Trending CVEs

Vulnerability: CVE-2026-109618 is a critical remote code execution vulnerability in PHP that exploits improper handling of out-of-memory (OOM) errors using longjmp(), leaving request memory in an uninitialized state and enabling RCE. The vulnerability affects all PHP installations from version 2004 onwards, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Trending: CVE-2026-109618, part of the "php2shell" vulnerability pair, is trending due to active exploitation in the wild at scale, with security researchers observing widespread attacks particularly targeting PHP's session upload-progress functionality. The vulnerability has generated significant urgency across social media and news outlets, with CISA urging immediate patching and major cloud platforms like Heroku and AWS working to release patches.

Vulnerability: CVE-2026-109619 is a critical remote code execution vulnerability in PHP caused by improper handling of global state that temporarily points into request memory. The vulnerability affects all PHP installations serving web requests, with vulnerable versions dating back to 2004, and can be exploited through multiple attack strategies to achieve unauthenticated remote code execution.

Trending: CVE-2026-109619, tracked as part of the "php2shell" vulnerability pair, is trending due to active exploitation in the wild at scale before patches were released. The vulnerability has generated significant urgency across the security community, with CISA urging immediate patching, multiple reports of active exploitation attempts, and widespread discussion about mitigation strategies and delayed patch availability from major cloud providers.

Vulnerability: CVE-2026-111497 is a remote code execution vulnerability in Node.js caused by an out-of-bounds write in the Brotli decoder, affecting Node.js systems that process Brotli-compressed data.

Trending: The vulnerability is gaining attention on social media due to its severity as a remote code execution flaw, with security researchers noting it as a significant issue alongside other recent vulnerabilities, though characterized as less critical than concurrent PHP vulnerabilities.

Vulnerability: EDK2 contains a critical vulnerability in BIOS that allows remote users to cause out-of-bounds write, classic buffer overflow, and incorrect buffer size calculation, potentially leading to arbitrary code execution and compromising confidentiality, integrity, and availability.

Trending: The vulnerability is receiving attention on social media platforms with a CVSS score of 9.5 (critical severity), driving awareness and discussion within cybersecurity communities regarding the high-risk nature of this EDK2 BIOS flaw.

Vulnerability: A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network by accessing resources using an incompatible type.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with multiple posts from cybersecurity accounts sharing the CVE details and rating it as high severity (8.8).

Vulnerability: CVE-2026-116682 affects FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta, a free self-hosted web-based file manager. The vulnerability allows improper symbolic link resolution in file read handling, enabling authenticated users with download access and public share link holders to read server-accessible files outside their authorized scope.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with multiple posts from cybersecurity news accounts highlighting its high severity rating of 8.6 and the recently published disclosure as of October 27, 2026.

Vulnerability: Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by exploiting a hardcoded DUMMY_SECRET fallback key when KENER_SECRET_KEY is empty or unset. Attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.

Trending: CVE-2026-116747 is receiving attention across security social media platforms with a critical CVSS 9.2 rating, with multiple threat intelligence accounts highlighting the vulnerability's severity and ease of exploitation. No public exploit has been reported yet, but the vulnerability is being actively discussed in infosec communities due to its high impact on affected Kener deployments.

Vulnerability: CVE-2026-117532 is a critical authentication bypass vulnerability (CVSS 9.3) in REDAXO core versions 5.3.0 before 5.21.4 affecting the structure/history plugin. Unauthenticated attackers can forge temporary login tokens by forcing the session-tied secret into a predictable state, enabling backend access and code execution for accounts like admin.

Trending: The vulnerability is receiving attention across security social media platforms due to its critical severity rating and the ability for unauthenticated attackers to gain backend access and execute code. Social mentions indicate no public exploit has been reported yet, but the issue is being actively discussed in the infosec community.

Vulnerability: CVE-2026-18450 is a critical vulnerability (CVSS 9.8) in BMC (Baseboard Management Controller) implementations, including Supermicro X12SPI servers, where the BMC does not correctly enforce integrity and encryption requirements for IPMI commands, allowing attackers to craft packets that execute arbitrary commands on active sessions.

Trending: The vulnerability is receiving significant attention across security-focused social media platforms including Bluesky and Mastodon, with multiple posts from cybersecurity news outlets highlighting its critical severity rating and potential for remote command execution on affected systems.

