The BitShield News Flaw Tracker Desk is the part of the BitShield News newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 31 articles so far. See the editorial policy or report an error.
A critical flaw in LMCache allows unauthenticated remote code execution on exposed ZeroMQ ports, risking full system compromise for multi-node deployments.
A severe SQL injection flaw in the Mang Board WordPress plugin exposes sites running versions up to 2.4.4 to potential database compromise, according to National Vulnerability Database records.
A fixed challenge response vulnerability in Mitsubishi Electric GENESIS and related products allows remote attackers to unlock systems and access internal data without valid credentials.
AWS releases patch for CVE-2026-15737, urging users to purge sensitive AI prompts from logs and upgrade their Python SDK packages immediately.
XenServer 8.4 and 9 require urgent attention due to four newly disclosed flaws, including a complex race condition in the grant table subsystem.
Cisco released hardening updates for its Secure Email Gateway and Web Manager. Two vulnerabilities are under active exploitation with no workarounds.
A critical flaw in Juniper routing daemons allows configured peers to execute root code or crash services. MSPs must assess exposure immediately.
A stack overflow in J-Web allows attackers to execute code remotely on 12 distinct Junos OS and Evolved branches without credentials.
A critical stack-based buffer overflow in Juniper routing daemons allows remote peers to execute code or crash services, affecting multiple OS versions.
A critical flaw in transcribe2texts allows attackers to execute system commands via crafted audio paths, granting Node.js process privileges to malicious actors.
A critical deserialization flaw in itthinx Affiliates versions up to 7.0.1 demands immediate review by managed service providers to secure client environments.
Unauthenticated requests can trigger unbounded memory growth in ASP.NET Core localization logic, requiring immediate updates to patched runtime versions.
A heap-based buffer overflow in Windows iSCSI allows unauthorized remote code execution, carrying a CVSS score of 9.8 according to the National Vulnerability Database.
A critical authorization flaw in Adobe ColdFusion allows low-privileged attackers to run code without user interaction, affecting versions up to 2023.0.25 and 2025.0.13.
A CVSS 9.8 vulnerability in Adobe Commerce and Magento Open Source allows attackers to run arbitrary code without user interaction.
A use-after-free flaw in the Windows Message Queuing Queue Manager allows remote code execution without authentication across multiple OS versions.
A revised advisory rates a local double free vulnerability as low severity, affecting authenticated users on FortiOS, FortiProxy, and FortiSwitch devices.
Attackers are exploiting two critical flaws in Citrix NetScaler ADC and Gateway appliances to deploy persistent backdoors on exposed edge devices.
A critical vulnerability in Perforce Helix Authentication Service allows remote code execution through a default token chain, affecting versions up to 2025.2.
A critical vulnerability in Netherman Portal del Hermano allows attackers to bypass authentication and seize control of any user account across all tenants.
ThemeREX Stargaze versions up to 1.10 contain a critical CVE-2026-62051 flaw allowing unauthenticated PHP object injection, posing immediate risks to managed sites.
WatchTowr Labs reveals four linked vulnerabilities in PaperCut software that allow remote code execution without credentials and evade existing fixes.
Attackers can execute arbitrary JavaScript in generated clients by injecting unescaped values into OpenAPI documents, affecting versions up to 0.31.0.
The NVD rates this flaw as critical, allowing attackers to bypass authentication checks and run server-side code on vulnerable sites.