SecurityExchange Online Authentication Flaw
A critical vulnerability identified in Microsoft Exchange Online creates a significant risk of unauthorized network tampering.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityCritical Heap Overflow in MS Account
A newly disclosed heap-based buffer overflow in Microsoft Account creates a high-stakes path for unauthorized remote code execution.
SecurityCritical Azure Red Hat OpenShift Flaw Found
A critical authorization vulnerability in Azure Red Hat OpenShift allows attackers to elevate privileges over a network, warranting immediate attention.
SecurityCode Execution Risks in Microsoft Surface
A critical vulnerability identified as CVE-2026-54120 allows for remote code execution via improper input validation.
SecurityCritical Bold Reports Flaw Risks Server Data
A path traversal vulnerability in Bold Reports Standalone Report Designer allows unauthenticated attackers to read sensitive files from the server.
SecurityPrivilege Escalation Risks in SolarWinds
A critical vulnerability identified in SolarWinds Serv-U allows for unauthorized privilege escalation and potential root code execution.
SecuritySSRF Flaw Discovered in lmdeploy API
A critical vulnerability in the lmdeploy API server enables unauthenticated attackers to reach internal network services.
SecuritySolarWinds Serv-U Faces Critical RCE
A critical remote code execution vulnerability identified in SolarWinds Serv-U requires domain administrator access to exploit.
SecuritySolarWinds Serv-U Privilege Escalation
A critical vulnerability identified in SolarWinds Serv-U allows domain administrators to elevate privileges to system administrator.
SecuritySolarWinds Serv-U Critical RCE Flaw
A critical IDOR vulnerability in SolarWinds Serv-U allows authenticated attackers to execute code as root, earning a CVSS score of 9.1.
SecurityCISA Warns of Actively Exploited WordPress Flaw
WordPress Core is under active attack via an interpretation conflict vulnerability that allows for SQL injection and remote code execution.
SecurityCISA Adds WordPress SQL Injection to KEV List
WordPress Core is currently under active exploitation via a SQL injection vulnerability that can be chained to achieve remote code execution.
SecurityEasy Form Builder Flaw Allows Takeover
A critical vulnerability in a WordPress plugin allows unauthenticated users to gain full administrator access to affected websites.
SecurityAVideo Command Injection Flaw Exposed
A critical vulnerability in AVideo allows for arbitrary OS command execution, bypassing previous security mitigations.
SecurityLightRAG Critical CORS Flaw Enables Data Theft
A critical vulnerability in LightRAG allows unauthorized cross-origin requests, potentially exposing sensitive documents and knowledge graph data.
SecurityLightRAG Critical Auth Bypass Vulnerability
A hardcoded secret in LightRAG allows unauthenticated attackers to bypass API key protections and gain full control over document operations.
SecurityCritical DoS Flaw Found in npm tar Package
A severe vulnerability in the node-tar library allows attackers to crash servers and exhaust storage through maliciously crafted archive files.
SecurityAI Agents Vulnerable to AgentBaiting
A campaign dubbed FakeGit uses 7,600 fake GitHub repositories to trick AI agents into installing the SmartLoader malware family.
SecurityWeaponized AI Workloads Threaten Grid
Researchers detail how malicious GPU workloads could trigger cascading power grid failures through high-frequency electrical modulation.
SecurityNeo Secures $100M for AI Control Layer
The American-Israeli startup steps out of stealth with significant backing to manage agentic software risks within enterprises.