The DataSafe Times Vulnerability Desk is the part of the DataSafe Times newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 14 articles so far. See the editorial policy or report an error.
A critical flaw in Privasys ra-tls-clients allowed endpoint impersonation by accepting unverified platform identities, now fixed in version 0.11.0.
A critical flaw in Wavlink firmware version 251117 allows remote attackers to execute arbitrary OS commands via a CGI script.
A critical flaw in Metasploit Framework 6.5.4 lets attackers delete stored credentials without authentication, exposing sensitive data on default ports.
Unauthenticated attackers can execute server-side commands via manipulated output folder paths in the GPT-SoVITS voice cloning tool, according to the NVD.
A critical flaw in sandboxed.sh allows container code to bypass isolation and access the host filesystem, rated 9.3 by the NVD.
ThemeREX WineShop versions up to 3.20 contain a critical unauthenticated PHP object injection flaw rated 9.8 CVSS with no confirmed patch available yet.
The openapi-typescript-codegen library contains a critical code injection flaw in versions up to 0.31.0 that enables remote code execution via malicious OpenAPI documents.
Before version 0.5.0, Privasys remote attestation clients allowed attackers to relay valid quotes, bypassing session binding checks.
The National Vulnerability Database rates this critical object injection risk as 9.8, affecting all IPharm versions up to and including 1.2.4.
The NVD rates CVE-2026-93945 as critical, affecting Axiomthemes Balance versions through 1.12.0 with a 9.8 score for untrusted data deserialization.
A critical flaw in PHPNuxBill through version 2025.3.20 allows attackers to guess OTP codes without limits and read new passwords from server responses.
The US Cybersecurity Agency added a Strapi flaw allowing sensitive data exposure to its exploited vulnerabilities list, setting a strict remediation deadline.
A CVSS 8.5 flaw in the databases-on-aws plugin allowed unauthenticated attackers to run OS commands via crafted inputs.
Unauthenticated attackers can exhaust PHP worker CPU via quadratic-time table parsing in versions prior to 2.10.2.