Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,023 articles

Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF) vulnerability in…

VULNFull Disclosure5 days ago

Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read

Posted by Ron E on Sep 03 Description Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability…

VULNFull Disclosure5 days ago

Payara 7.2026.1.RC1 Remote Code Execution via Server-Side Includes #exec Directive in Payara Server

Posted by Ron E on Sep 03 *Description:* Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation t…

VULNFull Disclosure5 days ago

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server

Posted by Ron E on Sep 03 Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlle…

VULNFull Disclosure5 days ago

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility…

VULNFull Disclosure5 days ago

thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program

Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow vulnerability exists in the redirect CGI program distribute…

VULNFull Disclosure5 days ago

thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption

Posted by Ron E on Sep 03 *Description:* A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with t…

VULNFull Disclosure5 days ago

lighttpd2 Signedness Error in li_chunkqueue_append_mem() Leads to Out-of-Bounds Memory Access

Posted by Ron E on Sep 03 *Description:* A signedness vulnerability exists in the li_chunkqueue_append_mem() function in lighttpd2…

VULNFull Disclosure5 days ago

Paho v1.3.15 Heap Use-After-Free in Eclipse Paho MQTT C Client via Message Retry Logi

Posted by Ron E on Sep 03 *Description:* Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in the synchronou…

VULNFull Disclosure5 days ago

Paho v1.3.15 Arbitrary Code Execution via Untrusted Dynamic Library Execution

Posted by Ron E on Sep 03 *Description:* Arbitrary code execution is possible in the MQTTVersion utility due to unsafe loading and…

VULNFull Disclosure5 days ago

Paho v1.3.15 Arbitrary Code Execution via Shared Library Search Path Hijacking

Posted by Ron E on Sep 03 *Description:* Arbitrary code execution is possible in the MQTTVersion utility due to uncontrolled loadi…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] ZesleCP 3.1.21 Authenticated arbitrary file write to root RCE via cron (8.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in ZesleCP 3.1…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] StreamSets DataCollector 6.4.1 (official Docker image) Default credentials plus unsandboxed Shell Executor to root RCE (9.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in StreamSets…

VULNcriticalCVE-2025-54598.8 HIGHFull Disclosure5 days ago

[0day-rubbish] Puppet Enterprise 2025.10.0 Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (8.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Ente…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] NoMachine Terminal Server 10.0.57 two vulnerabilities

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing two vulnerabilities in NoMachi…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] Minuteman UPS Network Management Card 1.60.3 Unauthenticated OS command injection to root RCE (9.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in Minuteman U…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantron…

VULNcriticalFull Disclosure5 days ago

[0day-rubbish] GeoVision GV-TBL4700 V1.06 Authenticated command injection to root RCE via SNMPv3 user configuration (8.8)

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in GeoVision G…

VULNhighRecorded Future5 days ago

Recorded Future Announces Automated Signature Creation, Accelerating Vulnerability Prioritization

Recorded Future's Automated Signature Creation turns new vulnerabilities into detection signatures in under an hour, matching the…

VULNhighMicrosoft Security6 days ago

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email…

VULNPalo Alto Unit 426 days ago

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to…

VULNExploit-DB6 days ago

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

FreePBX 17.0.2 - Remote Code Execution (RCE)

VULNExploit-DB6 days ago

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

Metabase 0.61.0 - Authenticated Remote Code Execution

VULNhighRecorded Future6 days ago

H1 2026 Malware Vulnerability Trends

Learn how adversaries abuse trusted tools, AI, and developer environments for cyberattacks. Get actionable insights on ransomware,…

VULNMicrosoft Security6 days ago

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to i…

VULNCheck Point Research7 days ago

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The…

VULNPalo Alto Unit 427 days ago

An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation

Using autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address and defend…

VULNExploit-DB7 days ago

[dos] EVerest 2025.9.0 - DoS

EVerest 2025.9.0 - DoS

VULNExploit-DB7 days ago

[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

VULNExploit-DB7 days ago

[webapps] PodcastGenerator 3.2.9 - Stored XSS

PodcastGenerator 3.2.9 - Stored XSS