The Vector Bulletin Flaw Tracker Desk is the part of the Vector Bulletin newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 30 articles so far. See the editorial policy or report an error.
A critical flaw in the Claude Agent SDK allows attackers to execute arbitrary commands by injecting flags through unvalidated resume inputs.
A critical flaw in EseeCloud devices allows attackers to log in using static, hard-coded credentials found in the application and firmware.
Progress has released updates for its managed file transfer platform to address twelve vulnerabilities, including critical flaws that enable authentication bypass and privilege escalation.
A critical flaw in the Mang Board WordPress plugin allows attackers to inject malicious SQL commands, risking significant data exposure for site administrators.
A resource allocation flaw in aws-smithy-http-server allows attackers to disrupt services without authentication, affecting versions up to 0.66.4.
A flaw in Dell’s Terraform tool ignores server identity, allowing attackers to intercept management traffic and steal credentials via man-in-the-middle attacks.
Unauthenticated attackers can hijack accounts in Better Auth versions before 1.7.7 by exploiting a flaw in the OAuth Proxy plugin that permits profile forgery.
A critical flaw in Mitsubishi GENESIS software uses a static unlock code, allowing remote attackers to bypass password recovery and access systems.
A high-severity memory corruption bug in Microsoft Excel allows remote attackers to run arbitrary code on affected systems without prior authentication.
A medium-severity flaw in the Windows client allows local users to crash the app, while other platforms remain secure.
A stack-based buffer overflow in Juniper’s BGP daemon allows configured peers to compromise the routing engine or trigger denial of service.
Microsoft has released patches for a high-severity denial-of-service vulnerability in .NET that allows remote attackers to crash services via uncontrolled recursion.
Microsoft has released updates for System.Security.Cryptography.Xml to fix a high-severity flaw that allows attackers to deny service via unbounded resource use.
A severe flaw in TR7 ASP allows attackers to execute system commands via improper input handling, affecting multiple version branches.
Vulnerabilities in FortiAnalyzer and Metabase allow low-privileged users to read or write files via crafted SQL commands, rated high and critical severity.
All versions of the AGE-GATE plugin up to 1.0 contain a critical flaw allowing attackers to execute code without logging in, according to NVD records.
A critical flaw in Microsoft QUIC allows unauthenticated remote code execution via crafted IPv6 packets, affecting .NET 8 through 11 on Windows.
An unauthenticated remote code execution vulnerability in Windows Message Queuing affects multiple Windows 10 and 11 builds with a CVSS score of 9.8.
A critical vulnerability in Ivanti Xtraction allows attackers to hijack requests and steal credentials, affecting versions prior to the 2026.4 release.
A TLS configuration error disables authentication globally in HAProxy Data Plane API, allowing unauthenticated access to administrative controls.
Public exploit code targets unpatched Linksys E1700 routers, with vendors failing to respond to early vulnerability disclosure notices.
Unauthenticated attackers can execute server commands via output folder paths in the voice cloning tool’s UVR5 component.
The NVD rates CVE-2026-62086 as critical. ThemeREX’s Juno theme allows remote code execution without credentials in versions up to 2.25.
IBM and Red Hat invite firms to submit code to a new service aiming to fix hundreds of novel library vulnerabilities.