Vulnerabilities
itthinx Affiliates CVE-2026-108291 Object Injection Risk Reaches 9.8 CVSS
A critical deserialization flaw in itthinx Affiliates versions up to 7.0.1 demands immediate review by managed service providers to secure client environments.
NVD
Everything BitShield News has reported about NVD: 5 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
CVE-2026-106612: CVSS 9.9 ColdFusion Auth Flaw Enables Code Execution on 2023 and 2025 Versions
A critical authorization flaw in Adobe ColdFusion allows low-privileged attackers to run code without user interaction, affecting versions up to 2023.0.25 and 2025.0.13.
Vulnerabilities
CVSS 9.8: Unauthenticated Windows Message Queuing RCE Hits Windows 10 and 11 Builds
A use-after-free flaw in the Windows Message Queuing Queue Manager allows remote code execution without authentication across multiple OS versions.
Vulnerabilities
Single POST Request Enables Unauthenticated Code Execution in WooCommerce 3D Plugin
The NVD rates this flaw as critical, allowing attackers to bypass authentication checks and run server-side code on vulnerable sites.
Vulnerabilities
9.8 CVSS Score Logged for ThemeREX Rosalinda Deserialization Vulnerability
The National Vulnerability Database rates CVE-2026-93933 as critical, exposing sites running ThemeREX Rosalinda versions up to 1.2.4 to object injection risks.