Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

832 articles

VULNhighCVE-2026-657767.0 HIGHZero Day Initiative1 day ago

ZDI-26-540: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An att…

VULNhighCVE-2026-657737.8 HIGHZero Day Initiative1 day ago

ZDI-26-539: (Pwn2Own) Microsoft Windows ipt.sys Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-658147.8 HIGHZero Day Initiative1 day ago

ZDI-26-537: (Pwn2Own) Microsoft Windows storport Integer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-627357.8 HIGHZero Day Initiative1 day ago

ZDI-26-536: (Pwn2Own) Microsoft Windows http.sys Integer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-629118.0 HIGHZero Day Initiative1 day ago

ZDI-26-535: (Pwn2Own) Microsoft Exchange External Control of File Path Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange. Although aut…

VULNhighCVE-2026-629118.0 HIGHZero Day Initiative1 day ago

ZDI-26-534: (Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Exchange. Authenticatio…

VULNhighCVE-2026-661497.8 HIGHZero Day Initiative1 day ago

ZDI-26-532: SonicWall Email Security updateNetIf Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of SonicWall Email Security. An attacke…

VULNhighCVE-2026-661486.3 MEDIUMZero Day Initiative1 day ago

ZDI-26-531: SonicWall GMS Virtual Appliance interface Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of SonicWall GMS Virtual Appliance. An…

VULNhighCVE-2026-661507.8 HIGHZero Day Initiative1 day ago

ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of SonicWall Email Security. An attacke…

VULNExploit-DB2 days ago

[webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

VULNExploit-DB2 days ago

[webapps] Ray 2.56.0 - Directory Traversal & Local File Inclusion

Ray 2.56.0 - Directory Traversal & Local File Inclusion

VULNExploit-DB2 days ago

[webapps] Apache Gravitino 1.2.1 - SSRF

Apache Gravitino 1.2.1 - SSRF

VULNExploit-DB2 days ago

[webapps] Blocksy Companion 2.1.46 - RCE

Blocksy Companion 2.1.46 - RCE

VULNExploit-DB2 days ago

[remote] PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

VULNExploit-DB2 days ago

[remote] mcp-server-kubernetes 3.8.x - Argument Injection

mcp-server-kubernetes 3.8.x - Argument Injection

VULNExploit-DB2 days ago

[dos] LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

VULNRecorded Future2 days ago

Mines, Minds, and Machines: The Journey of AI

Minerals become chips. Chips become data centers. Data centers become models, and models are acquiring arms and legs. From Earth t…

VULNPalo Alto Unit 422 days ago

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure…

VULNMicrosoft Security2 days ago

Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise

Microsoft is named a Leader in the 2026 IDC MarketScape for MDR services. Discover how Microsoft Defender Experts MDR combines AI,…

VULNMicrosoft Security2 days ago

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use o…

VULNCheck Point Research2 days ago

10th August – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 10th August, please download our Threat Intelligence Bulletin. TOP AT…

VULNExploit-DB3 days ago

[webapps] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution

OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution

VULNExploit-DB3 days ago

[local] Microsoft Edge 150.0.4078.48 - RCE

Microsoft Edge 150.0.4078.48 - RCE

VULNExploit-DB3 days ago

[webapps] CorgetGpsDget 2_3.2 - OS Command Injection

CorgetGpsDget 2_3.2 - OS Command Injection

VULNExploit-DB3 days ago

[webapps] Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

VULNhighRecorded Future3 days ago

The Hugging Face Hack Was Cheap Persistence at Work

The Hugging Face incident shows AI won't make attackers brilliant. It makes persistence cheap. Defense has to close the gap from w…

VULNPalo Alto Unit 425 days ago

Inside the Modern SOC: The Identity Front Door

Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respon…

VULNRecorded Future6 days ago

July 2026 CVE Landscape

In July 2026, Insikt Group® identified 85 high-impact vulnerabilities that should be prioritized for remediation, 36 of which had…

VULNPalo Alto Unit 426 days ago

ChainDrop: Inside a Self-Propagating npm Worm

Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2…

VULNhighCheck Point Research6 days ago

When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers

By Yarden Porat, Check Point Research Key Points The short version We set out to break Cloudflare Code Mode, and ended up breaking…