Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

937 articles

VULNcriticalZero Day Initiative4 months ago

ZDI-26-260: (0Day) Docker Desktop System Editor Uncontrolled Search Path Element Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must fir…

VULNcriticalZero Day Initiative4 months ago

ZDI-26-259: (0Day) Docker Desktop cli-plugins Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. An attac…

VULNhighZero Day Initiative4 months ago

ZDI-26-274: Microsoft Qlib fit Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction…

VULNcriticalZero Day Initiative4 months ago

ZDI-26-258: (0Day) Docker Desktop extension-manager Exposed Dangerous Function Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop for Windows. An attac…

VULNhighCVE-2026-5424Zero Day Initiative4 months ago

ZDI-26-271: Avast Premium Security Gen Self Protection Driver Exposed Dangerous Function Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker…

VULNhighCVE-2026-346197.7 HIGHZero Day Initiative4 months ago

ZDI-26-262: Adobe ColdFusion deleteVersion Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of Adobe ColdFusion. Although authe…

VULNhighCVE-2026-5489Zero Day Initiative4 months ago

ZDI-26-285: DriveLock Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authenticatio…

VULNhighCVE-2026-273058.6 HIGHZero Day Initiative4 months ago

ZDI-26-264: Adobe ColdFusion fetchCFSettingFile Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe ColdFusion. Authen…

VULNhighCVE-2026-228989.8 CRITICALZero Day Initiative4 months ago

ZDI-26-292: QNAP TS-453E QVRPro excpostgres Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices.…

VULNhighCVE-2026-398114.9 MEDIUMZero Day Initiative4 months ago

ZDI-26-265: Fortinet FortiWeb cgi_buf_alloc Integer Overflow Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Fortinet FortiWeb.…

VULNhighCVE-2026-328617.8 HIGHZero Day Initiative4 months ago

ZDI-26-291: NI LabVIEW LVCLASS File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI LabVIEW. User interaction is…

VULNhighZero Day Initiative4 months ago

ZDI-26-275: Microsoft Qlib _mount_nfs_uri Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Microsoft Qlib. Authen…

VULNhighCVE-2025-549489.4 CRITICALZero Day Initiative4 months ago

ZDI-26-269: TrendAI Apex One Console Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentica…

VULNhighCVE-2026-252037.8 HIGHZero Day Initiative4 months ago

ZDI-26-268: Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Samsung MagicINFO 9 Server. An attac…

VULNhighCVE-2026-272827.5 HIGHZero Day Initiative4 months ago

ZDI-26-263: Adobe ColdFusion subscribeToEndpoints Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Adobe ColdFusion. Authentication…

VULNcriticalZero Day Initiative4 months ago

ZDI-26-261: (0Day) Docker Desktop credentialHelper Directory Traversal Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must fir…

VULNhighCVE-2026-320737.0 HIGHZero Day Initiative4 months ago

ZDI-26-277: Microsoft Windows afd.sys Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-328607.8 HIGHZero Day Initiative4 months ago

ZDI-26-290: NI LabVIEW LVLIB File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI LabVIEW. User interaction is…

VULNhighCVE-2026-321837.8 HIGHZero Day Initiative4 months ago

ZDI-26-279: Microsoft Windows Snipping Tool Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interact…

VULNhighCVE-2026-5492Zero Day Initiative4 months ago

ZDI-26-288: DriveLock Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authenticatio…

VULNhighCVE-2026-5491Zero Day Initiative4 months ago

ZDI-26-287: DriveLock Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authenticatio…

VULNhighCVE-2026-5490Zero Day Initiative4 months ago

ZDI-26-286: DriveLock SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is requir…

VULNhighCVE-2025-710667.5 HIGHZero Day Initiative4 months ago

ZDI-26-289: Linux Kernel ETS Scheduler Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first…

VULNhighCVE-2026-340547.8 HIGHZero Day Initiative4 months ago

ZDI-26-281: Microsoft vcpkg OpenSSL Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on applications built using the Microsoft vcpkg port of OpenSSL.…

VULNhighCVE-2026-261797.8 HIGHZero Day Initiative4 months ago

ZDI-26-276: Microsoft Windows Secure Kernel Double Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-331047.0 HIGHZero Day Initiative4 months ago

ZDI-26-278: Microsoft Windows win32kfull Improper Locking Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-5056Zero Day Initiative4 months ago

ZDI-26-283: GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this…

VULNhighCVE-2026-5487Zero Day Initiative4 months ago

ZDI-26-284: DriveLock Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authenticatio…

VULNhighCVE-2025-549879.4 CRITICALZero Day Initiative4 months ago

ZDI-26-270: TrendAI Apex One Console Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentica…

VULNRecorded Future4 months ago

Your Supply Chain Breach Is Someone Else's Payday

A supply chain attack by TeamPCP compromised trusted software tools to harvest credentials at scale, enabling payroll fraud, logis…