TL;DR CISA published an advisory for five DCMTK vulnerabilities on 30 June 2026. The DICOM toolkit powers medical imaging on many hospital systems. The worst flaw lets a malicious server write fil…

TL;DR CVE-2026-48282, a critical CVSS 10 ColdFusion arbitrary code execution vulnerability, is under active attack. Hackers are exploiting this path traversal flaw in the wild. Administrators must…

The Apache project patched three Apache Lucene.NET vulnerability issues in the 4.8.0-beta00018 release. Two of the flaws carry a high CVSS score of 8.9. Both live inside the Lucene.Net.Replicator …

TL;DR Apache IoTDB has patched three flaws in its time-series database. The worst is a critical path traversal bug, CVE-2026-24014, scored 9.8. A second flaw allows an authentication bypass, and a…

TL;DR A high-severity decompress npm vulnerability lets crafted archives write files outside the extraction folder. Tracked as CVE-2026-53486, the flaw carries a CVSS score of 9.1. It sits in a li…

TL;DR PHP Composer, the main dependency manager for the language, patched three security flaws. The most serious, CVE-2026-59948, is an arbitrary file write rated CVSS 7.0. A malicious package can…

TL;DR Notepad++ v8.9.7 fixes five security flaws in the popular Windows editor. Technical details and proof-of-concept exploit code for all five Notepad++ vulnerabilities are public in the project…

TL;DR Apache has patched a critical OpenMeetings vulnerability tracked as CVE-2026-49488. The path traversal flaw grants arbitrary file read to any user with moderator rights in a room. Version 9.…

TL;DR Vitest patched a critical vulnerability rated CVSS 9.4. Browser Mode commands could read, write, or delete files outside the project folder. They did so even when the allowWrite gate was set…

TL;DR ManageEngine patched a critical ADAudit Plus vulnerability tracked as CVE-2026-6516. Two weaknesses in the product’s Agent APIs, an authentication bypass and a path traversal, chain in…