Patch/Configuration Management

The vulnerability stems from flaws in the plugin's handling of "direct request" mode, where it accepted requests without proper cryptographic verification.

The tool specifically targets access control vulnerabilities in Salesforce Aura, the framework powering Experience Cloud sites.

The vulnerability, discovered by Zach Hanley of Horizon3.ai, resides in the phMonitor service, which handles logging security events.

ServiceNow has addressed a critical vulnerability within its AI Platform that could have allowed threat actors to impersonate users and execute arbitrary actions.

The vulnerability, identified as CVE-2026-20805, affects the Windows Desktop Window Manager and allows attackers to leak small pieces of memory information.

The January updates include 57 elevation of privilege flaws, 22 remote code execution flaws, and 22 information disclosure flaws.

The exploit requires no authentication and requires a manual router reset to reconnect.

Multiple iterations of the Apache Struts 2 open-source web application framework have been impacted by the high-severity XML external entity injection vulnerability, tracked as CVE-2025-68493, which could be exploited to facilitate data exposure, as well as denial-of-service and server-side request forgery intrusions, GBHackers News reports.