attack_FeedLIVE

Vulnerability Alerts

Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,023 articles

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Royal Server 5.04.505…

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] core-admin 1.0.164 (b…

VULNcriticalCVE-2025-34115Full Disclosureabout 16 hours ago

[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] OP5 Monitor 9.20 Comm…

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] QuantaStor 6.8.3.018…

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] SmarterMail 100.0.969…

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Jitterbit Agent 12.8.…

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Accurate Online Priva…

VULNcriticalFull Disclosureabout 16 hours ago

[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] DBxtra .NET 13.1.1.0…

VULNhighCVE-2026-2035703Full Disclosureabout 16 hours ago

Subject: CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

Posted by Surf free on Sep 08 Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command injection vulnerability (CWE-78)…

VULNhighCVE-2026-52307Full Disclosureabout 16 hours ago

CVE-2026-52307: Stored XSS in 1CMS v5.6

Posted by 懒-癌-症～ via Fulldisclosure on Sep 08 CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability Vulnerability Desc…

VULNCheck Point Researchabout 21 hours ago

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, AI assistants have moved far beyond text gen…

VULNGoogle Project Zero1 day ago

Testing race conditions with memory access tracing and stack-based delay injection

Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative eff…

VULNhighCVE-2026-506967.5 HIGHZero Day Initiative1 day ago

ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. Authenticatio…

VULNhighCVE-2026-627127.8 HIGHZero Day Initiative1 day ago

ZDI-26-621: Microsoft Windows UMPDDrvRealizeBrush Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-627127.8 HIGHZero Day Initiative1 day ago

ZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-627127.8 HIGHZero Day Initiative1 day ago

ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-627127.8 HIGHZero Day Initiative1 day ago

ZDI-26-618: Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-668047.8 HIGHZero Day Initiative1 day ago

ZDI-26-617: Microsoft Windows MIDI Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-19780Zero Day Initiative1 day ago

ZDI-26-616: Koha Eval Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required…

VULNCheck Point Research2 days ago

7th September – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 7th Setpember, please download our Threat Intelligence Bulletin. TOP…

VULNMicrosoft Security5 days ago

How to secure edge AI in customer-owned environments

As AI moves into customer-owned environments, organizations need new ways to verify the systems, software, and AI assets they trus…

VULNhighCVE-2026-12554Full Disclosure5 days ago

HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556

Posted by Nir Yehoshua on Sep 03 Hello Full Disclosure list, Cipher Security Labs has published technical details for three High-…

VULNFull Disclosure5 days ago

Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

Posted by Ron E on Sep 03 Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side Request Forgery vulnerability in th…

VULNFull Disclosure5 days ago

O-CMS 1.0.0 Authenticated OS Command Injection via ai_cli_script

Posted by Ron E on Sep 03 Description O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in the AI…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion

Posted by Ron E on Sep 03 Description Flextype CMS contains a remote code execution vulnerability in the interaction between the…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery (SSRF) vulnerabil…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored sho…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability caused by the in…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains an authentication validation vulnerability in the API…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy fun…