Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNhighCVE-2026-352739.8 CRITICALZero Day Initiative4 months ago

ZDI-26-389: Oracle PeopleSoft ExecuteProcessActivityCommand External Control of File Path Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle PeopleSoft. Although auth…

VULNhighCVE-2026-502587.8 HIGHZero Day Initiative4 months ago

ZDI-26-392: X.Org Server Xkb Key Types Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first…

VULNhighCVE-2026-502597.8 HIGHZero Day Initiative4 months ago

ZDI-26-393: X.Org Server SetMap Request Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first…

VULNhighCVE-2026-502607.8 HIGHZero Day Initiative4 months ago

ZDI-26-394: X.Org Server FreeCounter Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first…

VULNhighCVE-2026-502617.8 HIGHZero Day Initiative4 months ago

ZDI-26-395: X.Org Server SyncChangeCounter Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first…

VULNhighCVE-2026-97745.5 MEDIUMZero Day Initiative4 months ago

ZDI-26-378: ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is r…

VULNhighCVE-2026-97755.5 MEDIUMZero Day Initiative4 months ago

ZDI-26-379: ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is r…

VULNhighCVE-2026-97767.5 HIGHZero Day Initiative4 months ago

ZDI-26-380: ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authenticat…

VULNhighCVE-2026-97777.2 HIGHZero Day Initiative4 months ago

ZDI-26-381: ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is r…

VULNhighCVE-2026-97787.2 HIGHZero Day Initiative4 months ago

ZDI-26-382: ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is r…

VULNPalo Alto Unit 424 months ago

OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute ag…

VULNhighSentinelOne Labs4 months ago

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegra…

VULNRecorded Future4 months ago

The Purchase Scam Tactic Headed for the World Cup | Recorded Future

A purchase scam tactic hijacks organic search through compromised sites, and it’s built to scale into 2026 FIFA World Cup fraud. H…

VULNPalo Alto Unit 424 months ago

The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams acr…

VULNMicrosoft Security4 months ago

Guarding AI memory

What happens when threat actors target what AI remembers? Microsoft breaks down the risks and the defenses. The post Guarding AI m…

VULNCheck Point Research4 months ago

22nd June – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin. TOP ATTA…

VULNMicrosoft Security4 months ago

One intrusion, two cyberattackers: Uncovering parallel threat activity

Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often miss moder…

VULNCVE-2026-560995.3 MEDIUMFull Disclosure4 months ago

OpenBSD mpls_do_error: Remote Kernel Stack Disclosure via MPLS Label Stack Over-read

Posted by shj on Jun 20 ------------------------------------------------------------------------ OpenBSD mpls_do_error: Remote Ker…

VULNFull Disclosure4 months ago

OpenBSD sppp_pap_input: PAP authentication bypass

Posted by shj on Jun 20 ------------------------------------------------------------------------ OpenBSD sppp_pap_input: PAP Authe…

VULNCVE-2025-10560Full Disclosure4 months ago

SEC Consult SA-20260618-0 :: Hardcoded Root Cloud Credentials in Application Binaries in Silver Leaf Technologies - Worksnaps.net Worksnaps

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 20 SEC Consult Vulnerability Lab Security Advisory ============…

VULNhighCVE-2026-11857Full Disclosure4 months ago

SEC Consult SA-20260617-1 :: Multiple Vulnerabilities in Quanos Content Solutions - SCHEMA ST4

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 20 SEC Consult Vulnerability Lab Security Advisory ============…

VULNcriticalCVE-2022-43339.8 CRITICALFull Disclosure4 months ago

SEC Consult SA-20260617-0 :: Multiple Critical Vulnerabilities in Sprecher Automation SPRECON-E-C/-E-P/-E-T3

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 20 SEC Consult Vulnerability Lab Security Advisory ============…

VULNhighCVE-2026-12225Full Disclosure4 months ago

SEC Consult SA-20260616-0 :: Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket #CVE-2026-12225

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 20 SEC Consult Vulnerability Lab Security Advisory ============…

VULNFull Disclosure4 months ago

APPLE-SA-06-16-2026-1 Beats Firmware Update 1B211

Posted by Apple Product Security via Fulldisclosure on Jun 20 APPLE-SA-06-16-2026-1 Beats Firmware Update 1B211 https://support.ap…

VULNFull Disclosure4 months ago

PHP 8.5.7 `levenshtein()` signed-integer overflow

Posted by Khashayar Fereidani on Jun 20 # PHP 8.5.7 `levenshtein()` signed-integer overflow https://fereidani.com/php-857-levensht…

VULNFull Disclosure4 months ago

PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow

Posted by Khashayar Fereidani on Jun 20 # PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow https://fereidani.com/php-8…

VULNFull Disclosure4 months ago

PHP 8.5.7 `mb_substr()` 'SJIS-mac' size_t underflow

Posted by Khashayar Fereidani on Jun 20 # PHP 8.5.7 `mb_substr()` 'SJIS-mac' size_t underflow https://fereidani.com/php-857-mbsubs…

VULNFull Disclosure4 months ago

PHP 8.5.7 `FILTER_SANITIZE_ENCODED` uninitialized read

Posted by Khashayar Fereidani on Jun 20 # PHP 8.5.7 `FILTER_SANITIZE_ENCODED` uninitialized read https://fereidani.com/php-857-fil…

VULNhighCVE-2025-68624Full Disclosure4 months ago

CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure

Posted by Alessandro Bertoldi BCS via Fulldisclosure on Jun 20 CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N…

VULNPalo Alto Unit 424 months ago

Threat Brief: Mitigating Large-Scale Credential Attacks

We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting securi…