Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

665 articles

VULNhighCVE-2026-454945.4 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-330: (Pwn2Own) Microsoft Edge Navigation Handling Universal Cross-Site Scripting Vulnerability

This vulnerability allows remote attackers to execute arbitrary cross-origin script on affected installations of Microsoft Edge. U…

VULNhighCVE-2026-454958.8 HIGHZero Day Initiativeabout 2 months ago

ZDI-26-331: (Pwn2Own) Microsoft Edge Feedback Log File Handling Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Edge. User interaction…

VULNRecorded Futureabout 2 months ago

Remembering Sir Alex Younger

A personal tribute to Sir Alex Younger, former head of MI6, on the friendship, lessons, and clarity he brought to Recorded Future…

VULNRecorded Futureabout 2 months ago

Threats to the 2026 FIFA World Cup

Threat assessment for the 2026 FIFA World Cup (US, Mexico, Canada) covering organized crime, AI-powered cyber fraud, state espiona…

VULNhighCheck Point Researchabout 2 months ago

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click t…

VULNhighCVE-2026-8936Zero Day Initiativeabout 2 months ago

ZDI-26-327: Docker Desktop grpcfuse Kernel Module Uncontrolled Recursion Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Docker Desktop. An…

VULNPalo Alto Unit 42about 2 months ago

The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2)

Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and…

VULNSentinelOne Labsabout 2 months ago

LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine

ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked e…

VULNhighPalo Alto Unit 42about 2 months ago

Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor

Operation FlutterBridge is a malvertising campaign targeting macOS users. It distributed the new backdoor FlutterShell, built usin…

VULNRecorded Futureabout 2 months ago

Iran Expands Handala Brand to Physical Threats

Iran's MOIS expands its Handala brand to hybrid cyber and physical threat operations, recruiting proxies to conduct attacks, espio…

VULNCheck Point Researchabout 2 months ago

1st June – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 1st June, please download our Threat Intelligence Bulletin. TOP ATTAC…

VULNhighFull Disclosureabout 2 months ago

CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series

Posted by Thomas Weber | CyberDanube via Fulldisclosure on May 31 CyberDanube Security Research 20260528-0 https://www.mennekes.at…

VULNhighFull Disclosureabout 2 months ago

bmcweb (OpenBMC web server): four vulnerabilities — two unfixed, GHSA without a CVE

Posted by binreaper via Fulldisclosure on May 31 Hi all, https://binreaper.pages.dev/posts/2026-05-27-bmcweb-disclosure/ ## Why b…

VULNExploit-DBabout 2 months ago

[webapps] WordPress OrderConvo 14 - Path Traversal

WordPress OrderConvo 14 - Path Traversal

VULNExploit-DBabout 2 months ago

[webapps] Drupal Core 10.5.5 - Error-Based SQL Injection

Drupal Core 10.5.5 - Error-Based SQL Injection

VULNExploit-DBabout 2 months ago

[webapps] YAMCS yamcs-core 5.12.7 - LDAP Injection

YAMCS yamcs-core 5.12.7 - LDAP Injection

VULNExploit-DBabout 2 months ago

[webapps] YAMCS yamcs-core 5.12.7 - No Rate Limiting

YAMCS yamcs-core 5.12.7 - No Rate Limiting

VULNExploit-DBabout 2 months ago

[webapps] YAMCS yamcs-core 5.12.7 - User Enumeration

YAMCS yamcs-core 5.12.7 - User Enumeration

VULNExploit-DBabout 2 months ago

[remote] Notepad++ 8.9.6 - Arbitrary Code Execution

Notepad++ 8.9.6 - Arbitrary Code Execution

VULNExploit-DBabout 2 months ago

[webapps] MikroORM 7.0.13 - SQL Injection

MikroORM 7.0.13 - SQL Injection

VULNExploit-DBabout 2 months ago

[remote] Microsoft - NTLMv2 Hash Capture

Microsoft - NTLMv2 Hash Capture

VULNExploit-DBabout 2 months ago

[webapps] Langflow 1.3.0 - Remote Code Execution

Langflow 1.3.0 - Remote Code Execution

VULNExploit-DBabout 2 months ago

[dos] strongSwan 5.9.13 - DoS

strongSwan 5.9.13 - DoS

VULNExploit-DBabout 2 months ago

[remote] strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow

strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow

VULNExploit-DBabout 2 months ago

[webapps] Prodigy Commerce 3.3.0 - Local File Inclusion

Prodigy Commerce 3.3.0 - Local File Inclusion

VULNExploit-DBabout 2 months ago

[webapps] CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)

VULNExploit-DBabout 2 months ago

[remote] Wing FTP Server 8.1.3 - Authenticated Remote Code Execution

Wing FTP Server 8.1.3 - Authenticated Remote Code Execution

VULNExploit-DBabout 2 months ago

[webapps] MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution

MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution

VULNExploit-DBabout 2 months ago

[local] Linux Kernel - Local Privilege Escalation

Linux Kernel - Local Privilege Escalation

VULNExploit-DBabout 2 months ago

[local] ZTE ZXHN H188A V6 - Authentication Bypass

ZTE ZXHN H188A V6 - Authentication Bypass