Vulnerabilities
AWS releases jsii-diff 1.131.0 to patch CVE-2026-15895 shell execution flaw in utility
A flaw in the AWS jsii-diff utility allowed shell execution via crafted arguments. Version 1.131.0 resolves the issue.
TechSec Observer Patch Watch Desk
The TechSec Observer Patch Watch Desk is the part of the TechSec Observer newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 20 articles so far. See the editorial policy or report an error.
Vulnerabilities
Mitsubishi Electric GENESIS64 Critical Flaw Lets Admins Run Code Without UAC Elevation
A critical vulnerability in Mitsubishi Electric’s industrial software suite allows attackers with admin access to bypass security controls and execute code remotely.
Vulnerabilities
Authenticated users can exploit CVE-2026-68883 to escalate privileges in SQL Server 2017-2022
A high-severity flaw in SQL Server lets authenticated users elevate privileges via a network-based heap buffer overflow.
Vulnerabilities
Microsoft Fixes High-Severity Access Heap Overflow in Office Apps
A heap-based buffer overflow in Office Access enables remote code execution. Microsoft has released patches for Enterprise and LTSC deployments.
Vulnerabilities
FortiGuard Alerts on FortiManager fgfmd OS Injection Flaw Allowing Cluster Node Code Execution
A medium-severity OS command injection bug in FortiManager’s fgfmd daemon allows attackers with cluster credentials to run arbitrary code on the system.
Vulnerabilities
@mborne/extract OS Command Injection Risks Node.js Process Privileges
A critical vulnerability in the @mborne/extract library allows attackers to execute system commands via shell metacharacters in path options.
Vulnerabilities
Stills 25.24.2 Fixes Critical CVE-2026-110649 OS Command Injection Vulnerability
A critical OS command injection flaw in Stills allows attackers to execute shell commands via crafted file paths, requiring immediate updates for affected users.
Vulnerabilities
Juniper SRX CVE-2026-33792: Critical Buffer Overflow in srxpfe Grants Root Access via GRE Packets
A critical buffer overflow in Juniper SRX firewalls allows attackers to run code as root via crafted GRE packets, affecting multiple Junos OS release branches.
Vulnerabilities
Microsoft issues .NET 8-11 patches to seal Windows Desktop remote info disclosure flaw across all architectures
A remote information disclosure flaw in Windows Desktop runtimes has been fixed in updated NuGet packages for versions 8, 9, 10 and 11.
Vulnerabilities
Microsoft patches .NET 8-11 Pkcs flaw causing unauthenticated CPU exhaustion via malformed X.509 data
Microsoft has released updates for System.Security.Cryptography.Pkcs to address a high-severity denial of service vulnerability triggered by inefficient algorithmic complexity.
Vulnerabilities
CVSS 9.8: Printcart Store Google Drive Endpoint Flaw Enables Unauthenticated RCE on v2.9.1
A critical flaw in the Printcart Store plugin allows attackers to upload malicious files and execute code on servers running versions up to 2.9.1 without needing valid credentials.
Vulnerabilities
Microsoft Flags Critical AD FS Crypto Verification Failure CVE-2026-96252 Enabling Network Spoofing Attacks
A critical cryptographic verification failure in Active Directory Federation Services allows unauthorised network-based spoofing attacks against infrastructure.
Vulnerabilities
GitHub patches npm Trusted Publishing flaw that allowed package hijacking
Researchers showed how reclaiming old GitHub repository names enabled attackers to publish malicious npm package versions without stealing credentials.
Vulnerabilities
CVE-2020-37279: easy-pdf-merge 0.2.6 Path Injection Grants Node.js Process Privileges to Attackers
The National Vulnerability Database rates CVE-2020-37279 as critical, noting that attackers can execute system commands by injecting specific characters into file paths or options.
Vulnerabilities
NVD Rates Square Squash YAML Flaw Critical 9.2 CVSS Score for Unauthenticated RCE
Unauthenticated attackers can exploit CVE-2026-109391 to execute arbitrary Ruby code in Square Squash via crafted YAML input.
Vulnerabilities
OTRS CE 6 Allows Auth Bypass via Remote-User Header in CGI Deployments
A critical flaw in OTRS Community Edition 6 lets attackers impersonate users by spoofing headers, bypassing password checks entirely.
Vulnerabilities
Remote attackers execute code on Equadio 1.1.4 via unauthenticated PHP injection CVE-2026-62087
A severe vulnerability in Equadio versions up to 1.1.4 allows remote attackers to execute arbitrary code without authentication.
Vulnerabilities
Privasys rustls v0.8.1 patches CVE-2026-108266 to stop quote relay attacks that bypass enclave attestation
A critical vulnerability in Privasys rustls allowed attackers to bypass enclave attestation via quote relay, now resolved in version 0.8.1.
Vulnerabilities
NVD Assigns 9.8 Score to ThemeREX Dwell Deserialization Weakness Enabling Object Injection
A deserialization weakness in ThemeREX Group Dwell allows object injection, rated 9.8 CVSS by the NVD for versions through 1.16.0.
Vulnerabilities
Nginx UI 2.5.0 blocks remote attackers from hijacking configs via unvalidated browser cookies
A high-severity CSRF vulnerability in Nginx UI versions 2.0.0 through 2.4.3 allows remote attackers to modify web server configurations by exploiting browser-managed authentication cookies.