Vulnerability: The Kirki plugin for WordPress versions up to 6.2.5 is vulnerable to Privilege Escalation via PHP Object Injection through deserialization of untrusted input in the 'get-single-symbol' AJAX dispatcher. Authenticated attackers with Subscriber-level access can exploit a missing capability check and leverage a POP chain to overwrite administrator passwords and gain administrative access.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with multiple posts highlighting its HIGH severity rating (8.8) and recommending that users restrict or disable the plugin until a patch is available. The widespread sharing suggests active awareness within the infosec community regarding the risk to WordPress installations using this plugin.

Vulnerability: The Qode Membership plugin for WordPress (versions up to 2.0.6.2) contains an authentication bypass vulnerability in the Facebook OAuth token verification logic due to a typographic error in a guard condition variable name. This allows unauthenticated attackers to log in as any existing WordPress account, including Administrator-level accounts, by exploiting the qode_membership_check_facebook_user AJAX action with a valid nonce and a known administrator login name.

Trending: The vulnerability is receiving significant attention across security-focused social media due to its critical severity rating (CVSS 9.8) and the ease of exploitation, with multiple security researchers and threat intelligence platforms warning of the risk of account takeover and recommending immediate removal or restriction of the affected plugin.

Vulnerability: A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. This affects systems using net/http implementations.

Trending: The vulnerability is receiving attention on security-focused social media platforms, with CVE tracking accounts publishing details about the excessive CPU consumption issue in HTTP/2 implementations shortly after its public disclosure.

Vulnerability: A supply chain vulnerability in Go's module system allows a malicious actor operating a Go project with a bogus golang.org/fips140 module and a malicious GOMODPROXY to serve arbitrary modules in place of the legitimate one. The fix involves unpacking the trusted ziphash for the bundled golang.org/fips140 module and constructing its entry in the GOMODCACHE for verification by the toolchain.

Trending: CVE-2026-94444 is trending due to its inclusion in multiple security fix announcements for Google Cloud's Apigee hybrid platform and related components (v1.15.9 and later), with the vulnerability addressed across numerous Apigee modules including apigee-udca, apigee-runtime, apigee-prometheus-adapter, and others as part of coordinated security updates.

Vulnerability: CVE-2026-94447 is a checksum bypass vulnerability in Go's toolchain handling that allows users operating within a malicious Go project with a bogus golang.org/toolchain go.sum entry and a malicious GOMODPROXY to circumvent intended checksum verification. The fix ensures that golang.org/toolchain always retrieves the canonical checksum from the network.

Trending: CVE-2026-94447 is trending due to its inclusion in multiple security fix announcements for Google Cloud's Apigee hybrid platform and related components, with patches released across apigee-watcher, apigee-runtime, apigee-prometheus-adapter, apigee-prom-prometheus, apigee-fluent-bit, and cassandra-client as part of the v1.15.9 release on October 21, 2026.

Vulnerability: Consul-k8s versions 0.42.0 and later contain a cross-namespace authorization bypass in ACL binding rules that allows attackers to obtain elevated Consul privileges across Kubernetes namespaces. The vulnerability is fixed in consul-k8s 2.1.0 and 1.8.18.

Trending: This vulnerability is receiving significant attention across security communities due to its critical CVSS 9.9 severity rating and the potential for privilege escalation across namespace boundaries in Kubernetes environments. Multiple security platforms and infosec accounts are actively sharing alerts about the flaw, highlighting the risk to Hashicorp Consul-k8s deployments.

Vulnerability: CVE-2026-116508 is a stack-based buffer overflow vulnerability in TOTOLINK A950RG version 4.1.2cu.5268_B20221104, specifically in the infostat.cgi component's Device-Information CGI function. The vulnerability can be exploited remotely by manipulating the CONTENT_LENGTH argument, and a public exploit has been released.

Trending: The vulnerability is receiving attention across security communities with CVSS severity ratings ranging from 9.3 to 10.0, indicating critical risk. Multiple security researchers and threat tracking accounts are actively discussing the flaw on social media, highlighting the router's web interface vulnerability and potential for device compromise through specially crafted requests.

Vulnerability: A critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) in the Updates Environment Management component allows unauthenticated attackers with network access via HTTP to achieve complete compromise of the system, with impacts to confidentiality, integrity, and availability (CVSS 3.1 score: 9.8).

Trending: The vulnerability is gaining attention following Oracle's security alert advisory, with security researchers and administrators sharing the official advisory across social media platforms as organizations assess their exposure to this critical remote exploitation risk.

