The TechSec Headlines Patch Watch Desk is the part of the TechSec Headlines newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 23 articles so far. See the editorial policy or report an error.
Commented-out code in Webreaper Damselfly 4.5.3 removes authentication checks, allowing unauthenticated users to create admin accounts and reset passwords.
A timing flaw in the LatePoint WordPress plugin allows attackers to bypass login limits and steal customer accounts without credentials.
Authenticated users with query permissions can exploit CVE-2026-110812 to run arbitrary code and steal credentials in affected Neptune versions.
Unauthenticated attackers can forge tokens using a default secret to impersonate administrators and gain full control of the platform.
Fortinet’s FortiGuard PSIRT reported a flaw allowing unauthenticated access to certain endpoints through crafted HTTP requests in the Fabric API.
A flaw in the GlobalProtect app on macOS allows local users to gain root access. Patches are available for affected versions.
An authenticated admin can run arbitrary OS commands via the OS Query pack in Cortex XSOAR or XSIAM, requiring a specific integration setup.
The vendor confirms active but restricted abuse of its gateway software, urging immediate upgrades and integrity checks for affected users.
A critical origin validation error in Legacy Update ActiveX controls lets malicious web pages install updates and restart PCs without user consent.
Microsoft identifies a critical vulnerability in Windows Shell that permits remote code execution via a heap-based buffer overflow.
A critical flaw in Adobe Experience Manager allows remote code execution without user interaction, impacting versions up to 6.5.25.
A critical vulnerability in Adobe ColdFusion allows attackers to execute arbitrary code without user interaction, affecting multiple recent versions.
Unpatched ColdFusion servers face critical risk from low-privilege attackers who can run arbitrary code without user interaction.
Huntress researchers report active exploitation of two unpatched AhsayCBS flaws to deploy webshells and disguised cryptocurrency miners on managed service provider servers.
A critical flaw in Agnaistic Agnai versions through 1.0.555 exposes fixed admin passwords and JWT secrets, enabling remote attackers to seize full control.
A critical flaw in BotSharp allows attackers to forge admin tokens using a secret key stored in the application's configuration file.
A critical vulnerability in Privasys rustls allows attackers to reuse enclave quotes, bypassing security checks until users update to version 0.8.1.
A high-severity flaw in OpenStack Mistral allows authenticated users to run arbitrary commands on the server, bypassing SSH connection checks.
A critical remote code execution flaw in Handlebars allows attackers to bypass security controls through a prototype pollution technique.
US and allied agencies seized domains linked to Beijing-based Integrity Tech, disrupting tools used to scan and infiltrate critical infrastructure.
Remote attackers can seize full administrative control of TVU broadcast devices by exploiting a login flaw that ignores username requirements in older firmware versions.
A high-severity flaw in the databases-on-aws plugin allowed remote attackers to run arbitrary commands. Version 1.7.1 patches the issue.
Cisco releases security updates for APIC addressing command injection and unauthorized file access vulnerabilities requiring administrative credentials.