Posts by Igal Zeifman

• Emerging Threats

A code injection flaw in Gitea’s diffpatch endpoint lets a user with repository write access install a Git hook and run arbitrary shell commands as the Gitea service account.

• Emerging Threats

Apache Traffic Server’s July 2026 security release patches dozens of flaws across its plugin surface, with the most severe letting unauthenticated attackers crash proxy tiers and bypass access controls.

• Emerging Threats

An out-of-bounds write in Samba’s internal DNS server lets an unauthenticated attacker crash a domain controller’s DNS process with a single crafted TSIG packet.

• Emerging Threats

Two unauthenticated flaws in IBM WebSphere Application Server traditional let remote attackers execute arbitrary code or escalate privileges through the administrative console.

• Emerging Threats

A flaw in the chunked upload handler of WPForms Pro lets an unauthenticated attacker leave executable files on a WordPress server, opening a path to remote code execution.

• Emerging Threats

A flaw in the Authentication Engine of Oracle Access Manager lets an unauthenticated attacker take over the single sign-on service that fronts an organization’s internal applications.

• Emerging Threats

Oracle’s July 2026 Critical Patch Update fixes multiple flaws in WebLogic Server’s Core component, several letting an unauthenticated attacker fully take over the server over T3, IIOP, HTTP, and SOAP.

• Emerging Threats

A PHP object injection flaw in PrestaShop’s ps_facetedsearch module lets an unauthenticated attacker smuggle a malicious object through a slider filter and achieve remote code execution on the storefront.

• Emerging Threats

wp2shell chains a REST API batch-route confusion flaw with a SQL injection in WordPress core’s WP_Query, letting an unauthenticated attacker run code on a default install and take over the site.

• Emerging Threats

A missing authentication flaw in on-premises Microsoft SharePoint Server lets an unauthenticated attacker escalate privileges over the network, a zero-day Microsoft confirms is already under active exploitation.