Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNhighCVE-2026-349297.8 HIGHZero Day Initiative5 months ago

ZDI-26-322: TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Vision One Security Agent. A…

VULNhighCVE-2026-349277.8 HIGHZero Day Initiative5 months ago

ZDI-26-320: TrendAI Vision One Security Agent Origin Validation Error Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of TrendAI Vision One Security Agent. A…

VULNPalo Alto Unit 425 months ago

Out of the Crypt: The Evolving Cyber Extortion Economy

Unit 42 explores trends in data theft and extortion, outlining key strategies for organizations as frontier AI models advance. The…

VULNExploit-DB5 months ago

[local] Realtek rtl819x - Local Privilege

Realtek rtl819x - Local Privilege

VULNExploit-DB5 months ago

[webapps] EspoCRM 9.3.3 - SSRF

EspoCRM 9.3.3 - SSRF

VULNExploit-DB5 months ago

[webapps] Casdoor 3.54.1 - Arbitrary File Write via Path Traversal

Casdoor 3.54.1 - Arbitrary File Write via Path Traversal

VULNExploit-DB5 months ago

[hardware] MeiG Smart FORGE_SLT711 - OS Command Injection

MeiG Smart FORGE_SLT711 - OS Command Injection

VULNExploit-DB5 months ago

[webapps] scramble - Remote Code Execution

scramble - Remote Code Execution

VULNExploit-DB5 months ago

[webapps] OpenCATS 0.9.7.4 - SQL Injection

OpenCATS 0.9.7.4 - SQL Injection

VULNExploit-DB5 months ago

[local] Linux Kernel - Local Privilege Escalation

Linux Kernel - Local Privilege Escalation

VULNCheck Point Research5 months ago

AI Threat Landscape Digest March-April 2026

Executive Summary During the March–April 2026 reporting period, AI use in offensive operations advanced from development and plann…

VULNFull Disclosure5 months ago

Re: Dovecot Security Advisory OXDC-2026-0002

Posted by Noel Butler via Fulldisclosure on May 25 So when is the fix for dovecot 2.3 source code due to be released? Since by yo…

VULNFull Disclosure5 months ago

SSRF in Anthropic mcp-server-fetch and Microsoft playwright-mcp — publicly disclosed via GitHub issues

Posted by outreach on May 25 -----BEGIN SECURITY ADVISORY----- Title: Server-Side Request Forgery (SSRF) in Anthropic mcp-server-…

VULNhighCVE-2021-217356.5 MEDIUMFull Disclosure5 months ago

[SECURITY ADVISORY] CVE-2021-21735 - ZTE ZXHN H168N V3.5 Unauthenticated Admin Credential Leak

Posted by m.nageh on May 25 -----BEGIN SECURITY ADVISORY----- Advisory ID: MONX-2021-001 CVE ID: CVE-2021-21735 Title:…

VULNhighCVE-2026-344747.5 HIGHFull Disclosure5 months ago

[SECURITY ADVISORY] CVE-2026-34474 - ZTE H298A/H108N Unauthenticated Admin Credential Exposure

Posted by m.nageh on May 25 -----BEGIN SECURITY ADVISORY----- Advisory ID: MONX-2026-003 CVE ID: CVE-2026-34474 Title:…

VULNhighCVE-2026-344727.1 HIGHFull Disclosure5 months ago

[SECURITY ADVISORY] CVE-2026-34472 - ZTE ZXHN H188A V6 Authentication Bypass via Pre-Login Wizard

Posted by m.nageh on May 25 -----BEGIN SECURITY ADVISORY----- Advisory ID: MONX-2026-002 CVE ID: CVE-2026-34472 Title:…

VULNhighCVE-2026-344737.5 HIGHFull Disclosure5 months ago

[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)

Posted by m.nageh on May 25 -----BEGIN SECURITY ADVISORY----- Advisory ID: MONX-2026-001 CVE ID: CVE-2026-34473 Title:…

VULNhighFull Disclosure5 months ago

Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect

Posted by Adamczyk Blazej on May 25 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Multiple vulnerabilities in Sparx…

VULNExploit-DB5 months ago

[webapps] Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover

Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover

VULNExploit-DB5 months ago

[hardware] D-Link DSL2600U - 'rom-0' Admin Password Disclosure

D-Link DSL2600U - 'rom-0' Admin Password Disclosure

VULNExploit-DB5 months ago

[webapps] Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service

VULNExploit-DB5 months ago

[webapps] Grav CMS 2.0.0-beta.2 - Remote Code Execution

Grav CMS 2.0.0-beta.2 - Remote Code Execution

VULNExploit-DB5 months ago

[local] Linux Kernel 6.8 - Local Privilege Escalation

Linux Kernel 6.8 - Local Privilege Escalation

VULNExploit-DB5 months ago

[webapps] cPanel - CRLF Injection

cPanel - CRLF Injection

VULNCheck Point Research5 months ago

25th May – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 25th May, please download our Threat Intelligence Bulletin. TOP ATTAC…

VULNhighMandiant5 months ago

2 PhaaS 2 Furious: The Evolution of Chinese-Language Phishing Services

While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is…

VULNhighMandiant5 months ago

Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability

Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incid…

VULNCheck Point Research5 months ago

Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict

Key Findings Introduction During the recent geopolitical tensions in the Middle East, we reported on multiple Iran-nexus threat ac…

VULNPalo Alto Unit 425 months ago

Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns

Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in re…

VULNPalo Alto Unit 425 months ago

Paved With Intent: ROADtools and Nation-State Tactics in the Cloud

Open-source framework ROADtools is being misused by threat actors for cloud intrusions. Learn how to identify its malicious use. T…