The InfoSec Ledger Advisory Desk is the part of the InfoSec Ledger newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 16 articles so far. See the editorial policy or report an error.
A severe flaw in Adobe Experience Manager 6.5 allows attackers to inject scripts via forms, potentially hijacking user sessions and escalating privileges.
A critical flaw in Adobe ColdFusion allows unauthenticated attackers to read arbitrary files via the Remote Development Server feature.
A high-severity flaw in Cisco UCS servers allows authenticated users or those with physical access to bypass Secure Boot and run unauthorized code.
A critical vulnerability in Docker Hub allowed attackers to hijack personal access tokens during account conversions, risking software supply chain integrity.
A critical vulnerability in NVIDIA AIStore allows unauthenticated remote attackers to submit crafted token-revocation lists, risking data tampering and service disruption.
Remote attackers with manage-user privileges can seize persistent admin control via an XQuery injection flaw in older MarkLogic Server versions.
Unauthenticated attackers can exploit CVE-2026-109573 to access secrets in phpMyFAQ versions prior to 4.1.9, according to the National Vulnerability Database record.
A critical flaw in IBM Db2 Mirror for i versions 7.4 through 7.6 permits authenticated attackers to bypass checks and execute arbitrary code on the system.
A CVSS 9.2 server-side request forgery flaw in Crawl4AI versions before 0.9.4 allowed API clients to access internal cloud metadata and private network resources.
A critical flaw in AnyDesk versions prior to 8.0.3 allows attackers to run code as root on Linux systems without user approval.
A critical vulnerability in OTRS Community Edition 6 lets attackers impersonate users by manipulating HTTP headers, bypassing password checks entirely.
A critical privilege escalation flaw in the Blocksy Companion WordPress plugin allows attackers to bypass security checks and create vendor accounts.
US fund managers deemed the Nvidia-backed startup's price tag too high relative to its FY 2026 earnings, causing the deal to fail within two days.
A high-severity command injection flaw in OpenStack Mistral allows project members to execute arbitrary code on infrastructure components via the SSH proxy action.
The National Vulnerability Database rates CVE-2026-93927 as critical, highlighting a severe deserialization flaw in Axiomthemes Veto versions up to 1.6.0 that permits object injection attacks.
A CVSS 9.8 vulnerability in the Convex plugin allows object injection, affecting all versions up to 1.16.0 and requiring immediate attention from administrators.