The Vector Update Patch Watch Desk is the part of the Vector Update newsroom that covers software flaws, vendor advisories and patches. It is a newsroom desk, not a single person. Sections: Vulnerabilities. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 12 articles so far. See the editorial policy or report an error.
A disclosed vulnerability in the XRP protocol could have allowed attackers to generate unlimited cryptocurrency tokens, raising concerns about systemic risks in digital asset infrastructure.
Attackers are exploiting unpatched vulnerabilities in AhsayCBS to install webshells and cryptocurrency miners, requiring immediate isolation of affected systems.
PortSwigger Research details a technique using overlapping CSS fragments to bypass token limits and exfiltrate sensitive data from web applications.
The National Vulnerability Database rates CVE-2026-42716 as critical, noting that attackers can inject PHP objects without authentication into affected stores.
The NVD rates CVE-2026-62045 as critical because it allows unauthenticated attackers to inject objects via deserialization flaws in older Booklovers versions.
The NVD rates this remote code execution vulnerability in the 3D Product Configurator plugin as critical due to missing authentication checks.
An unauthenticated privilege escalation flaw in Blocksy Companion versions up to 2.1.58 allows attackers to bypass security checks and create seller accounts.
A critical flaw in Privasys Go allows attackers to relay attestation quotes, bypassing security checks in versions prior to v0.5.1.
A critical flaw in Astron Agent versions before 1.1.2 allows authenticated tenants to run arbitrary code as root, risking full system compromise.
A critical flaw in the Partiso WordPress theme allows attackers to inject objects via untrusted data, affecting versions up to 1.1.13.
A critical vulnerability in ThemeREX Edema versions up to 1.2.2.2 allows object injection via untrusted data deserialization, requiring immediate action.
CISA added a Strapi vulnerability allowing admin panel attackers to steal user data to its catalog. You must apply fixes by October 11.