Vulnerability: CVE-2026-57200 is an authorization bypass vulnerability in Asterisk prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3 that allows authenticated attackers with read-only ARI permissions to execute write operations through REST-over-WebSocket, potentially leading to arbitrary module loading and remote code execution.

Trending: The vulnerability is receiving attention across infosec communities on social media platforms including Bluesky and Mastodon, with security researchers and news outlets sharing details about the high-severity flaw and available patches.

Vulnerability: CVE-2026-57202 is a privilege escalation vulnerability in Asterisk prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, where authenticated ARI attackers with read-only privileges can use setChannelVar to execute write dialplan functions including FILE() writes, bypassing the live_dangerously security setting.

Trending: The vulnerability is being shared across social media platforms including Bluesky and Mastodon by security news outlets, with a CVSS score of 8.1 (High severity), drawing attention from the infosec and cybersecurity communities.

Vulnerability: A flaw in Keycloak's OIDC protocol implementation allows the token refresh process to issue valid access tokens for disabled audience clients by failing to verify if the target audience client is still enabled. This affects Keycloak's identity and access management functionality and could allow applications with existing refresh tokens to bypass administrative access controls.

Trending: CVE-2026-93999 is trending following its recent publication on September 19, 2026, with social media mentions highlighting the token refresh vulnerability in Keycloak services that continues issuing tokens for disabled audience clients.

Vulnerability: A flaw in Keycloak's Admin REST API group-membership endpoints fails to verify whether a group grants administrative privileges before adding users, allowing delegated administrators with limited permissions to add themselves to high-privilege groups and escalate to full realm control.

Trending: The vulnerability is trending following its publication on September 19, 2026, with social media mentions highlighting the critical privilege escalation risk where delegated admins with manage-users permissions can escalate to realm-admin access through group membership manipulation.

Vulnerability: CVE-2026-86553 is a password reset vulnerability in the ZTE SmartLife app that allows attackers to extract authentication parameters from the application's runtime process and use them to reset target account passwords by spoofing application authentication information.

Trending: The vulnerability is trending due to recent publication and social media coverage on Bluesky, with posts highlighting the password reset attack vector in the SmartLife application.

Vulnerability: A hard-coded credentials vulnerability was identified in aiyiyi121 SxDevOps versions 1.0 and 1.1 in the ensure_default_superuser function of rbac/services.py, allowing remote exploitation. A patch has been released by the vendor.

Trending: The vulnerability is being tracked and shared across threat intelligence and cybersecurity communities on social media platforms, with security researchers and organizations monitoring CVE-2026-93969 as part of ongoing vulnerability awareness efforts.

Vulnerability: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with multiple cybersecurity accounts sharing alerts and technical details about the flaw in libexpat. The recent publication and high severity rating (7.5) are driving initial awareness and discussion within the infosec community.

Vulnerability: Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Trending: The vulnerability is receiving attention across multiple security-focused social media platforms including Bluesky and Mastodon, with security researchers and threat intelligence accounts actively sharing alerts and details about the CVE shortly after its publication.

Vulnerability: Exim before 4.100.1 contains an out-of-bounds write vulnerability when Proxy-Protocol is used with an attacker-controlled proxy, affecting mail server deployments using this configuration.

Trending: The vulnerability is gaining attention due to its severity and the bundled nature of the fix, which addresses multiple critical issues including Proxy Protocol heap flaws, a GnuTLS use-after-free, and SMTP smuggling vulnerabilities, prompting urgent upgrade recommendations across the mail server community.

Vulnerability: Suricata before version 8.0.7 contains a type confusion vulnerability in DoH2 (DNS-over-HTTPS 2) handling that can cause an invalid memory free when processing HTTP/1 to HTTP/2 upgrade requests. The vulnerability affects Suricata instances with app-layer.protocols.doh2 enabled, which is the default configuration in version 8.x.

Trending: The vulnerability is gaining attention in security communities due to its potential to cause denial of service by crashing the Suricata network monitoring tool when processing specially crafted DoH2 requests that attempt protocol upgrades.

Vulnerability: CVE-2025-53630 is an integer overflow vulnerability in the gguf_init_from_file_impl function in llama.cpp (an LLM inference engine written in C/C++) that can lead to heap out-of-bounds read/write conditions. The vulnerability affects llama.cpp and is resolved in commit 26a48ad699d50b6268900062661bd22f3e792579.

