Vulnerabilities
Submit Java Code to IBM Red Hat Lightwell for Automated Vulnerability Scanning and Remediation
The Lightwell initiative has found 400 new vulnerabilities in Java libraries and opened a service for customers to submit code for review.
Crypt Weekly Flaw Tracker Desk
Vulnerabilities
Secure AhsayCBS Servers Against Active Webshell and Crypto Miner Exploits
Threat actors are actively exploiting unpatched flaws in the AhsayCBS backup management platform to deploy webshells and run cryptocurrency miners on victim servers.
Vulnerabilities
Install Vikunja 2.4.0 to Fix Critical CVE-2026-68582 That Leaks Unrelated Project Data via Unvalidated View IDs
A critical flaw in Vikunja task manager allows attackers with any share link to access sensitive data from unrelated projects via unvalidated view IDs.
Vulnerabilities
Upgrade Axiomthemes Balance Past 1.12.0 to Block CVSS 9.8 Remote Code Execution
Sites running Axiomthemes Balance versions 1.12.0 or earlier face severe risk from CVE-2026-93945, a deserialization issue allowing remote code execution.
Vulnerabilities
Update PHPNuxBill before 2025.3.21 to block unauthenticated OTP guessing and credential theft in password resets
A critical flaw in PHPNuxBill allows attackers to guess password reset codes without limits, enabling full account takeover for any known user.
Vulnerabilities
Update TinaCMS to Block GraphQL Exploits in Preview Iframes That Hijack Editor Sessions
Attackers exploit CVE-2026-108261 to hijack editor sessions via unvalidated preview iframes, granting full content access.
Vulnerabilities
Patch IBM DataPower 10.5-11.0 Now to Block Unauthenticated Remote Code Execution via Critical Buffer Overflow
A critical buffer overflow in IBM DataPower Gateway versions 10.5 through 11.0 allows remote attackers to execute code without authentication.