TL;DR IBM has disclosed three critical vulnerabilities across three products, each rated CVSS 9.8. The flaws affect App Connect Enterprise, Power HMC, and webMethods Integration. Two of them let a…

Web application security often heavily relies on how different infrastructure layers communicate. Recently, I discovered and reported a…

TL;DR A researcher found six SGLang vulnerabilities, and the worst allow unauthenticated remote code execution. SGLang serves large language models such as DeepSeek and Qwen. CERT/CC published the…

TL;DR: TP-Link patched a TP-Link command injection flaw in the Archer AXE75 V1 router. Tracked as CVE-2026-9044, it carries a CVSS v4.0 score of 8.5. Firmware 1.5.6 Build 20260623 fixes the issue.…

TL;DR Cisco patched five Cisco SD-WAN vulnerability issues in Catalyst SD-WAN Software. Three are Critical, with two scoring CVSS 9.9. Cisco found them internally and reports no active exploitatio…

TL;DR Cisco patched seven Cisco IOS XE vulnerability issues in an August 2026 hardening release. Two are Critical, led by CVE-2026-20272 at CVSS 9.8. Cisco found them internally and reports no act…

Users of anonymous operating systems typically rely on the guarantee that no single program running within the environment can betray their true identity. Sometimes, however, a solitary flaw in th…

The Emergence of Fabricated Vulnerabilities Vulnerability databases recently received reports of critical SQLite flaws. These fictitious vulnerabilities boasted severity scores reaching a staggeri…

How an attacker-controlled Galera node name resulted in arbitrary OS command execution across cluster members.

How a missing validation check in Galera’s SST implementation allowed authenticated OS command execution.