A critical vulnerability in Stylemix uListing versions up to 2.2.0 allows unauthenticated SQL injection, posing severe risks to website data integrity.
The developer behind the ARTEX AI agent has made the project closed-source following revelations that the tool was used to compromise financial institutions in South Korea.
A critical vulnerability in ThemeREX IPharm versions up to 1.2.4 allows untrusted data deserialization, posing a severe risk to WordPress installations.
A critical flaw in Avada Builder allows attackers to delete site content and trigger code execution without logging in, affecting versions up to 7.16.1.
Security teams must patch ThemeREX Tantra CMS versions up to 2.9.0 immediately to mitigate a critical deserialization vulnerability.
A CVSS 9.8 vulnerability in ThemeREX Group Greeny versions up to 2.10.0 allows untrusted data deserialization, requiring immediate inventory checks.
A critical privilege escalation in the Blocksy Companion plugin allows unauthenticated users to bypass security checks and gain seller access on WordPress sites.
Unverified firmware updates bypass operating system security controls, granting attackers permanent root access that survives every hardware reset and reinstallation.
Restricting permissions reduces your attack surface but creates operational friction that can slow incident response and break automated workflows if not managed correctly.
Most teams treat software composition analysis as a compliance checklist rather than a continuous control, leaving supply chain risks dormant in production.
Proper input validation stops logic errors before they become exploits, reducing the need for expensive perimeter defences later in the development cycle.
Unrestricted file uploads allow attackers to execute code directly on your server, turning a simple document submission into a persistent backdoor that bypasses perimeter defences entirely.
Misinterpreted delimiters can desynchronise proxy queues, allowing attackers to bypass security controls and access data belonging to other users.
Updating firmware without verifying cryptographic signatures exposes your infrastructure to persistent root-level compromise that survives standard operating system reinstalls.
A single directory path in a URL can bypass file storage controls and expose confidential data without requiring password authentication or complex exploits.
Modifying an object’s prototype allows attackers to inject properties that every instance inherits, bypassing standard checks silently.
A missing authentication flaw in Azure App Service for Linux allows remote code execution, scoring 9.8 on the CVSS scale.
A critical vulnerability in mJobTime allows attackers to execute arbitrary code on the server as LocalSystem via a single HTTP request.
A joint international advisory highlights coordinated attempts by state-linked actors to compromise organisations across multiple sectors worldwide.