The Breach Observer CVE Desk is the part of the Breach Observer newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 21 articles so far. See the editorial policy or report an error.
A code generation flaw in Quarkus removes security constraints when developers use custom annotations, creating critical unauthenticated access risks.
A critical flaw in HAProxy Data Plane API allows unauthenticated access to management endpoints when specific TLS configurations are active.
A critical vulnerability in Linksys E1700 firmware allows remote OS command injection, with public exploit code now available.
A critical vulnerability in the Bricksforge plugin allows unauthenticated remote code execution, with active wild exploitation confirmed by security researchers.
Five states sue TP-Link over security claims and disclosure issues, raising questions for existing router owners about legal status and safety.
Citrix urges immediate patching for a 9.5-severity remote code execution vulnerability in NetScaler ADC and Gateway products.
A critical path traversal flaw in the PPOM plugin allows unauthenticated attackers to delete files and read data, risking full site takeover.
AWS Security Bulletins detail two flaws in Ops Wheel, prompting immediate review of infrastructure configurations and access controls.
AWS has published an advisory for a remote code execution flaw in the Amazon Redshift JDBC driver that requires immediate attention from security teams.
AWS has issued security bulletins for five vulnerabilities in the containerd CRI plugin, urging organisations to assess their exposure to potential container escapes.
A critical blind SQL injection vulnerability in the Shinetheme Traveler WordPress plugin exposes sites running versions up to 3.2.9 to severe data theft risks.
Attackers with admin access can exploit CVE-2026-107806 to run arbitrary code by manipulating backup restoration processes in vulnerable versions.
Authenticated users can run arbitrary commands on executor hosts via a command injection flaw in the std.ssh_proxied action.
A critical remote code execution vulnerability in Handlebars allows attackers to inject JavaScript via manipulated abstract syntax trees, bypassing recent safety checks.
A high-severity flaw in fast-jwt permits signed JWTs with array payloads to skip expiry and issuer checks, risking token forgery in affected applications.
A lack of input validation in the Savannah lwIP SMTP client creates a severe buffer overflow vector, rated 9.8 by the NVD.
TVU Networks confirms a critical authentication bypass in pre-7.9 firmware allows remote takeover via crafted login requests.
A critical vulnerability in TVU Networks devices allows attackers to steal data and hijack DNS settings without any form of login or authentication.
A flaw in the recent security update for fast-jwt allows attackers to forge tokens by bypassing public key detection, restoring a critical vulnerability.
A critical vulnerability in the Microsoft Partner Center allows remote attackers to elevate privileges through improper certificate handling.
Citrix has issued patches for a critical memory overflow in NetScaler ADC and Gateway that allows remote code execution or denial of service.
