ASUS Control Center can manage an entire fleet. One critical flaw can turn that reach against every server, PC and workstation connected to it, without requiring an account or a click.
Four linked Cleo Harmony weaknesses let a low-privilege user cross SAML and token trust boundaries, become an administrator and reach operating-system command execution.
CISA says attackers are exploiting a Kestra authentication bypass that lets unauthenticated requests create workflows and execute commands as root inside the worker container.
A passwordless Proxmox VE authentication bypass was fixed in 2023 but disclosed three years later, leaving exposed end-of-life control planes at urgent risk.
argocd-mcp 0.8.0 exposed its Argo CD tool surface without caller authentication, letting reachable clients act with the server's stored token. Version 0.9.0 rebuilds the boundary.
JFrog fixed a critical Artifactory authentication bypass that can grant administrative privileges without credentials under the default configuration.
Two independent flaws let network-adjacent or Bluetooth-range attackers reach root on a Unitree G1 EDU robot.
CISA says attackers are exploiting a critical ownCloud WebDAV authentication bypass first disclosed in 2023. A known username and a missing signing key can expose a user's files without authentication.
Veeam ONE patches close a CVSS 10 unauthenticated RCE, arbitrary file read, SQL injection and a 9.3 flaw that can coerce SMB authentication.
Hundreds of AI agents exploited PaperCut at 395 organisations, with some intrusions reaching domain administrator in minutes. Defenders must investigate Active Directory, not only the PaperCut host.
