Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server

Posted by Ron E on Sep 03 Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlle…

VULNFull Disclosureabout 2 months ago

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility…

VULNFull Disclosureabout 2 months ago

thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program

Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow vulnerability exists in the redirect CGI program distribute…

VULNFull Disclosureabout 2 months ago

thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption

Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with t…

VULNFull Disclosureabout 2 months ago

lighttpd2 Signedness Error in li_chunkqueue_append_mem() Leads to Out-of-Bounds Memory Access

Posted by Ron E on Sep 03 *Description:* A signedness vulnerability exists in the li_chunkqueue_append_mem() function in lighttpd2…

VULNFull Disclosureabout 2 months ago

Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi

Posted by Ron E on Sep 03 *Description:* Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in the synchronou…

VULNFull Disclosureabout 2 months ago

Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution

Posted by Ron E on Sep 03 *Description:* Arbitrary code execution is possible in the MQTTVersion utility due to unsafe loading and…

VULNFull Disclosureabout 2 months ago

Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking

Posted by Ron E on Sep 03 *Description:* Arbitrary code execution is possible in the MQTTVersion utility due to uncontrolled loadi…

VULNcriticalFull Disclosureabout 2 months ago

[0day-rubbish] ZesleCP 3.1.21 Authenticated arbitrary file write to root RCE via cron (8.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in ZesleCP 3.1…

VULNcriticalFull Disclosureabout 2 months ago

[0day-rubbish] StreamSets DataCollector 6.4.1 (official Docker image) Default credentials plus unsandboxed Shell Executor to root RCE (9.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in StreamSets…

VULNcriticalCVE-2025-54598.8 HIGHFull Disclosureabout 2 months ago

[0day-rubbish] Puppet Enterprise 2025.10.0 Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (8.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Ente…

VULNcriticalFull Disclosureabout 2 months ago

[0day-rubbish] NoMachine Terminal Server 10.0.57 two vulnerabilities

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing two vulnerabilities in NoMachi…

VULNcriticalFull Disclosureabout 2 months ago

[0day-rubbish] Minuteman UPS Network Management Card 1.60.3 Unauthenticated OS command injection to root RCE (9.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in Minuteman U…

VULNcriticalFull Disclosureabout 2 months ago

[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantron…

VULNcriticalFull Disclosureabout 2 months ago

[0day-rubbish] GeoVision GV-TBL4700 V1.06 Authenticated command injection to root RCE via SNMPv3 user configuration (8.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in GeoVision G…

VULNhighRecorded Futureabout 2 months ago

Recorded Future Announces Automated Signature Creation, Accelerating Vulnerability Prioritization

Recorded Future's Automated Signature Creation turns new vulnerabilities into detection signatures in under an hour, matching the…

VULNhighMicrosoft Securityabout 2 months ago

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email…

VULNPalo Alto Unit 42about 2 months ago

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to…

VULNExploit-DBabout 2 months ago

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

FreePBX 17.0.2 - Remote Code Execution (RCE)

VULNExploit-DBabout 2 months ago

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

Metabase 0.61.0 - Authenticated Remote Code Execution

VULNhighRecorded Futureabout 2 months ago

H1 2026 Malware Vulnerability Trends

Learn how adversaries abuse trusted tools, AI, and developer environments for cyberattacks. Get actionable insights on ransomware,…

VULNMicrosoft Securityabout 2 months ago

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to i…

VULNCheck Point Researchabout 2 months ago

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The…

VULNPalo Alto Unit 42about 2 months ago

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Using autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address and defend…

VULNExploit-DBabout 2 months ago

[dos] EVerest 2025.9.0 - DoS

EVerest 2025.9.0 - DoS

VULNExploit-DBabout 2 months ago

[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

VULNExploit-DBabout 2 months ago

[webapps] PodcastGenerator 3.2.9 - Stored XSS

PodcastGenerator 3.2.9 - Stored XSS

VULNExploit-DBabout 2 months ago

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

Ghost_CMS 6.19.0 - Remote Code Execution

VULNExploit-DBabout 2 months ago

[webapps] Langflow 1.10.0 - RCE

Langflow 1.10.0 - RCE

VULNhighExploit-DBabout 2 months ago

[hardware] Fullhan FH8626V100 - Multiple Vulnerabilities

Fullhan FH8626V100 - Multiple Vulnerabilities