Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

666 articles

LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout

Mick Baccio and Scott Roberts examine whether public breach signals and market timing models can turn cyber incidents into actiona…

VULNExploit-DB2 months ago

[webapps] PJPROJECT 2.16 - Heap Bufferoverflow

PJPROJECT 2.16 - Heap Bufferoverflow

VULNhighRecorded Future2 months ago

NIST NVD Enrichment Policy Change: Prioritizing Vulnerabilities with Attacker Behavior Signals

NVD enrichment now covers only 15–20% of CVEs. Learn how Recorded Future Vulnerability Intelligence prioritizes risk using real at…

VULNExploit-DB2 months ago

[webapps] WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI

WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI

VULNExploit-DB2 months ago

[webapps] Apache HertzBeat 1.8.0 - Remote Code Execution

Apache HertzBeat 1.8.0 - Remote Code Execution

VULNExploit-DB2 months ago

[webapps] ePati Antikor NGFW 2.0.1301 - Authentication Bypass

ePati Antikor NGFW 2.0.1301 - Authentication Bypass

VULNRecorded Future2 months ago

Beyond Acceleration and Automation: How AI + Intelligence Changes Cyber Defense

The real question in modern cyber defense isn't who has more technology. It's who uses their resources more efficiently. Here's ho…

VULNCheck Point Research2 months ago

Thus Spoke…The Gentlemen

Key Points Introduction The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2…

VULNhighCVE-2025-549579.8 CRITICALGoogle Project Zero2 months ago

A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens

We recently published an exploit chain for the Google Pixel 9 that demonstrated it was possible to go from a zero-click context to…

VULNExploit-DB2 months ago

[webapps] Ninja Forms Uploads - Unauthenticated PHP File Upload

Ninja Forms Uploads - Unauthenticated PHP File Upload

VULNExploit-DB2 months ago

[webapps] glances 4.5.2 - command injection

glances 4.5.2 - command injection

VULNhighCVE-2026-343427.0 HIGHZero Day Initiative3 months ago

ZDI-26-310: Microsoft Windows splwow64 Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-289186.5 MEDIUMZero Day Initiative3 months ago

ZDI-26-311: Apple macOS CoreSymbolication Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction…

VULNhighCVE-2026-289558.8 HIGHZero Day Initiative3 months ago

ZDI-26-312: Apple Safari Web Inspector WebCore Style Resolver Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction i…

VULNhighCVE-2026-288478.8 HIGHZero Day Initiative3 months ago

ZDI-26-313: Apple Safari Regular Expression Duplicate Named Groups Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction i…

VULNhighCVE-2026-338387.8 HIGHZero Day Initiative3 months ago

ZDI-26-309: Microsoft Windows Message Queueing Double Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows that run Message Q…

VULNhighCVE-2025-126597.8 HIGHZero Day Initiative3 months ago

ZDI-26-317: Siemens Simcenter Femap IPT File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Simcenter Femap. User in…

VULNhighCVE-2025-126597.8 HIGHZero Day Initiative3 months ago

ZDI-26-316: Siemens Simcenter Femap IPT File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Simcenter Femap. User in…

VULNhighCVE-2026-81096.5 MEDIUMZero Day Initiative3 months ago

ZDI-26-308: Ivanti Endpoint Manager RemoteControlAuth Exposed Dangerous Method Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Endpoint Manager.…

VULNhighCVE-2026-289417.1 HIGHZero Day Initiative3 months ago

ZDI-26-315: Apple macOS USD Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction…

VULNhighCVE-2026-289408.8 HIGHZero Day Initiative3 months ago

ZDI-26-314: Apple macOS USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with th…

VULNPalo Alto Unit 423 months ago

Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral dete…

VULNhighMandiant3 months ago

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Executive Summary Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has contin…

VULNCheck Point Research3 months ago

11th May – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 11th May, please download our Threat Intelligence Bulletin. TOP ATTAC…

VULNCheck Point Research3 months ago

The State of Ransomware – Q1 2026

Key Findings Ransomware in Q1 2026: Consolidation at Scale During the first quarter of 2026, we monitored more than 70 active data…

VULNRecorded Future3 months ago

Working in London at the World’s Largest Intelligence Company

See what it is like to work at the Recorded Future London office.

VULNSentinelOne Labs3 months ago

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

Cloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, and potentia…

VULNcriticalCVE-2026-03009.8 CRITICALPalo Alto Unit 423 months ago

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Unit 42 details CVE-2026-0300, a buffer overflow vulnerability in the PAN-OS User-ID Authentication Portal. Read now for details.…

VULNRecorded Future3 months ago

Quantum Risk Explained

Learn how the "Harvest Now, Decrypt Later" (HNDL) risk exposes long-lived sensitive data today, regardless of when Cryptographical…

VULNSentinelOne Labs3 months ago

LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience

Joe FitzPatrick reveals how consumer imports of networked devices pose a real security risk to small businesses and critical infra…