ddtcorex

Posts tagged “cve”

12 posts

23 Oct 2026

Roundcube session desync (CVE-2026-114724): a '!' that turns into object injection

CVE-2026-114724 desyncs Roundcube session parsing with a '!' key into object injection. Patch 1.6.20/1.7.5 and check mail hosts.

securitycveroundcubephp

23 Oct 2026

Node.js Brotli RCE (CVE-2026-111497): malformed compression input to code execution

CVE-2026-111497 is an OOB write in Node's bundled Brotli decoder plus TLS bypasses. Upgrade to 22.23.4/24.22.1/26.12.1 now.

securitycvenodejsjavascript

23 Oct 2026

GitLab October release (12 CVEs): unauthenticated RCE via crafted compile input

GitLab's 22 Oct 2026 release fixes 12 CVEs including unauth RCE (CVE-2026-110264). Patch 19.3.6/19.4.3/19.5.1 now.

securitycvegitlabdevops

22 Oct 2026

PHPPresentation flaws (CVE-2026-114403/114404): a slide deck that runs code

PHPPresentation 1.2.0 deserializes objects from uploaded slide files plus a stored XSS. File-upload lessons for PHP apps.

securitycvephpdeserialization

22 Oct 2026

PHP core memory flaws (CVE-2026-109618/109619): when OOM handling corrupts the request

Two Oct 2026 PHP flaws corrupt request memory around OOM handling. Why every Magento host should track PHP patch releases.

securitycvephpinternals

22 Oct 2026

Duplicator plugin PHP Object Injection (CVE-2026-82814): migration input to code execution

CVE-2026-82814 gives unauthenticated PHP Object Injection via Duplicator's migration engine. The deserialization lesson for every PHP shop.

securitycvewordpressphp

11 Sept 2026

Dependency supply-chain and CVE patching in Magento 2

How a Magento store's real attack surface is its dependency tree, how to track CVEs, patch safely, and avoid the two failures that leave stores exposed for months.

magento2securitydependenciescve

10 Dec 2025

Fortinet FortiOS bypass (CVE-2025-59718): forged SSO login as super-admin

CVE-2025-59718 let attackers forge SSO logins into unpatched FortiOS as super-admin. Affected branches and lockdown steps.

securitycvefortinetnetwork

04 Dec 2025

React Server Components RCE (CVE-2025-55182): pre-auth deserialization flaw

CVE-2025-55182 gave pre-auth RCE on React Server Components via a crafted payload. Affected packages, patches, and edge mitigations.

securitycvereactjavascript

19 Jul 2025

CrushFTP takeover (CVE-2025-54309): AS2 validation flaw to admin access

CVE-2025-54309 let attackers gain CrushFTP admin via mishandled AS2 validation. Patch versions and exposure checklist.

securitycvecrushftpfile-transfer

18 Jun 2025

Citrix Bleed 2 (CVE-2025-5777): memory overread on NetScaler gateways

CVE-2025-5777, dubbed Citrix Bleed 2, leaks session memory from NetScaler gateways. Who is exposed and the hardening checklist.

securitycvecitrixenterprise

14 May 2025

Ivanti EPMM RCE (CVE-2025-4428): one request, remote code on your MDM

CVE-2025-4428 gave unauthenticated RCE on Ivanti Endpoint Manager Mobile. Patch chain, device-fleet risk, and what to check now.

securitycveivantienterprise

Browse by topic:

2faaccessibilityadminadobe-commercealpineanalyticsapiarchitectureauditb2bbest-practicesblueprintsbotscachecachingcatalogcheckoutcicicdcitrixclicomplianceconfigurationconsentcontentcore-web-vitalscrawlcrushftpcspcustomizationcvedatabasedebuggingdependenciesdeploydeploymentdeserializationdetectiondevopsdidockereavecommerceenterpriseerpeventsfile-transferfortinetfpcframeworksfraudfrontendgdprgitlabgogovardgraphqlhardeningheadlesshyvai18nimagesindexerintegrationinternalsinventoryivantijavajavascriptlaravellayered-navigationlayoutlcplocal-devmagento2migrationmodulesmonitoringmsimultistorenetworknextjsnodejsobservabilityonboardingopensearchorderspatchpaymentsperformancephppluginspricingprofilingpwaqualityrcereactredisremotesresilienceroundcubesapsearchsecurityseosessionsshippingslostructured-datasymfonysynctailwindteamtestingtomcatupgradevarnishwcagwordpressworkflowxdebugzeroday