Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

TAG-193’s Regional Espionage Operations

Explore joint Cisco Talos and Recorded Future research on TAG-193's cyber-espionage operations targeting government across Central…

VULNPalo Alto Unit 4212 days ago

The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk

Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organ…

VULNCVE-2026-350298.8 HIGHCheck Point Research12 days ago

When LLM Gateways Go Wrong: Findings from LiteLLM

TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnera…

VULNcriticalZero Day Initiative12 days ago

ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery Vulnerability

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Genesis World.…

VULNcriticalZero Day Initiative12 days ago

ZDI-26-754: (0Day) Genesis World URDF Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Genesis World. Interacti…

VULNcriticalZero Day Initiative12 days ago

ZDI-26-753: (0Day) Genesis World MJCF Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Genesis World. Interacti…

VULNcriticalZero Day Initiative12 days ago

ZDI-26-752: (0Day) Genesis World decompress_usdz Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Genesis World. Interaction with…

VULNcriticalZero Day Initiative12 days ago

ZDI-26-756: (0Day) Genesis World load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Genesis World. Interaction with…

VULNRecorded Future13 days ago

September 2026 CVE Landscape

In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which…

VULNhighRecorded Future13 days ago

Malware Indicators of Compromise (IoCs) | Recorded Future

Learn what malware indicators of compromise (IoCs) are, common types, how they’re collected, and best practices for detection and…

VULNCheck Point Research13 days ago

12th October – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP A…

VULNhighCVE-2026-82077watchTowr Labs16 days ago

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs…

VULNRecorded Future17 days ago

Recorded Future Introduces AI Infrastructure Indicator Lists, Strengthening AI Governance

Recorded Future's new AI Infrastructure Indicator Lists help security teams find shadow AI, enforce policy, and prevent data loss.

VULNMicrosoft Security17 days ago

Post-quantum authentication: Why organizations should start testing certificate ecosystems now

Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps a…

VULNRecorded Future18 days ago

Japan Adopts Proactive Cyber Defense Strategy

Learn about Japan's Active Cyber Defense (ACD) strategy, mandatory reporting rules, and key impacts on critical infrastructure.

VULNPalo Alto Unit 4218 days ago

Evolution of Web3 in Cloud Supply Chain Attacks

Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud env…

VULNhighMicrosoft Security18 days ago

3 lessons from frontier AI vulnerability research

Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel. The post 3 lessons…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in StreamSets…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in RCDevs WebA…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Cart…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in IPConfigure…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] Circutor LineEds 24.11.14-r0 unauthenticated pwrstudio events.xml shellExecute command injection (9.8)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in the pwrstud…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] Asustor ADM 3.5.9.RWM1 (AS602T) music.cgi act=live stored-filename command injection reaching system() (8.8 primary, PR:L)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in the media h…

VULNcriticalFull Disclosure19 days ago

[0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8)

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Advantech W…

VULNFull Disclosure19 days ago

SEC Consult Research 20261001 :: Arbitrary Email sender spoofing in Apple iCloud mail

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 06 SEC Consult Vulnerability Lab Research Announcement ========…

VULNhighCVE-2026-4637Full Disclosure19 days ago

SEC Consult SA-20260924-0 :: Multiple Vulnerabilities in Paessler PRTG Network Monitor #CVE-2026-4637 #CVE-2026-4638

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 06 SEC Consult Vulnerability Lab Security Advisory ============…

VULNhighCVE-2026-215897.5 HIGHwatchTowr Labs19 days ago

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

Welcome back to yet another episode of "security was taken seriously". Being who we are (and constantly being exposed to what we s…

VULNhighMicrosoft Security19 days ago

CISO perspectives on managing vulnerability risks in the age of AI

Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management. The po…

VULNPalo Alto Unit 4219 days ago

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target cri…

VULNGoogle Project Zero19 days ago

How to fix a bug in a fix

Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making s…