attack_FeedLIVE

Vulnerability Alerts

Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNFull Disclosureabout 2 months ago

Dovecot Security Advisory 3/2026

Posted by Aki Tuomi on Aug 29 Hi! https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.…

VULNMicrosoft Securityabout 2 months ago

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reve…

VULNPalo Alto Unit 42about 2 months ago

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layer…

VULNMicrosoft Securityabout 2 months ago

What’s new in Microsoft Security: August 2026

This month’s updates provide new capabilities to help organizations gain insights into agent activity, expand security coverage ac…

VULNRecorded Future2 months ago

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic or…

VULNCVE-2026-650536.1 MEDIUMFull Disclosure2 months ago

FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)

Posted by Evan Tang on Aug 26 https://blog.evan.lat/posts/CVE-2026-65053/ the blog talks about two vulns that are chainable toget…

VULNhighCVE-2026-00138.4 HIGHFull Disclosure2 months ago

[NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00126.2 MEDIUMFull Disclosure2 months ago

[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00118.4 HIGHFull Disclosure2 months ago

[NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00108.4 HIGHFull Disclosure2 months ago

[NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00097.8 HIGHFull Disclosure2 months ago

[NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNMicrosoft Security2 months ago

When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvest…

VULNFull Disclosure2 months ago

Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure

Posted by Ron E on Aug 26 An unauthenticated remote debugger vulnerability exists in Escargot v4.3.0-214-gfaee4437 when the applic…

VULNFull Disclosure2 months ago

Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path

Posted by Ron E on Aug 26 An OS command injection vulnerability exists in the Escargot v4.3.0-214-gfaee4437 crash handler due to a…

VULNFull Disclosure2 months ago

Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow

Posted by Ron E on Aug 26 Escargot contains a remotely triggerable one-byte stack-based out-of-bounds write in the WebSocket messa…

VULNFull Disclosure2 months ago

UltraJSON v5.13.0-6-g733f9e1 Length-Boundary Violation Causes Out-of-Bounds Read During Incomplete JSON Parsing

Posted by Ron E on Aug 26 UltraJSON contains an out-of-bounds read in its native C JSON decoder when processing certain incomplete…

VULNFull Disclosure2 months ago

Realtek edimax 52fc10d19 In-Band Ioctl Response Length Confusion Causes Heap Buffer Overflow

Posted by Ron E on Aug 26 The Realtek in-band ioctl bridge contains a heap-buffer overflow when processing peer-supplied ioctl res…

VULNFull Disclosure2 months ago

WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize

Posted by Ron E on Aug 26 WatsonWebserver contains an HTTP/1 request body size-limit bypass when processing requests using Transfe…

VULNFull Disclosure2 months ago

Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags

Posted by Ron E on Aug 26 Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection…

VULNFull Disclosure2 months ago

Chronicle Wire v2026.8 Insecure Reflection Allows Unvalidated Method Invocation

Posted by Ron E on Aug 26 Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events…

VULNFull Disclosure2 months ago

Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection

Posted by Ron E on Aug 26 Chronicle Wire's FileMarshallableOut follows symbolic links when writing files in append mode. When ?app…

VULNhighFull Disclosure2 months ago

Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Aug 26 ----------------------------------------------------------------…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] VitalPBX 4.5.2 (Asterisk 20.20.1) Authenticated root RCE via asterisk_cli to dialplan System() (8.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in VitalPBX 4.…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Seeq Server R65.2.3 (default deployment with Data Lab installed via the official CLI) Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (9.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Seeq Server…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX gateway) Authenticated config injection to root RCE (8.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Raritan EMX…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] mySCADA PRO Runtime 9.4.0 (container deployment msxrun; earlier versions with the same upgrade branch are likely affected) Unauthenticated OS command injection to root RCE (9.4)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in mySCADA PRO…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Maian Gallery v2.1 Authenticated unrestricted file upload to PHP RCE (7.2)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Galle…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] NCache Enterprise 5.3.6 (other versions with the same default-disabled security and handler logic are likely affected) Pre-authentication RCE (missing auth + attacker assembly load) (9.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in NCache Ente…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] myDBR 7.5.4 (build 5454) (other versions with the same file-editor are likely affected) Authenticated RCE (admin file editor + default credentials) (8.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in myDBR 7.5.4…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Microsip 2026 (ASD data-service agent) 2026 Eval (other builds with the same backup-runner path handling are likely affected) Pre-authentication RCE (attacker-controlled binary path, LocalSystem) (9.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Microsip 20…