Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

Synology stale DNS allows practical interception of traffic from vulnerable DSM clients

Posted by shed riot on Jul 22 # Synology stale DNS allows practical interception of traffic from vulnerable DSM clients Vendor ca…

VULNFull Disclosure3 months ago

Amplitude customers using domain proxies should update their configuration immediately.

Posted by shed riot on Jul 22 After receiving live analytics requests intended for `api2.amplitude.com`, I contacted `security ()…

VULNRecorded Future3 months ago

TAG-195 Upgrades MaaS Ecosystem with Modular Tools

Insikt Group identifies four new TAG-195 malware families, revealing an architectural transition toward modular, operator-driven t…

VULNhighSentinelOne Labs3 months ago

Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?

A real-world benchmark tests whether powerful AI models can keep an investigation trustworthy when new evidence invalidates their…

VULNMicrosoft Security3 months ago

Real world incident response: Microsoft and AXA XL strengthen cyber resilience

Our collaboration with AXA XL brings Microsoft Incident Response services directly to cyber insurance policyholders, helping organ…

VULNRecorded Future3 months ago

Modern Attack Vectors | Recorded Future

What is an attack vector, and how does it impact your business? Discover the top threat actor targets in 2026 and learn attack vec…

VULNSentinelOne Labs3 months ago

Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

In April, SentinelLABS’ Tom Hegel published an initial assessment of the first five weeks of the conflict. Three months later, the…

VULNhighCVE-2026-13585Full Disclosure3 months ago

ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping in ASUS Business/Software Manager kernel driver

Posted by Hayaturehman Ahmadzai on Jul 20 Hi all, I'm disclosing a vulnerability (CVE-2026-13585) in the ASUS bsitf.sys / AsusBSI…

VULNFull Disclosure3 months ago

New Release: UFONet v2.0 - "R3DST4R!"...

Posted by psy on Jul 20 Hi Community, https://ufonet.03c8.net --------- "UFONet is a free software, P2P and cryptographic -disru…

VULNFull Disclosure3 months ago

XSSer v.1.9 - "Bl4ck Swarm!" released

Posted by psy on Jul 20 Hi FD, https://xsser.03c8.net --------- "Cross Site "Scripter" (aka XSSer) is an automatic -framework- t…

VULNhighFull Disclosure3 months ago

NotCVE registry index — public records of vulnerabilities that shipped without a CVE

Posted by NotCVE Advisories on Jul 20 ---------------------------------------------------------------------------- https://notcve.…

VULNhighCVE-2026-503257.0 HIGHZero Day Initiative3 months ago

ZDI-26-445: Microsoft Windows WMI Providers Incorrect Authorization Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNhighCVE-2026-502977.0 HIGHZero Day Initiative3 months ago

ZDI-26-446: Microsoft Windows WMI Providers Incorrect Authorization Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must…

VULNCheck Point Research3 months ago

20th July – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 20th July, please download our Threat Intelligence Bulletin. TOP ATTA…

VULNRecorded Future3 months ago

Threat Hunting: A Guide | Recorded Future

Master modern cyber threat hunting by embracing real-time threat intelligence. Discover the elite tools, steps, and frameworks to…

VULNMicrosoft Security3 months ago

Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks

Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and…

VULNcriticalPalo Alto Unit 423 months ago

Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and p…

VULNMicrosoft Security3 months ago

ACR Stealer: Two observed intrusion chains amid increased threat activity

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environm…

VULNPalo Alto Unit 423 months ago

AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report

Explore Unit 42's perspectives on AI's impact on cybersecurity, including key updates since the 2026 Incident Response Report. The…

VULNMicrosoft Security3 months ago

Least privilege for AI agents: Identity, access, and tool binding

As AI agents become more autonomous, strong identity, access, and auditing controls are critical to keeping them secure. The post…

VULNhighCVE-2026-0001Full Disclosure3 months ago

[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure

Posted by NotCVE Advisories on Jul 15 ---------------------------------------------------------------------------- NotCVE Disclosu…

VULNFull Disclosure3 months ago

Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312)

Posted by AliReza on Jul 15 # Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config https://ezsystemrepairs…

VULNhighCVE-2026-568776.3 MEDIUMFull Disclosure3 months ago

CVE-2026-56877 - Skillable SCORM userId authorisation bypass

Posted by Greg via Fulldisclosure on Jul 15 Skillable's SCORM lab launch endpoint validates a launch token but enforces per-user a…

VULNMicrosoft Security3 months ago

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysi…

VULNRecorded Future3 months ago

AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict

Explore how Iran has utilized AI to enhance its asymmetric playbook during the 2026 conflict. Learn how AI acts as a force multipl…

VULNMicrosoft Security3 months ago

Turning threat intelligence into decisive action with Defender Experts

Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identitie…

VULNPalo Alto Unit 423 months ago

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture an…

VULNhighCVE-2026-133096.8 MEDIUMZero Day Initiative3 months ago

ZDI-26-435: (Pwn2Own) Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC…

VULNhighCVE-2026-61027.8 HIGHZero Day Initiative3 months ago

ZDI-26-430: MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first o…

VULNhighCVE-2026-133056.4 MEDIUMZero Day Initiative3 months ago

ZDI-26-433: (Pwn2Own) Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC…