The openapi-typescript-codegen library contains a critical code injection flaw in versions up to 0.31.0 that enables remote code execution via malicious OpenAPI documents.
Before version 0.5.0, Privasys remote attestation clients allowed attackers to relay valid quotes, bypassing session binding checks.
The National Vulnerability Database rates this critical object injection risk as 9.8, affecting all IPharm versions up to and including 1.2.4.
The NVD rates CVE-2026-93945 as critical, affecting Axiomthemes Balance versions through 1.12.0 with a 9.8 score for untrusted data deserialization.
A critical flaw in PHPNuxBill through version 2025.3.20 allows attackers to guess OTP codes without limits and read new passwords from server responses.
Session fixation attacks bypass login screens by forcing a user to adopt an attacker-controlled identifier, rendering simple cookie expiration strategies ineffective.
Firmware flaws persist because update mechanisms are often manual, air-gapped assumptions are frequently broken, and code complexity hides critical execution paths.
Switching to memory-safe code eliminates buffer overflows but introduces new risks in logic errors and complex dependency management that require different testing strategies.
Open redirects hide in legitimate-looking URLs, allowing attackers to bypass security checks and craft convincing phishing links that steal credentials.
Bundling security fixes into a single monthly window reduces operational chaos but creates a predictable target for attackers who scan for unpatched systems.
Automated patching reduces exposure windows but introduces configuration drift and silent failure modes that manual reviews often miss.
EPSS separates the theoretical severity of a flaw from the statistical likelihood that someone will actively exploit it in the wild within a specific timeframe.
Disabling external entity processing at the parser level neutralizes the threat without requiring application code changes or service restarts.
The US Cybersecurity Agency added a Strapi flaw allowing sensitive data exposure to its exploited vulnerabilities list, setting a strict remediation deadline.
A CVSS 8.5 flaw in the databases-on-aws plugin allowed unauthenticated attackers to run OS commands via crafted inputs.
Unauthenticated attackers can exhaust PHP worker CPU via quadratic-time table parsing in versions prior to 2.10.2.