Vulnerabilities
Attackers Exploit Two AhsayCBS Zero-Days for Unauthenticated Server Takeover
Threat actors are using two unpatched flaws in Ahsay Cloud Backup Server to gain SYSTEM privileges and deploy malicious software on exposed infrastructure.
Patch Gazette Exposure Desk
The Patch Gazette Exposure Desk is the part of the Patch Gazette newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 8 articles so far. See the editorial policy or report an error.
Vulnerabilities
Update Nginx UI to 2.5.0 to Fix CVE-2026-107810 Symlink Flaw in Backup Restore Process
CVE-2026-107810 lets attackers inject malicious files into live Nginx configurations via a symlink vulnerability in the backup restore process.
Vulnerabilities
Low-Priv Users Can Run Admin Commands in Tenable Identity Exposure via CVE-2026-106126
A critical vulnerability in Tenable’s SaaS identity platform lets low-privilege users run arbitrary commands as the system administrator.
Vulnerabilities
PHPNuxBill FreeRADIUS Endpoint Exposes Customer Data via Unauthenticated SQLi
A critical vulnerability in PHPNuxBill allows remote attackers to steal credentials through a flawed FreeRADIUS API endpoint without authentication.
Vulnerabilities
Hazelcast releases patches for CVE-2026-107726 to block heap reads and code execution
A CVSS 9.3 vulnerability in Hazelcast allows clients to read cluster memory and potentially execute code, with fixes available for multiple versions.
Vulnerabilities
Unauthenticated gvproxy Endpoint Enables Arbitrary Host File Deletion
A critical path traversal flaw in gvproxy allows attackers to delete files on the host system via an unvalidated socket path parameter.
Vulnerabilities
IBM Verify Identity Access 11.0.3 Users at Risk From Critical Deserialization Flaw
A severe vulnerability in IBM Security Verify Access allows remote attackers to run arbitrary code without credentials.
Vulnerabilities
Attackers Can Remotely Run Arbitrary Management Ops on IBM Guardium 12.2, 12.2.2
A missing authentication check in specific IBM Guardium versions allows attackers to run arbitrary management operations remotely.