TL;DR BigBlueButton contains a critical path traversal vulnerability within the Etherpad integration. Attackers can perform an unauthenticated arbitrary file read to extract sensitive system files…

TL;DR A critical W3 Total Cache vulnerability lets unauthenticated attackers write files anywhere on the server. Tracked as CVE-2026-18051, it earns the top CVSS score of 10. The plugin runs on mo…

IBM patched 18 flaws in Db2 Mirror for i this week. The worst bug lets a remote attacker run system commands without logging in. IBM Db2 Mirror RCE risk reaches a CVSS score of 9.9. Also, several …

ArcadeDB is a multi-model database engine with an HTTP server API. Like most database servers, it lets an admin create and drop databases…

When a Single Text File Breaks a Trust Boundary (Bug Bounty writeup) During a recent security review, I encountered an interesting vulnerability in an open-source tool that, at first glance, appeared …

Note on notation: Throughout this article, traversal sequences are written in “defanged” form — e.g. ../ instead of the literal…

TL;DR WordPress 7.1.1 landed as a maintenance and security release. It fixes 11 security issues in the popular CMS, including stored cross-site scripting. The WordPress security team urges site ow…

TL;DR Canonical has patched three critical LXD vulnerabilities rated CVSS 9.6 to 9.9. Each one lets a low-privileged user or a rogue migration source write or delete files as root on the host. Fix…

TL;DR On October 1, Dell fixed five flaws in Dell System Update (DSU), led by a 9.6 path traversal bug. That flaw can let a remote, unauthenticated attacker run code as root. Version 2.3.0.0 fixes…

TL;DR Attackers are exploiting CVE-2026-104286, a CVSS 9.8 FortiMail vulnerability that lets unauthenticated users write arbitrary files. CISA added it to its Known Exploited Vulnerabilities catal…

TL;DR Atlassian has patched CVE-2026-21589, a critical Atlassian Data Center vulnerability with a CVSS score of 9.3. The arbitrary file access bug lets an unauthenticated attacker read files from …

TL;DR Attackers have begun CVE-2026-21589 exploitation against self-managed Atlassian servers. Researchers at watchTowr published a full technical breakdown and working proof-of-concept for the ar…

Introduction

Bonus: A webhook.site alternative for security testing

TL;DR Wazuh 4.14.8 fixes 15 security flaws in the open-source SIEM and XDR platform. Two of these Wazuh vulnerabilities score 9.4 on CVSS 4.0 and can lead to remote code execution as root. Several…

Introduction

A practical guide to understanding, testing, and fixing path traversal vulnerabilities

TL;DR Horizon3 has published a technical deep dive and proof-of-concept exploit for CVE-2026-106173, a critical FortiSIEM vulnerability rated CVSS 9.4. The flaw lets an unauthenticated attacker wr…

TL;DR Canada’s Cyber Centre updated its Fortinet advisory on October 23, 2026, to warn that CVE-2026-106173 “is being exploited in the wild.” This FortiSIEM vulnerability, rated …