Security Advisories
Disclosure bulletins
Dated advisories from research and client engagements — severity, affected products, technical root cause, and remediation guidance, published under coordinated disclosure.
96 advisories published
Critical JFrog Artifactory Vulnerability Grants Unauthenticated Admin Access
A critical improper authentication vulnerability in JFrog Artifactory allows unauthenticated remote attackers to gain administrative privileges.
Unauthenticated RCE in Kestra OSS: Analyzing CVE-2026-49869
A critical CVSS 10.0 command injection vulnerability in Kestra OSS allows unauthenticated remote attackers to execute arbitrary workflows.
CVE-2026-48710: Starlette "BadHost" Request Smuggling Vulnerability
Technical analysis of CVE-2026-48710, an HTTP request smuggling flaw in Kludex Starlette enabling authentication bypass via Host header manipulation.
BerriAI LiteLLM Authentication Bypass (CVE-2026-59822) Enables Unauthenticated Access
A flaw in BerriAI LiteLLM (CVE-2026-59822) allows remote attackers to bypass authentication on MCP Streamable HTTP endpoints using arbitrary Bearer tokens.
PaperCut NG/MF Critical Vulnerability CVE-2026-81578 Exposes Systems to Takeover
A critical missing authentication vulnerability in PaperCut NG/MF (CVE-2026-81578) allows remote attackers to alter system settings and chain exploits.
PaperCut NG/MF Unsafe Reflection Vulnerability (CVE-2026-82078) Analysis
An analysis of CVE-2026-82078, a critical unsafe reflection vulnerability in PaperCut NG/MF allowing remote code execution via vulnerability chaining.
Critical macOS Screen Sharing Bypass: CVE-2026-65400 Technical Advisory
Apple has patched CVE-2026-65400, a critical authentication bypass in macOS Screen Sharing allowing unauthenticated remote access.
Microsoft SharePoint Weak Authentication Vulnerability (CVE-2026-55040)
Analysis of CVE-2026-55040, a critical Microsoft SharePoint weak authentication vulnerability allowing unauthenticated remote security bypass.
Broadcom VMware vCenter Path Traversal Vulnerability (CVE-2026-59310): Action Required
Unauthenticated RCE in Broadcom VMware vCenter (CVE-2026-59310) enables full appliance compromise. Review attack paths and forensic triage steps.
Critical Microsoft IKE Service RCE (CVE-2026-33824): Urgent Patch Required
A critical double-free flaw in Microsoft Internet Key Exchange (IKE) Service Extensions (CVE-2026-33824) allows unauthenticated remote code execution.
No advisories match your search.