Security Advisories
Disclosure bulletins
Dated advisories from research and client engagements — severity, affected products, technical root cause, and remediation guidance, published under coordinated disclosure.
96 advisories published
ProFTPD CVE-2015-3306: Analyzing the Critical mod_copy Vulnerability
The ProFTPD improper access control vulnerability (CVE-2015-3306) allows unauthenticated remote attackers to write arbitrary files and execute code.
CVE-2021-3199: Unauthenticated Remote Code Execution in ONLYOFFICE Docs
A critical path traversal flaw in ONLYOFFICE Docs (CVE-2021-3199) allows unauthenticated attackers to execute arbitrary code via JWT image upload params.
Strapi CVE-2023-22894: Query Filter Secrets Leak Enables RCE Chaining
Strapi CVE-2023-22894 exposes sensitive data via query filters, enabling attackers to chain it with CVE-2023-22621 for remote code execution.
Apache Struts Command Injection Vulnerability (CVE-2016-3081): Technical Analysis
Apache Struts CVE-2016-3081 allows remote code execution via Dynamic Method Invocation. Learn how S2-032 works and how to secure legacy Struts apps.
Citrix NetScaler Flaw CVE-2026-88779 Exposes Edge Infrastructure to Denial of Service
Citrix NetScaler ADC and Gateway devices face a memory buffer vulnerability (CVE-2026-88779) that can trigger denial of service on edge appliances.
Critical Zammad Session Fixation Vulnerability Enables Remote Code Execution…
A critical session fixation vulnerability in Zammad (CVE-2026-102489) enables unauthenticated remote code execution. Upgrade affected instances immediately.
Escalating to Root: Analyzing the Critical Zammad Vulnerability (CVE-2026-102490)
CVE-2026-102490 allows attackers to escalate privileges from the local zammad user to root in Zammad helpdesk instances. Learn how to patch now.
CVE-2026-104286: Critical Arbitrary File Write in Fortinet FortiMail
Fortinet FortiMail faces a critical path traversal flaw (CVE-2026-104286) allowing unauthenticated attackers to drop files via HTTP.
CVE-2026-76504: Critical Pre-Auth Admin Access in Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager flaw CVE-2026-76504 allows unauthenticated attackers to gain admin access via URI hex encoding manipulation.
Apple Patches CoreGraphics Out-of-Bounds Write Vulnerability (CVE-2026-86950)
Apple released updates for iOS, iPadOS, and macOS to fix CVE-2026-86950, a CoreGraphics out-of-bounds write allowing arbitrary code execution.
No advisories match your search.