Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNhighCVE-2026-182627.8 HIGHZero Day Initiative3 months ago

ZDI-26-555: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker mu…

VULNhighCVE-2026-131217.8 HIGHZero Day Initiative3 months ago

ZDI-26-554: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker mu…

VULNhighCVE-2026-182947.8 HIGHZero Day Initiative3 months ago

ZDI-26-553: OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User in…

VULNhighCVE-2026-182937.8 HIGHZero Day Initiative3 months ago

ZDI-26-552: OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User in…

VULNhighCVE-2026-182927.8 HIGHZero Day Initiative3 months ago

ZDI-26-551: OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro . User inter…

VULNhighCVE-2026-692649.8 CRITICALZero Day Initiative3 months ago

ZDI-26-546: Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not r…

VULNhighCVE-2026-692568.8 HIGHZero Day Initiative3 months ago

ZDI-26-545: Flowise CSV_Agent customReadCSV Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is requi…

VULNExploit-DB3 months ago

[webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

VULNExploit-DB3 months ago

[webapps] Ray 2.56.0 - Directory Traversal & Local File Inclusion

Ray 2.56.0 - Directory Traversal & Local File Inclusion

VULNExploit-DB3 months ago

[webapps] Apache Gravitino 1.2.1 - SSRF

Apache Gravitino 1.2.1 - SSRF

VULNExploit-DB3 months ago

[webapps] Blocksy Companion 2.1.46 - RCE

Blocksy Companion 2.1.46 - RCE

VULNExploit-DB3 months ago

[remote] PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

VULNExploit-DB3 months ago

[remote] mcp-server-kubernetes 3.8.x - Argument Injection

mcp-server-kubernetes 3.8.x - Argument Injection

VULNExploit-DB3 months ago

[dos] LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

VULNRecorded Future3 months ago

Mines, Minds, and Machines: The Journey of AI

Minerals become chips. Chips become data centers. Data centers become models, and models are acquiring arms and legs. From Earth t…

VULNPalo Alto Unit 423 months ago

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure…

VULNMicrosoft Security3 months ago

Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise

Microsoft is named a Leader in the 2026 IDC MarketScape for MDR services. Discover how Microsoft Defender Experts MDR combines AI,…

VULNMicrosoft Security3 months ago

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use o…

VULNCheck Point Research3 months ago

10th August – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 10th August, please download our Threat Intelligence Bulletin. TOP AT…

VULNExploit-DB3 months ago

[webapps] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution

OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution

VULNExploit-DB3 months ago

[local] Microsoft Edge 150.0.4078.48 - RCE

Microsoft Edge 150.0.4078.48 - RCE

VULNExploit-DB3 months ago

[webapps] CorgetGpsDget 2_3.2 - OS Command Injection

CorgetGpsDget 2_3.2 - OS Command Injection

VULNExploit-DB3 months ago

[webapps] Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

VULNhighRecorded Future3 months ago

The Hugging Face Hack Was Cheap Persistence at Work

The Hugging Face incident shows AI won't make attackers brilliant. It makes persistence cheap. Defense has to close the gap from w…

VULNPalo Alto Unit 423 months ago

Inside the Modern SOC: The Identity Front Door

Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respon…

VULNRecorded Future3 months ago

July 2026 CVE Landscape

In July 2026, Insikt Group® identified 85 high-impact vulnerabilities that should be prioritized for remediation, 36 of which had…

VULNPalo Alto Unit 423 months ago

ChainDrop: Inside a Self-Propagating npm Worm

Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2…

VULNhighCheck Point Research3 months ago

When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers

By Yarden Porat, Check Point Research Key Points The short version We set out to break Cloudflare Code Mode, and ended up breaking…

VULNFull Disclosure3 months ago

Dangling DNS record for bastion.certb.cdp.bethesda.net

Posted by shed riot on Aug 06 # Summary The hostname resolved to an address within a dynamic cloud IP pool. The address had been…

VULNFull Disclosure3 months ago

CL.0 desync in www.microsoft.com

Posted by shed riot on Aug 06 # Summary I reported the issue to the Microsoft Security Response Center twice: * VULN-165381, MSR…