Trending: The vulnerability is receiving attention due to related follow-up vulnerabilities being discovered, including EUVD-2026-110571, which describes how subsequent versions of llama.cpp (b5854 before b11275) contain an integer overflow that bypasses the CVE-2025-53630 size check when handling crafted GGUF files with padding near-SIZE_MAX tensor sizes.

Vulnerability: Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. Exploitation requires user interaction, such as visiting a maliciously crafted URL, and could result in elevated access or control over the victim's account or session.

Trending: The vulnerability is gaining attention on social media platforms with security researchers highlighting its critical severity (CVSS 9.3) and the ease of exploitation through specially crafted links that could allow attackers to take control of user accounts.

Vulnerability: Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that allows arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this vulnerability to execute arbitrary code without requiring user interaction.

Trending: The vulnerability is receiving attention on social media platforms with posts highlighting its critical CVSS 9.9 severity rating and emphasizing that attackers with limited access can automatically trigger arbitrary command execution on affected systems.

Vulnerability: Adobe Campaign Classic (ACC) is affected by an SQL injection vulnerability that could allow an attacker with high privileges to execute arbitrary code in the context of the current user without requiring user interaction.

Trending: The vulnerability is gaining attention on social media with posts highlighting its critical CVSS 9.1 severity rating and the insider threat risk posed by the lack of user interaction requirement, making it a concern for organizations using Adobe Campaign Classic.

Vulnerability: Adobe Campaign Classic (ACC) is affected by an SQL injection vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code without requiring user interaction.

Trending: The vulnerability is receiving attention on social media platforms with posts highlighting its critical CVSS 9.9 rating and the ability for low-privilege attackers to execute unwanted commands by processing specially crafted input in Adobe Campaign Classic.

Vulnerability: Adobe Campaign Classic (ACC) is affected by an SQL injection vulnerability that allows low-privileged attackers to bypass security features and gain unauthorized read and limited write access without requiring user interaction.

Trending: The vulnerability is receiving attention on social media platforms with posts highlighting its critical CVSS 9.1 score and the ability for low-privilege attackers to manipulate the system to bypass security controls and access sensitive information.

Vulnerability: An improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 allows an unauthenticated attacker with network access to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with security news outlets sharing details about the high-severity flaw and its potential impact on Fortinet devices.

Vulnerability: CVE-2026-111820 is a Stored Cross-Site Scripting vulnerability in the Analytics Insights – Google Analytics Dashboard for WordPress plugin affecting all versions up to and including 6.3.12. The vulnerability exists due to insufficient input sanitization and output escaping in the Page Title field, allowing unauthenticated attackers to inject arbitrary web scripts that execute when users access affected pages.

Trending: The vulnerability is trending due to recent publication and active discussion on social media platforms, with security researchers flagging it as HIGH severity and recommending input restrictions and monitoring for plugin updates.

Vulnerability: CVE-2026-116662 is a compression bomb vulnerability in Tanium Enforce that has been addressed by the vendor. The vulnerability is rated as High severity with a CVSS score of 7.5.

Trending: The vulnerability is being actively discussed across social media platforms including Bluesky and Mastodon, with security researchers and information security professionals sharing details about the flaw and directing attention to available patch information.

Vulnerability: Atlantis, a self-hosted Golang application for Terraform pull request management, contains a command injection vulnerability in versions 0.4.0 through 0.47.1. Authenticated contributors can inject shell metacharacters into workspace names to execute arbitrary commands as the Atlantis service account, potentially accessing cloud credentials, Terraform state, and other sensitive resources.

Trending: The vulnerability is being actively shared across social media platforms including Bluesky and Mastodon by security news outlets, with a CVSS score of 8.8 indicating high severity. The widespread distribution of vulnerability details across multiple social networks suggests increased awareness and concern within the security community.

Vulnerability: CKEditor 5 versions 45.0.0 through 47.7.4 and 48.5.1 contain a prototype-pollution vulnerability in a vulnerable es-toolkit dependency that can be exploited through crafted style attribute values, leading to unauthorized JavaScript execution in the browser.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with security news outlets actively sharing information about the high-severity flaw and its fixes in versions 47.7.4 and 48.5.1.

Vulnerability: llama.cpp versions b5899 before b10261 contain a heap out-of-bounds write vulnerability in the llm_tokenizer_plamo2::build function that allows attackers to corrupt heap memory through crafted GGUF models. By supplying BYTE-typed token text with negative parsed values, attackers can write token IDs before the bytes_ buffer during model loading, potentially causing crashes or code execution.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, where it is being shared with a CVSS score of 7.8 (High severity) by security news outlets tracking recent CVE disclosures.

