulnerabilities
Organisations face critical risk as Thirty Bees 1.7.0 flaw lets attackers reset user passwords via guest tokens
Unauthenticated attackers can reset passwords for registered users in Thirty Bees 1.7.0 via guest checkout tokens, posing a critical risk.
Vulnerabilities
GitLab CE/EE RCE forces urgent upgrades for self-managed users after CERT-EU warning
CERT-EU warns self-managed GitLab users to upgrade immediately after a CVSS 10.0 flaw allows unauthenticated remote code execution.
Vulnerabilities
Single Request Can Freeze Next.js Servers via React Server Components Flaw
High-severity CVE-2026-23870 allows attackers to cause denial of service in React 19 deployments without authentication or user interaction.
Vulnerabilities
Organisations urged to review Wordfence data on WordPress flaws disclosed 28 Sep-4 Oct 2026 to secure platforms
Organisations should review the latest Wordfence Intelligence data on WordPress flaws disclosed between 28 September and 4 October 2026.
Vulnerabilities
Unauthenticated SQL Injection in Stylemix uListing Risks Data Breach for WordPress Sites
A critical vulnerability in Stylemix uListing versions up to 2.2.0 allows unauthenticated SQL injection, posing severe risks to website data integrity.
Vulnerabilities
South Korean banks hit by ARTEX; Chinese dev switches AI tool to closed-source after breach
The developer behind the ARTEX AI agent has made the project closed-source following revelations that the tool was used to compromise financial institutions in South Korea.
Vulnerabilities
ThemeREX IPharm Deserialization Flaw Exposes Sites to Object Injection
A critical vulnerability in ThemeREX IPharm versions up to 1.2.4 allows untrusted data deserialization, posing a severe risk to WordPress installations.
Vulnerabilities
Avada Users at Risk: Unauthenticated Attackers Can Delete Site Content via Critical Builder Flaw Up to 7.16.1
A critical flaw in Avada Builder allows attackers to delete site content and trigger code execution without logging in, affecting versions up to 7.16.1.
Vulnerabilities
Orgs hit by CVSS 9.8: Patch ThemeREX Tantra CMS to block object injection
Security teams must patch ThemeREX Tantra CMS versions up to 2.9.0 immediately to mitigate a critical deserialization vulnerability.
Vulnerabilities
Organisations Hit by Greeny CVE-2026-93940 Must Patch Critical Object Injection Vulnerability Now
A CVSS 9.8 vulnerability in ThemeREX Group Greeny versions up to 2.10.0 allows untrusted data deserialization, requiring immediate inventory checks.
Vulnerabilities
Unauthenticated attackers can seize vendor roles via Blocksy Companion flaw
A critical privilege escalation in the Blocksy Companion plugin allows unauthenticated users to bypass security checks and gain seller access on WordPress sites.
Vulnerabilities
Organisations Face Critical Azure Linux RCE Risk From Missing Auth Flaw Scoring 9.8
A missing authentication flaw in Azure App Service for Linux allows remote code execution, scoring 9.8 on the CVSS scale.
Vulnerabilities
mJobTime SQL Flaw Grants LocalSystem Access Without Authentication
A critical vulnerability in mJobTime allows attackers to execute arbitrary code on the server as LocalSystem via a single HTTP request.
Vulnerabilities
Global sectors face coordinated data theft campaigns by state-linked actors, warns new international advisory
A joint international advisory highlights coordinated attempts by state-linked actors to compromise organisations across multiple sectors worldwide.