Vulnerabilities
Orgs at Risk: LangChat Flaw Exposes Passwords, Grants Unauthenticated Super-Admin Access
A critical flaw in LangChat lets unauthenticated users access sensitive data and gain full control over the application without logging in.
TechWire Beat Patch Watch Desk
The TechWire Beat Patch Watch Desk is the part of the TechWire Beat newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 34 articles so far. See the editorial policy or report an error.
Vulnerabilities
Vulnerabilities
Full Router Control: Netcore NR256CN Critical Flaw Allows Unauthenticated Access Without Passwords
Unauthenticated attackers can exploit a stack overflow in Netcore NR256CN devices, potentially taking full control of the router without needing a password.
Vulnerabilities
Orgs at risk: Arcane 2.6.0 blocks privileged users from resetting admin passwords via missing check
A missing privilege check in Arcane container manager lets low-level users reset administrator passwords, a flaw fixed in version 2.6.0.
Vulnerabilities
BeyondTrust patches zero-day after Armory Castle steals credentials and persists in remote support appliances
Suspected Chinese spies used an unpatched flaw in BeyondTrust remote support tools to steal stored credentials and maintain long-term access.
Vulnerabilities
RIOT OS update stops critical DHCPv6 flaw crashing IoT devices
A critical buffer overread in RIOT OS allows rogue servers to crash devices and leak memory data, requiring an immediate upgrade.
Vulnerabilities
Organisations at Risk: Link Whisper Free v0.9.7 Suffers Critical Blind SQL Injection Vuln
A critical security flaw in the Link Whisper Free plugin allows blind SQL injection attacks, affecting all versions released before the latest update.
Vulnerabilities
Booking Sites Urged to Update TMS Amelia Plugin Amid Critical SQL Injection Vulnerability
A critical vulnerability in the TMS Amelia plugin allows attackers to manipulate databases, affecting versions up to 2.4.10.
Vulnerabilities
SQL Server flaw lets insiders boost rights across three major versions
A high-severity buffer overflow in Microsoft SQL Server allows authorised users to escalate privileges, affecting 2017, 2019 and 2022 editions.
Vulnerabilities
Palo Alto Networks Panorama DoS Flaw Disrupts Centralised Security Management
CVE-2026-0318 allows attackers to crash Panorama consoles via log processing, forcing maintenance mode on affected versions.
Vulnerabilities
Orgs risk unintended actions as TypeSafe Jev falls to hidden web ad injections despite safety vows
Security tests show the decision model can be tricked into unintended actions via web ads, contradicting vendor safety assurances.
Vulnerabilities
Unauthenticated kernel crash risk in Junos OS requires immediate vendor review
A critical integer underflow flaw enables remote denial of service on specific Juniper Networks router and switch operating system versions.
Vulnerabilities
Orgs face record 1,413 patches as Microsoft plugs exploited Windows Shell flaw and critical zero-days
Organisations face a massive update cycle as Microsoft patches a record number of vulnerabilities, including a Windows Shell flaw already being exploited in the wild.
Vulnerabilities
Enterprises urged to patch .NET 8-11 Preview to stop remote code execution via deserialization flaw CVE-2026-70035
Microsoft patches a high-severity flaw in .NET Framework that allows remote code execution via untrusted data deserialization.
Vulnerabilities
Microsoft tightens ReFS security on external drives, with 2027 enforcement deadline
Windows will enforce stricter controls on Resilient File System volumes on removable media, giving organisations time to prepare after October 2026 updates.
Vulnerabilities
Attackers steal credentials from patched Ivanti gateways using zero-day chain
A threat group exploited three unpatched flaws in Ivanti Connect Secure to gain root access and harvest Active Directory secrets from updated appliances.
Vulnerabilities
Microsoft PPP EAP-TLS Flaw Lets Attackers Run Code Without Credentials
A critical heap overflow in Microsoft’s PPP EAP-TLS protocol allows unauthenticated remote code execution, rated 9.8 by the National Vulnerability Database.
Vulnerabilities
Microsoft AD FS Spoofing Flaw CVE-2026-96252 Risks Network Identity Integrity
A critical cryptographic verification failure in Active Directory Federation Services allows unauthorised attackers to perform network spoofing.
Vulnerabilities
Organisations urged to patch ASP.NET Core 8-11 against critical 9.4-score network tampering flaw
Microsoft has released updates for ASP.NET Core versions 8 through 11 to fix a severe vulnerability that allows remote network tampering.
Vulnerabilities
Organisations Safe as Docker Hub Fixes CVE-2026-105445 Token Hijacking Flaw With No Exploitation
A critical vulnerability in Docker Hub allowed attackers to hijack personal access tokens and impersonate other users, but the vendor has since deployed a fix.
Vulnerabilities
Organisations Urged to Patch Metasploit v6.5.5 After Critical Auth Bypass Exposes Private Keys and Credentials
A critical flaw in the Metasploit Framework web service permits unauthenticated users to read, modify, or delete stored credentials and private keys.
Vulnerabilities
Organisations Risk Total HR Data Loss as Wukong_HRM Flaw Grants Unauthenticated Admin Access via CVE-2026-108707
A critical flaw in Wukong_HRM allows unauthenticated users to bypass security checks and access sensitive employee data and administrative functions.
Vulnerabilities
Organisations at risk: Perforce Helix Auth Service critical flaw enables RCE via default token chain
A critical flaw in Perforce Helix Authentication Service allows attackers to execute code via a default token and prototype pollution chain.
Vulnerabilities
Quarkus Code Generator Flaw Exposes Endpoints to Unauthenticated Access
A critical flaw in Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints, potentially leading to data leaks.
Vulnerabilities
SonicWall SMA1000 SSRF Flaw Exploitation Attempts Detected Days After Disclosure
Threat intelligence firms report exploitation attempts against a maximum-severity vulnerability in SonicWall remote access appliances, detected shortly after public disclosure.