The Patch Review Exposure Desk is the part of the Patch Review newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 18 articles so far. See the editorial policy or report an error.
Microsoft rates CVE-2026-102238 as critical because path traversal in older VS Code versions allows unauthorized remote code execution over a network.
A heap overflow in Microsoft QUIC allows remote code execution on Windows. Developers must update specific NuGet packages and .NET versions immediately.
A critical authorization flaw in Adobe Commerce and Magento Open Source allows remote attackers to run code without any user interaction.
Fortinet revised an advisory for a local authenticated vulnerability that can crash a CLI daemon. No patch is confirmed yet.
Patches are available for specific Metabase versions addressing a critical file access flaw, while Fortinet advisories detail high-severity risks in its management tools.
D-Link DCS-930L cameras on firmware B1.08B4 face a critical remote flaw allowing unauthorized firmware updates via signature verification failure.
A critical flaw in Wazuh allows cluster workers to overwrite master configs. Versions before 4.14.8 are affected. Teams must patch to prevent root access.
Unauthenticated attackers exploit a Unicode normalization bug in phpMyFAQ to execute SQL commands and steal database credentials.
A critical flaw in Perforce Helix Authentication Service allows attackers to execute code remotely if default tokens remain unchanged.
A critical vulnerability in Netcore NR268 firmware version 1.7.121109 allows remote argument injection, posing a severe risk to device security.
Unauthenticated users can access private data and trigger workflows in older PraisonAI versions. Version 1.6.59 fixes this critical flaw.
A critical vulnerability in the Grav Login OAuth plugin allows attackers to guess credentials and seize full administrative control of websites.
A critical flaw in the Tonda Membership plugin allows attackers to gain full administrative control without any login credentials, requiring immediate action for site owners.
The BoldThemes Avala plugin contains a severe vulnerability allowing attackers to inject PHP objects without logging in, affecting versions up to 1.1.4.
A critical flaw in older Privasys runtimes allowed relay attacks on TLS sessions, undermining the security of Intel SGX enclaves.
A critical vulnerability in ThemeREX Group Smart Casa versions up to 1.0.12 allows attackers to inject objects, requiring immediate action for all users.
IBM Guardium versions 12.0 through 12.2 contain a critical vulnerability that lets attackers run arbitrary code remotely via path traversal.
CISA added a critical ProFTPD vulnerability to its KEV catalog, setting a tight three-day deadline for federal compliance and risk mitigation.