Vulnerabilities
Update Adobe Acrobat to Block AI-Found PDF Code Execution Flaw
Adobe patched a high-severity flaw in Acrobat and Reader that lets malicious PDFs run code. Users must install the latest build to stay safe.
Crypt Weekly Flaw Tracker Desk
The Crypt Weekly Flaw Tracker Desk is the part of the Crypt Weekly newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 31 articles so far. See the editorial policy or report an error.
Vulnerabilities
Update SQL Server 2019-2025 to Stop Authenticated Remote Code Execution
Microsoft warns that authorized attackers can run remote code on SQL Server versions 2019 through 2025 via a high-severity deserialization flaw.
Vulnerabilities
Update Cisco SEG Appliances to Block Unauthenticated Root Access from CVE-2026-76519
Attackers are exploiting a critical flaw in Cisco email security systems to gain full control. Users must update software to block remote command execution.
Vulnerabilities
Update SharePoint Server to Block High-Severity Privilege Escalation Flaw
Microsoft issued a patch for a high-severity authorization flaw in SharePoint Server that allows attackers to gain higher system privileges.
Vulnerabilities
Fortinet Confirms Critical 9.6 Score for FortiSandbox GUI Authentication Bypass
A remote attacker can bypass login on FortiSandbox using crafted requests, creating a high-risk exposure for organizations using the appliance.
Vulnerabilities
Patch Prisma Browser to fix high-severity CSRF and auth flaws in vulnerable versions
Palo Alto Networks released a patch for Prisma Browser to address multiple high-severity security flaws inherited from the Chromium engine.
Vulnerabilities
Patch Junos OS to Block Unauthenticated RCE via CVE-2026-101986 in J-Web
A critical flaw in Juniper J-Web lets attackers bypass login screens and run commands on network devices without any credentials.
Vulnerabilities
Update Whisper-node to Prevent Critical Command Injection Exploits
A critical flaw in Whisper-node 1.1.1 allows attackers to run system commands by manipulating file paths and language options.
Vulnerabilities
Patch Stills Immediately: Critical OS Command Injection Flaw in Versions Before 25.24.2 Allows Remote Code Execution
A critical OS command injection flaw in Stills allows attackers to run shell commands via crafted file paths, requiring an immediate update for users.
Vulnerabilities
Upgrade .NET 8-11 to Stop Remote Code Execution Via Pixel-Shader Bytecode in WPF
Microsoft released patches for a high-severity out-of-bounds write flaw in .NET WPF that lets attackers run code over a network.
Vulnerabilities
Update ASP.NET Core to 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2 to Fix Auth Bypass
Microsoft released patches for a high-severity race condition in ASP.NET Core that lets attackers bypass authorization checks and elevate privileges.
Vulnerabilities
Update Abandoned Cart Pro to Fix Critical SQL Injection Allowing Remote Admin Control
A critical flaw in the Abandoned Cart Pro plugin allows attackers to seize full control of WordPress sites without logging in.
Vulnerabilities
Secure Windows DNS against CVE-2026-83869: Critical Integer Underflow Enables Unauthenticated Remote Code Execution
An unpatched integer underflow in Windows DNS allows unauthorized attackers to run code remotely, rated 9.8 by NVD.
Vulnerabilities
Update Adobe AEM to Fix Critical XSS Session Hijack Vulnerability CVE-2026-83662
A critical cross-site scripting flaw in Adobe Experience Manager allows attackers to hijack sessions if users visit malicious URLs.
Vulnerabilities
Update Adobe ColdFusion 2023/2025 to block CVE-2026-75994 Critical Auth Flaw
A critical authorization flaw in Adobe ColdFusion allows attackers to run code without user interaction, affecting 2023 and 2025 versions.
Vulnerabilities
Check FortiSIEM Access Controls for Low-Severity Broken Authorization Flaw
FortiSIEM has a missing authorization issue in its GUI that allows logged-in users to run unauthorized code via crafted requests.
Vulnerabilities
Dragonfly DB Users Must Upgrade Past 1.40 to Mitigate Unauthenticated Remote Code Execution Risk
A critical double-free flaw in older Dragonfly DB versions allows attackers to run code on servers without authentication credentials.
Vulnerabilities
Upgrade Wazuh Manager to 4.14.8 to Stop Remote Root Access Flaw
A logic error in Wazuh versions before 4.14.8 allows authenticated users to bypass validation and run commands as root on the server.
Vulnerabilities
Patch Obsidian-TC to 1.3.1 to Fix CVSS 9.9 Cross-Vault Data Manipulation Flaw
A critical flaw in Obsidian-TC versions before 1.3.1 allows attackers with valid tokens to read, write, or delete data in any configured vault.
Vulnerabilities
Patch Thelia 2.6.0 and 2.6.1 to Block Remote Code Execution Risks
CERT/CC warns that multiple flaws in Thelia e-commerce software allow attackers to execute code, steal credentials, and hijack user sessions.
Vulnerabilities
Patch BotSharp 5.2.0 to Stop Critical Authentication Bypass via Hardcoded Keys
A critical flaw in BotSharp allows attackers to forge admin tokens using a hardcoded secret, enabling full system compromise.
Vulnerabilities
ThemeREX Smart Casa Users Must Upgrade Past v1.0.12 to Fix Critical CVE-2026-93932 Deserialization Flaw
The National Vulnerability Database rates a deserialization flaw in ThemeREX Smart Casa as critical, affecting versions up to 1.0.12 with a CVSS score of 9.8.
Vulnerabilities
Update ThemeREX Tantra CMS to mitigate critical CVE-2026-93930 object injection vulnerability
The NVD rates CVE-2026-93930 as critical for ThemeREX Tantra CMS versions through 2.9.0, exposing users to object injection risks.
Vulnerabilities
Update Equadio to 1.1.5 to Fix Critical CVE-2026-62087 PHP Injection
Unauthenticated attackers can exploit CVE-2026-62087 in Equadio versions 1.1.4 and earlier to inject malicious PHP objects.