The Firewall Pulse Patch Watch Desk is the part of the Firewall Pulse newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 15 articles so far. See the editorial policy or report an error.
A critical object injection vulnerability in the Travesia WordPress theme allows untrusted data deserialization, affecting versions through 1.1.16 with a CVSS score of 9.8.
Unpatched OS command injection in TOZED X300 firmware allows remote attackers to execute arbitrary commands via manipulated ping arguments.
A critical flaw in the ParamAspect component allows unauthenticated users to access all HR API endpoints by omitting a specific header.
Royal Plugins SiteVault plugin allows unauthenticated remote code execution in versions up to 1.5.19, rated critical by NVD.
Select-Themes plugin allows attackers to gain administrative access without credentials, rated 9.8 CVSS.
Threat actors are actively exploiting unpatched flaws in the AhsayCBS backup management platform to install webshells and cryptocurrency mining software.
Two security issues in AWS Ops Wheel allow potential exposure of sensitive cloud infrastructure configurations to unauthorized users.
The National Vulnerability Database rates CVE-2026-62046 as critical, warning that untrusted data handling in the Gutentype plugin enables object injection.
Deserialization of untrusted data in the Convex plugin exposes WordPress sites to remote object injection attacks requiring immediate attention.
A critical authentication bypass in the WPCOM Member plugin for WordPress allows attackers to hijack admin accounts by forging social login sessions without valid credentials.
A critical vulnerability in the ThemeREX Greeny WordPress theme allows object injection through untrusted data deserialization in versions up to 2.10.0.
A high-severity injection flaw in older versions of the TinaCMS CLI allows attackers to execute arbitrary code during preview builds by manipulating Git branch names.
Federal agencies must mitigate the ProFTPD file copy flaw by 11 October after CISA added it to the Known Exploited Vulnerabilities catalog.
A critical flaw in the Sipay OpenCart module allows attackers to bypass cryptographic signature checks and spoof transaction data.
The US government has added CVE-2015-5477 to its catalog, requiring teams to mitigate the high-severity remote DoS vulnerability within three days.