Vulnerabilities coverage from TechSec Headlines holds 44 articles, 21 of them reference guides. The newest was published on October 17, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include OWASP Top Ten and FIRST: Common Vulnerability Scoring System.
Commented-out code in Webreaper Damselfly 4.5.3 removes authentication checks, allowing unauthenticated users to create admin accounts and reset passwords.
A timing flaw in the LatePoint WordPress plugin allows attackers to bypass login limits and steal customer accounts without credentials.
Hidden PHP flaws often hide in file upload handlers and session management logic, bypassing standard input validation checks that secure most other web applications.
Disputed CVEs signal vendor disagreement with a finding, while rejected CVEs indicate the issue was never a valid security vulnerability.
BOLA exploits occur when an API trusts client-side IDs without verifying the user owns the resource, allowing attackers to access data they should not see.
Most sandbox escapes occur because developers grant unnecessary permissions or fail to sanitize data that crosses isolation boundaries.
Authenticated users with query permissions can exploit CVE-2026-110812 to run arbitrary code and steal credentials in affected Neptune versions.
Most extension risks stem from permission creep and supply chain failures, not just malicious code injection or direct network attacks.
Scanners rely on static signatures rather than runtime behavior, meaning they miss logic flaws that only appear when code executes in a live environment.
WebSocket connections often inherit HTTP session cookies, allowing attackers to hijack active sessions without brute-forcing credentials or exploiting complex injection flaws.
Time-of-check to time-of-use bugs hide in race conditions where file permissions change between verification and execution, allowing attackers to bypass security controls entirely.
Malicious packages hijack your build pipeline by exploiting human error in package names, turning trusted dependency managers into delivery vehicles for code execution.
Theme vulnerabilities bypass server defenses by turning trusted design files into execution paths that steal data or take control of the site without needing admin credentials.
Unauthenticated attackers can forge tokens using a default secret to impersonate administrators and gain full control of the platform.
Fortinet’s FortiGuard PSIRT reported a flaw allowing unauthenticated access to certain endpoints through crafted HTTP requests in the Fabric API.
A flaw in the GlobalProtect app on macOS allows local users to gain root access. Patches are available for affected versions.
An authenticated admin can run arbitrary OS commands via the OS Query pack in Cortex XSOAR or XSIAM, requiring a specific integration setup.
The vendor confirms active but restricted abuse of its gateway software, urging immediate upgrades and integrity checks for affected users.
A critical origin validation error in Legacy Update ActiveX controls lets malicious web pages install updates and restart PCs without user consent.
Directory services treat user input as executable code, allowing attackers to bypass authentication by manipulating the query syntax rather than guessing credentials.
Microsoft identifies a critical vulnerability in Windows Shell that permits remote code execution via a heap-based buffer overflow.
Unsupported software creates permanent attack surfaces that no firewall can close because the vendor stops fixing the code that runs your critical operations.
Unpatched legacy systems create hidden attack surfaces that grow exponentially in risk while shrinking your operational budget over time.
A critical flaw in Adobe Experience Manager allows remote code execution without user interaction, impacting versions up to 6.5.25.