Octopus Server Deserialization Bug Opens Deployment Systems to Code Execution
A high-severity Octopus Server vulnerability lets sufficiently privileged authenticated users execute code through malicious JSON. There is no workaround, making upgrades urgent for self-hosted deployment environments that hold...
OpenCode Web Interface Flaw Let Hostile Sites Run Commands on Developer PCs
A flaw in OpenCode’s local web interface allowed a malicious website to turn an upgrade request into code execution on a developer machine. Version 1.18.22 fixes both the...
SharePoint Code-Injection Bug Joins CISA’s Must-Patch List After Real-World Attacks
CISA has added a Microsoft SharePoint code-injection flaw, CVE-2026-65660, to its Known Exploited Vulnerabilities catalog after confirming it is being used in live attacks. The agency gave federal...
Two Reported NetScaler Zero-Days Put Internet-Facing Gateways on Emergency Watch
Researchers say two undisclosed Citrix NetScaler remote-code-execution flaws are already being used in attacks, although vendor confirmation and technical indicators remain pending. Defenders should inventory exposed appliances, preserve...
Wireshark Update Fixes 19 Flaws That Turn Untrusted Captures Into Workstation Risk
Wireshark 4.6.9 and 4.4.19 address 19 documented vulnerabilities, including a configuration-profile flaw that may permit code execution. Security teams should update analyst workstations and treat captures, profiles and...
Unsigned JWT Flaw Opened Microsoft Analytics Service to Administrator Access
A missing signature check in Microsoft’s internal Titan analytics service allowed a forged token to obtain administrator privileges and query connected databases. Microsoft closed the public endpoint after...
Actively Exploited Linux Kernel Race Condition Enables Root and Container Escape
A race condition in Linux’s AF_ALG cryptographic interface can give an unprivileged local attacker root access and may support Docker container escape. CISA lists CVE-2025-39964 as exploited in...
ServiceNow Rushes Fixes for Five AI Platform Bugs After Two Are Rated Critical
ServiceNow has patched five vulnerabilities in its AI Platform, including a SQL injection flaw and a missing-authorization bug that together could let an unauthenticated attacker read, alter, or...