The DataSafe Radar Flaw Tracker Desk is the part of the DataSafe Radar newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 14 articles so far. See the editorial policy or report an error.
Security firms detected active exploitation of a critical, unauthenticated flaw in SonicWall appliances shortly after the vendor issued a fix.
A critical vulnerability in IBM DataStage allows authenticated attackers to crash services via path traversal, posing significant operational risks.
Researchers found a severe code injection bug in Linksys E1700 firmware version 1.0.0.4.003. The vendor did not respond to early outreach about the issue.
A CVSS 9.8 critical vulnerability allows subscribers to escalate privileges in Sergey AIWU versions through 1.5.9, posing severe risks to system integrity.
A critical vulnerability in versions up to 4.8.2 allows attackers to inject PHP objects without logging in, posing severe risks to store security.
Amazon Web Services issued a security bulletin for CVE-2026-11931, highlighting insecure permissions on token cache files in its Kiro IDE product.
A CVSS 9.8 flaw in the Partiso theme allows object injection through untrusted data deserialization in versions prior to 1.1.13.
Unauthenticated attackers can take over any WordPress account, including administrators, by exploiting missing validation in the WPCOM Member plugin’s social login flow.
The NVD rates CVE-2026-62045 as critical because untrusted data deserialization allows object injection in the Booklovers theme.
A critical vulnerability in PHPNuxBill enables attackers to hijack accounts by brute-forcing password reset codes, with no attempt limits in place.
A critical flaw in Privasys rustls allows attackers to relay quotes, bypassing enclave attestation checks in TLS connections before version 0.8.1.
A deserialization flaw in ThemeREX Tantra CMS versions up to 2.9.0 carries a CVSS 9.8 score, allowing remote object injection attacks.
A critical vulnerability in the Hogwords plugin allows object injection, posing severe risks to WordPress sites running version 1.2.7 or earlier.
Remote attackers can execute unauthorized SQL commands in IBM Guardium versions 12.0 through 12.2 due to a critical input validation flaw.