Vulnerability: A Stored Cross-Site Scripting (XSS) vulnerability in airMAX M devices allows a malicious actor with adjacent network access to escalate privileges on the device under certain conditions.

Trending: The vulnerability is receiving attention across social media platforms with a high severity rating of 8.8, with security researchers and infosec communities sharing information about the flaw on Bluesky and Mastodon.

Vulnerability: A Heap-based Buffer Overflow vulnerability in Ubiquiti airMAX M, LTU, SolarPoint, and SolarSwitch devices allows a malicious actor with adjacent network access to execute arbitrary code on affected devices.

Trending: The vulnerability is receiving attention across social media platforms including Bluesky and Mastodon, with security researchers and information security communities sharing alerts about the high-severity issue (CVSS 8.8) and its potential for remote code execution.

Vulnerability: Electrum before version 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one and trick users into signing invalid transactions paying attacker addresses.

Trending: The vulnerability is receiving attention across security information channels with a critical CVSS 9.3 score, though no public exploit has been reported yet as of the initial disclosure.

Vulnerability: Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests or repeatedly pay msat amounts to drain funds beyond the configured limit.

Trending: The vulnerability is trending on social media platforms including Bluesky, where multiple security accounts have shared alerts about the issue. The focus on the daily spending cap bypass and potential for fund drainage appears to be driving awareness among cryptocurrency and infosec communities.

Vulnerability: CVE-2026-18449 is a high-severity vulnerability in BMC systems where the Baseboard Management Controller does not correctly enforce integrity and encryption requirements for IPMI commands, allowing attackers to craft packets that execute arbitrary commands on active sessions.

Trending: The vulnerability is receiving attention across social media platforms including Bluesky and Mastodon, with security researchers and infosec communities sharing alerts about the high-severity rating (7.5) and its potential for remote command execution on affected systems.

Vulnerability: A NULL pointer dereference in the Asterisk Manager Interface (AMI) affects Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3. An unauthenticated attacker can crash Asterisk when Digest Authentication is used via HTTP, provided the HTTP web server, AMI, and AMI access via HTTP are all enabled.

Trending: The vulnerability is receiving attention across security-focused social media platforms including Bluesky and Mastodon, with posts highlighting its High severity rating (7.5) and sharing details about the affected Asterisk versions and the conditions required for exploitation.

Vulnerability: A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges. The vulnerability affects systems using vulnerable BMC IPMI implementations.

Trending: The vulnerability is receiving attention across social media platforms including Bluesky and Mastodon, with security researchers and news outlets sharing details about the high-severity flaw (CVSS 8.8) and its potential for privilege escalation attacks.

Vulnerability: A stack-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 Manager versions 10-00 before 13-50-31, which could allow an attacker to cause a denial of service or execute arbitrary code through a coding error in the manager component.

Trending: The vulnerability is receiving attention on social media platforms due to its critical CVSS 9.4 severity rating and its impact on Hitachi's widely-used JP1 Automatic Job Management System, with security researchers and infosec communities actively discussing the affected versions and mitigation steps.

Vulnerability: A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager in versions 10-00 before 13-50-31, allowing an attacker to write beyond the allocated memory space.

Trending: The vulnerability is receiving attention on social media platforms with a CVSS score of 9.4 (critical severity), with security researchers and infosec communities sharing alerts about the affected Hitachi JP1 component.

Vulnerability: A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3, affecting both the Manager component (versions 11-00 before 13-50-31) and the Agent component (versions 11-00 before 13-50-31). This flaw could allow an attacker to cause unspecified impact on affected systems.

Trending: The vulnerability is receiving attention on social media platforms with a CVSS score of 9.8 (critical severity), prompting security researchers and infosec professionals to share alerts and information about the affected Hitachi product versions.

Vulnerability: An authentication bypass vulnerability in HiRDB allows attackers to spoof authentication mechanisms and gain unauthorized access. The vulnerability affects multiple versions of HiRDB Server, including Version 10 (before 10-12-01), Version 9 (09-00 through 09-66-22), and their 32-bit variants.

Trending: The vulnerability is receiving attention on social media with security researchers flagging it as critical, emphasizing that attackers can fully compromise affected systems and urging immediate patching to version 10-12-01 or later.