Realtek WiFi Driver Flaw Gives Any User Root on Affected Devices
A local privilege escalation bug in Realtek’s rtl819x WiFi driver SDK lets any unprivileged user gain full root access. No…
Security
Cybersecurity, vulnerabilities, threats, and defense
MeiG Smart FORGE711 Router Flaw Lets Attackers Run Commands as Root
A serious vulnerability has been discovered in the MeiG Smart FORGE_SLT711, a 4G LTE CPE router. The flaw allows unauthenticated…
Scramble Docs Generator Exposed to Remote Code Execution
The Scramble API documentation generator for Laravel applications contains a critical remote code execution vulnerability. Tracked as CVE-2026-44262, the bug…
EspoCRM 9.3.3 SSRF Bug Lets Attackers Probe Internal Services
EspoCRM 9.3.3 contains a server-side request forgery (SSRF) vulnerability that allows authenticated users to make requests to internal services, potentially…
Casdoor 3.54.1 Patched After Path Traversal Bug Allowed Arbitrary File Writes
A path traversal vulnerability in Casdoor, the open-source identity and access management platform, has been disclosed. Tracked as CVE-2026-6815, the…
strongSwan DoS Bug Lets One Malformed Packet Pin a Worker Thread at 100% CPU
Another strongSwan vulnerability, another pre-auth headache. CVE-2026-35333 affects strongSwan 5.9.13 when the eap-radius plugin is built with DAE (Dynamic Authorization…
strongSwan 5.9.13 Hit by Pre-Auth Heap Overflow in EAP-SIM/AKA
strongSwan versions up to 5.9.13 contain a pre-authentication heap buffer overflow in the libsimaka library. The bug lives in parse_attributes()…
CubeCart Patch Gap: Unauthenticated XSS Still a Threat for Older Stores
An unauthenticated reflected cross-site scripting vulnerability affects CubeCart versions before 6.7.0. Tracked as CVE-2026-44376, it lets an attacker inject malicious…
Wing FTP Server 8.1.3 RCE: Authenticated Admins Can Inject and Execute Lua Code
Wing FTP Server versions up to and including 8.1.2 contain a remote code execution vulnerability that allows an authenticated administrator…
MixPHP Framework 2.2.17 RCE: Unsafe Deserialization Lets Attackers Run Arbitrary Code
A remote code execution vulnerability has been identified in MixPHP Framework versions 2.x through 2.2.17. The flaw, tracked as CVE-2026-42471,…