Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNhighCVE-2026-596898.0 HIGHZero Day Initiative3 months ago

ZDI-26-482: Progress Software Kemp LoadMaster enablexroot Use of Hard-Coded Cryptographic Key Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Progress Software Kemp LoadMaster.…

VULNhighCVE-2026-182747.2 HIGHZero Day Initiative3 months ago

ZDI-26-479: Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Au…

VULNhighCVE-2026-156867.2 HIGHZero Day Initiative3 months ago

ZDI-26-478: Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is requi…

VULNhighCVE-2026-182847.8 HIGHZero Day Initiative3 months ago

ZDI-26-477: (Pwn2Own) Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Sony XAV-9500ES devices. An attacker…

VULNhighCVE-2026-478769.3 CRITICALZero Day Initiative3 months ago

ZDI-26-495: (Pwn2Own) VMware ESXi VMXNET3 espQueueMask Out-Of-Bounds Write Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of VMware ESXi. An attacker must first…

VULNhighCVE-2026-182803.9 LOWZero Day Initiative3 months ago

ZDI-26-473: (Pwn2Own) Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devi…

VULNhighCVE-2026-182798.8 HIGHZero Day Initiative3 months ago

ZDI-26-472: (Pwn2Own) Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES device…

VULNhighCVE-2026-182783.5 LOWZero Day Initiative3 months ago

ZDI-26-471: (Pwn2Own) Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sony XAV-9500E…

VULNhighCVE-2026-182716.8 MEDIUMZero Day Initiative3 months ago

ZDI-26-488: (Pwn2Own) Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR de…

VULNhighCVE-2026-130507.2 HIGHZero Day Initiative3 months ago

ZDI-26-500: WatchGuard FireWare OS networkd network_wireless_kick_off_user_cb Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authenti…

VULNhighCVE-2026-182997.8 HIGHZero Day Initiative3 months ago

ZDI-26-467: GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this…

VULNhighCVE-2026-182987.8 HIGHZero Day Initiative3 months ago

ZDI-26-466: GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is r…

VULNhighCVE-2026-182977.8 HIGHZero Day Initiative3 months ago

ZDI-26-465: GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is r…

VULNhighCVE-2026-182707.8 HIGHZero Day Initiative3 months ago

ZDI-26-487: (Pwn2Own) Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attack…

VULNhighCVE-2026-182696.8 MEDIUMZero Day Initiative3 months ago

ZDI-26-486: (Pwn2Own) Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR de…

VULNhighCVE-2026-182687.0 HIGHZero Day Initiative3 months ago

ZDI-26-485: (Pwn2Own) Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attack…

VULNhighCVE-2026-182676.8 MEDIUMZero Day Initiative3 months ago

ZDI-26-484: (Pwn2Own) Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR de…

VULNMicrosoft Security3 months ago

Rethinking security for the age of AI

Why security needs a new Cyber Stack — Introducing Project Perception The physics of cybersecurity are changing. Autonomous system…

VULNMicrosoft Security3 months ago

Enhancing AI security through global AI red teaming

Microsoft's External Red Team Alliance (EXTRA) is a global AI security initiative designed to advance AI safety research and red t…

VULNCheck Point Research3 months ago

27th July – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin. TOP ATTA…

VULNRecorded Future3 months ago

Ransomware is the Scoreboard

Ransomware is the scoreboard for defensive architecture. Learn why traditional security methods fail and how to use AI and threat…

VULNMicrosoft Security3 months ago

Email threat landscape: Q2 2026 trends and insights

In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to…

VULNPalo Alto Unit 423 months ago

Russian Global Webmail Espionage

Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credential…

VULNhighCVE-2026-123907.8 HIGHZero Day Initiative3 months ago

ZDI-26-449: AzeoTech DAQFactory CTL File Parsing Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User intera…

VULNhighCVE-2026-123577.2 HIGHZero Day Initiative3 months ago

ZDI-26-447: Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Au…

VULNhighCVE-2026-68517.0 HIGHZero Day Initiative3 months ago

ZDI-26-448: Bitdefender Total Security Shredder Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Bitdefender Total Security. An attac…

VULNhighZero Day Initiative3 months ago

ZDI-26-451: Docker Desktop for macOS Inference Server Permissive Allow List Sandbox Escape Vulnerability

This vulnerability allows local attackers to escape the model runner sandbox on affected installations of Docker Desktop for macOS…

VULNhighCVE-2026-129217.8 HIGHZero Day Initiative3 months ago

ZDI-26-450: AzeoTech DAQFactory CTL File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User intera…

VULNhighZero Day Initiative3 months ago

ZDI-26-452: Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction i…

VULNcriticalFull Disclosure3 months ago

A project is publishing full analyses of AI-discovered 0-days - first batch of 10 with reproducible exploits

Posted by zz lin on Jul 22 I came across a project, "0day Rubbish", that states it will continuously https://0day-rubbish.com/blog…