Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNhighCVE-2026-242687.8 HIGHZero Day Initiative2 months ago

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interactio…

VULNhighCVE-2026-242387.8 HIGHZero Day Initiative2 months ago

ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interactio…

VULNhighCVE-2026-242727.8 HIGHZero Day Initiative2 months ago

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interactio…

VULNhighCVE-2026-197739.8 CRITICALZero Day Initiative2 months ago

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is…

VULNhighCVE-2026-195044.0 MEDIUMZero Day Initiative2 months ago

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction w…

VULNhighCVE-2026-197817.8 HIGHZero Day Initiative2 months ago

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User inter…

VULNhighCVE-2026-198867.8 HIGHZero Day Initiative2 months ago

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User in…

VULNhighCVE-2026-198857.8 HIGHZero Day Initiative2 months ago

ZDI-26-585: OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User in…

VULNhighCVE-2026-197747.1 HIGHZero Day Initiative2 months ago

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker mus…

VULNPalo Alto Unit 422 months ago

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and stric…

VULNCheck Point Research2 months ago

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-contro…

VULNPalo Alto Unit 422 months ago

Identity Abuse Through Trusted Communication Channels

Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defe…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] VMS 6.48.809 Authenticated command injection to root RCE (8.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in VMS 6.48.80…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] ONE Reporter 13.1 Authenticated RCE / privilege escalation via CommandExecutor (8.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in ONE Reporte…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Gemini 7.3.0 Authenticated SQL injection to xp_cmdshell RCE (8.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in Gemini 7.3.…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] RoboTask 11.0.5.1229 Unauthenticated REST API remote task execution (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in RoboTask 11…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] ActiveFax Server 10.70 Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in ActiveFax S…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Tornado 2.11.3 Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in Tornado 2.1…

VULNcriticalFull Disclosure2 months ago

[0day-rubbish] Datalore On-Premises 2026.2.3 Unauthenticated RCE via InteractiveReport access-mapping flaw (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in Datalore On…

VULNFull Disclosure2 months ago

APPLE-SA-08-18-2026-1 Safari 26.6.1

Posted by Apple Product Security via Fulldisclosure on Aug 19 APPLE-SA-08-18-2026-1 Safari 26.6.1 https://support.apple.com/148286…

VULNCVE-2026-719609.1 CRITICALFull Disclosure2 months ago

Cudy WR3000: Hard-coded JWT Secret to Root Command Injection

Posted by Nir Yehoshua on Aug 19 Hello Full Disclosure list, Cipher Security Labs has published details for two vulnerabilities a…

VULNMicrosoft Security2 months ago

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Microsoft is named a visionary leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, recognized for unified runt…

VULNRecorded Future2 months ago

Recorded Future Launches 6 New Capabilities for Third-Party Risk

Recorded Future has launched native risk ratings capabilities inside its Third-Party Risk product, uniting threat intelligence and…

VULNMicrosoft Security2 months ago

Hunting MacSync Stealer infrastructure through behavioral pivots

MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+…

VULNhighCheck Point Research2 months ago

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Research by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopAndProtect…

VULNFull Disclosure2 months ago

Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry…

VULNFull Disclosure2 months ago

Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer…

VULNFull Disclosure2 months ago

Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology))

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in Output Mess…

VULNFull Disclosure2 months ago

Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy…

VULNFull Disclosure2 months ago

Security advisory: Authenticated RCE (second-order SQL injection) in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper)

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper…