SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments. CVSSv3.1 9.1 (CRITICAL)
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments. CVSSv3.1 9.1 (CRITICAL)
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments. CVSSv3.1 9.1 (CRITICAL)
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments. CVSSv3.1 9.1 (CRITICAL)
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments. CVSSv3.1 9.1 (CRITICAL)
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditio CVSSv3.1 9.3 (CRITICAL)
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloa CVSSv3.1 9.3 (CRITICAL)
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users. CVSSv3.1 8.8 (HIGH)
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and CVSSv3.1 8.4 (HIGH)
BloodHound v9.5.0-rc2 released with dependency resolution updates addressing package vulnerabilities (BED-9026). This is a pre-release candidate containing minimal changelog details beyond a single chore commit.
CVE-2026-11374 is a critical unauthenticated account takeover in ManageEngine's AD360-integrated products (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, ADAudit Plus) where SSO tickets are generated from millisecond-precision wall-clock timestamps, allowing predictable session hijacking. Bishop Fox's analysis reveals the vulnerability is practically difficult to exploit blindly due to layered controls (request throttling, source-IP binding, closed direct oracle), making the realistic threat model a targeted attacker already on the victim's network rather than mass exploitation. The patch replaces timestamp-based tickets with random UUIDs, but leaves the bearer-token design intact, meaning stolen tickets can still be replayed if obtained through other means.
In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier CVSSv3.1 9.8 (CRITICAL)
Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. CVSSv3.1 9.8 (CRITICAL)
Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.1 (CRITICAL)
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. CVSSv3.1 9.8 (CRITICAL)
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.8 (CRITICAL)
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.1 (CRITICAL)
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153. CVSSv3.1 9.1 (CRITICAL)
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVSSv3.1 9.1 (CRITICAL) · EPSS 5th percentile