Vulnerabilities
Implement bug bounty triage: the workflow that stops noise
Proper triage separates genuine security flaws from configuration errors, preventing developer burnout while ensuring critical vulnerabilities receive immediate attention.
Vulnerabilities
Vulnerabilities coverage from TechSec Observer holds 41 articles, 21 of them reference guides. The newest was published on October 16, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include OWASP Top Ten and FIRST: Common Vulnerability Scoring System.
Vulnerabilities
IoT Patching Mistakes: 7 Errors That Leave Devices Exposed
Firmware updates often bypass standard application security controls, creating a silent gap where known vulnerabilities remain active on deployed hardware for years.
Vulnerabilities
Prevent Business Logic Vulnerabilities: 4 Proven Measures
Automated scanners miss logic flaws because they cannot understand the intended workflow, requiring manual threat modelling to find the gap.
Vulnerabilities
Regular Expression Denial of Service Prevention Checklist
Catastrophic backtracking in regular expressions turns pattern matching into an exponential resource drain that exposes services to denial of service attacks.
Vulnerabilities
Container Escape Vulnerabilities: Mechanisms, Risks and Defences
Container isolation relies on kernel features that can be bypassed, turning a lightweight runtime into a full host compromise vector.
Vulnerabilities
CVE Monitoring: How to Filter Noise and Track Real Risk
Tracking every published vulnerability creates operational blindness, forcing teams to ignore critical flaws buried under thousands of low-risk alerts.
Vulnerabilities
Vulnerability Remediation SLAs: 8 Practices for Faster Patching
Static time limits ignore deployment friction, causing teams to patch low-risk issues first while critical flaws remain exposed in production systems.
Vulnerabilities
Out-of-Bounds Write Myths: 6 False Beliefs About Memory Safety
Memory safety violations persist not because detection is impossible, but because developers misinterpret the scope and severity of unvalidated memory access patterns.
Vulnerabilities
GitHub Actions Workflow Injection Explained: How to Stop Code Theft
Attackers manipulate environment variables to inject malicious code directly into your build scripts, bypassing standard code review processes entirely.
Vulnerabilities
WordPress Theme Vulnerabilities: Mechanics, Risks and Mitigation
Theme code executes with server privileges, meaning a single insecure template file can grant attackers full control over the database and file system.
Vulnerabilities
AWS releases jsii-diff 1.131.0 to patch CVE-2026-15895 shell execution flaw in utility
A flaw in the AWS jsii-diff utility allowed shell execution via crafted arguments. Version 1.131.0 resolves the issue.
Vulnerabilities
Mitsubishi Electric GENESIS64 Critical Flaw Lets Admins Run Code Without UAC Elevation
A critical vulnerability in Mitsubishi Electric’s industrial software suite allows attackers with admin access to bypass security controls and execute code remotely.
Vulnerabilities
Authenticated users can exploit CVE-2026-68883 to escalate privileges in SQL Server 2017-2022
A high-severity flaw in SQL Server lets authenticated users elevate privileges via a network-based heap buffer overflow.
Vulnerabilities
Microsoft Fixes High-Severity Access Heap Overflow in Office Apps
A heap-based buffer overflow in Office Access enables remote code execution. Microsoft has released patches for Enterprise and LTSC deployments.
Vulnerabilities
FortiGuard Alerts on FortiManager fgfmd OS Injection Flaw Allowing Cluster Node Code Execution
A medium-severity OS command injection bug in FortiManager’s fgfmd daemon allows attackers with cluster credentials to run arbitrary code on the system.
Vulnerabilities
@mborne/extract OS Command Injection Risks Node.js Process Privileges
A critical vulnerability in the @mborne/extract library allows attackers to execute system commands via shell metacharacters in path options.
Vulnerabilities
Stills 25.24.2 Fixes Critical CVE-2026-110649 OS Command Injection Vulnerability
A critical OS command injection flaw in Stills allows attackers to execute shell commands via crafted file paths, requiring immediate updates for affected users.
Vulnerabilities
Juniper SRX CVE-2026-33792: Critical Buffer Overflow in srxpfe Grants Root Access via GRE Packets
A critical buffer overflow in Juniper SRX firewalls allows attackers to run code as root via crafted GRE packets, affecting multiple Junos OS release branches.
Vulnerabilities
Microsoft issues .NET 8-11 patches to seal Windows Desktop remote info disclosure flaw across all architectures
A remote information disclosure flaw in Windows Desktop runtimes has been fixed in updated NuGet packages for versions 8, 9, 10 and 11.
Vulnerabilities
Microsoft patches .NET 8-11 Pkcs flaw causing unauthenticated CPU exhaustion via malformed X.509 data
Microsoft has released updates for System.Security.Cryptography.Pkcs to address a high-severity denial of service vulnerability triggered by inefficient algorithmic complexity.
Vulnerabilities
CVSS 9.8: Printcart Store Google Drive Endpoint Flaw Enables Unauthenticated RCE on v2.9.1
A critical flaw in the Printcart Store plugin allows attackers to upload malicious files and execute code on servers running versions up to 2.9.1 without needing valid credentials.
Vulnerabilities
Microsoft Flags Critical AD FS Crypto Verification Failure CVE-2026-96252 Enabling Network Spoofing Attacks
A critical cryptographic verification failure in Active Directory Federation Services allows unauthorised network-based spoofing attacks against infrastructure.
Vulnerabilities
Secure Code Review: Mechanism, Limits and Hidden Costs
Static analysis misses logic flaws, while manual review misses scale, requiring a layered approach to catch real defects before deployment.
Vulnerabilities
Content Security Policy Implementation for Small Business Security
Content Security Policy blocks script injection at the browser level, providing a defence layer that operates independently of server-side code quality or application logic flaws.