Vulnerabilities
Curated coverage and analysis in this editorial area.
Atlassian Patches CVE-2026-21589: Path Traversal Hits 8 Data Center Products at CVSS 9.3
Atlassian released fixes on October 5, 2026 for a critical path traversal flaw affecting eight Data Center products. The vulnerability…
Dell System Update Critical 9.6 Bug Opens PowerEdge Servers to Remote Root
A path traversal vulnerability in Dell System Update allows unauthenticated remote code execution with root privileges. Version 2.3.0.…
GitLab Patches Critical RCE in AI Gateway: Self-Hosted Deployments at Risk
CVE-2026-90970, rated CVSS 9.9, allows authenticated users with Duo Agent Platform access to escape the prompt template sandbox and ex…
Meta Muse Zero-Day Turns AI Assistant Into Backdoor: Attack Explained
Patrick Wardle discovered a zero-day in Meta's Muse AI agent for macOS. An undocumented setting, `endo_voyager_dictation_endpoint`, le…
Windows: TOCTOU Bug in dxgkrnl Enables Kernel Escalation With Conflicting CVSS Scores
CVE-2026-50375 in the DirectX Graphics Kernel driver: Microsoft confirms patch and 'More Likely' exploitability, but CVSS scores diver…
TeamViewer Mandates 15.82 Patch for Five High-Severity Cross-Platform Flaws
TeamViewer released version 15.82 on September 30, 2026, to fix five high-severity vulnerabilities affecting Windows, Linux, and macOS…
D-Link Already Declared EOL for DIR-895L; CVE-2026-100740 Gets No Patch
CVE-2026-100740 hits D-Link DIR-895L routers with a CVSS 9.9 score. The vendor declared the series End-of-Life in 2019, ruling out any…
Cisco ThousandEyes: DHCP Client Command Injection Yields Root RCE, Patch Mandatory
A command injection flaw in the DHCP client of Cisco ThousandEyes Virtual Appliance allows remote code execution as root. Cisco has re…
D-Link DIR-822A Zero-Day CVSS 10.0: LAN Vector Renders Vendor Mitigation Useless
D-Link confirmed a maximum-severity zero-day in DIR-822A routers running firmware A_101. A public proof-of-concept exists, no patch is…
Meta Muse macOS: Local Bug Hijacks Dictation to Malicious Servers
Patrick Wardle has disclosed a zero-day vulnerability in Meta Muse for macOS. The endo_voyager_dictation_endpoint setting can be modif…
WordPress Click2Shell: One Admin Click Opens RCE on Millions of Sites
A CSRF vulnerability in WordPress core allows unauthenticated attackers to force a logged-in administrator to install an arbitrary the…
Xreader PDF RCE: Unguarded C Union Exposes Linux Mint to Remote Attack
ZDI-26-715 reveals a type confusion in Xreader's PDF parser that enables arbitrary code execution simply by opening a malicious PDF. T…