Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

[0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the setWAN WAN-configuration handler, root command execution (7.2)

Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in the Edimax…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the formWlanMP manufacturing-test handler, root command execution (7.2)

Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in the Edimax…

VULNFull Disclosure5 days ago

[ROOTEDCON] Call for Papers 2027 · RootedCON2027 (Madrid)

Posted by Román Ramírez on Oct 20 -=] About RootedCON RootedCON is a technology and cybersecurity conference that will take place…

VULNCheck Point Research5 days ago

The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations

Key Findings Introduction Antidetect browsers conceal their users’ digital identities, enabling a single operator or small team to…

VULNCheck Point Research6 days ago

19th October – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin. TOP A…

VULNMicrosoft Security6 days ago

Agents are your newest insiders. Security must move at their speed.

New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuousl…

VULNPalo Alto Unit 429 days ago

Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026

Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and…

VULNMicrosoft Security9 days ago

Managing open-weight model risk in enterprise deployments

New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations,…

VULNhighCVE-2026-93536Zero Day Initiative9 days ago

ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker…

VULNcriticalCVE-2026-88794Zero Day Initiative9 days ago

ZDI-26-779: (0Day) Sparx Systems Enterprise Architect XSLT Debugger XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sparx Systems Enterprise…

VULNhighCVE-2026-63273Zero Day Initiative9 days ago

ZDI-26-783: LibreOffice PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is…

VULNhighCVE-2026-63274Zero Day Initiative9 days ago

ZDI-26-782: LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is…

VULNhighCVE-2026-6045Zero Day Initiative9 days ago

ZDI-26-781: LibreOffice EMF+ Brush Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is…

VULNhighCVE-2026-580947.8 HIGHZero Day Initiative9 days ago

ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must fir…

VULNhighCVE-2026-580937.0 HIGHZero Day Initiative9 days ago

ZDI-26-784: FreeBSD Kernel kqueue Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must fir…

VULNRecorded Future10 days ago

TAG-217 Targets South Korean Financial Services with ARTEX

Learn how threat actor TAG-217 used the AI-driven ARTEX framework to target South Korean financial institutions in recent cyberatt…

VULNPalo Alto Unit 4210 days ago

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advan…

VULNFull Disclosure10 days ago

VestaCP <= 0.9.8-26: authenticated config-parser eval sinks -> root RCE (VESTACP-2026-001)

Posted by Bryan Ramirez via Fulldisclosure on Oct 15 Advisory ID: VESTACP-2026-001 / GHSA-m2mc-xwq7-pw72 Product: Vesta Co…

VULNFull Disclosure10 days ago

[SYSS-2026-080]: dcm4che - Path Traversal (CWE-22)

Posted by Matthias Deeg via Fulldisclosure on Oct 15 Advisory ID: SYSS-2026-080 Product: dcm4che M…

VULNFull Disclosure10 days ago

[SYSS-2026-079]: dcm4che - Path Traversal (CWE-22)

Posted by Matthias Deeg via Fulldisclosure on Oct 15 Advisory ID: SYSS-2026-079 Product: dcm4che M…

VULNFull Disclosure10 days ago

[SYSS-2026-078]: dcm4che - Path Traversal (CWE-22)

Posted by Matthias Deeg via Fulldisclosure on Oct 15 Advisory ID: SYSS-2026-078 Product: dcm4che M…

VULNFull Disclosure10 days ago

[SYSS-2026-077]: dcm4che - Path Traversal (CWE-22)

Posted by Matthias Deeg via Fulldisclosure on Oct 15 Advisory ID: SYSS-2026-077 Product: dcm4che M…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in South…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] SmartBear Collaborator Server 15.1.15101 authenticated DOORS/Simulink review-file upload zip-slip to anonymous webroot Groovy Server Page execution as uid 1001 (7.5)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear C…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] PacsOne Server 7.3.9 authenticated DICOMweb STOW-RS SOP Instance UID path traversal to www-data code execution on a PACS host (7.2)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in PacsOne Ser…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Guard…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo Por…

VULNcriticalFull Disclosure10 days ago

[0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel…