attack_FeedLIVE

Vulnerability Alerts

Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,023 articles

VULNhighCVE-2025-702909.8 CRITICALFull Disclosure10 days ago

Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)

Posted by t.preissl via Fulldisclosure on Aug 29 -----BEGIN SECURITY ADVISORY----- Title: Multiple Integer Overflows in U-Boot Fi…

VULNhighCVE-2025-702909.8 CRITICALFull Disclosure10 days ago

[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)

Posted by t.preissl via Fulldisclosure on Aug 29 -----BEGIN SECURITY ADVISORY----- Title: Multiple Integer Overflows in U-Boot Fi…

VULNFull Disclosure10 days ago

JSON Deserialiser Unconstrained Resource Consumption Proof of Concept

Posted by Daniel Owens via Fulldisclosure on Aug 29 On 26 October 2025 we published "Struts2 and Related Framework Array/Collectio…

VULNFull Disclosure10 days ago

Dovecot Security Advisory 3/2026

Posted by Aki Tuomi on Aug 29 Hi! https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.…

VULNMicrosoft Security11 days ago

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reve…

VULNPalo Alto Unit 4212 days ago

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layer…

VULNMicrosoft Security13 days ago

What’s new in Microsoft Security: August 2026

This month’s updates provide new capabilities to help organizations gain insights into agent activity, expand security coverage ac…

VULNRecorded Future13 days ago

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Discover how the Russian state-sponsored threat group BlueDelta is using the HOOKEDGE backdoor to target defense and diplomatic or…

VULNCVE-2026-650536.1 MEDIUMFull Disclosure14 days ago

FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)

Posted by Evan Tang on Aug 26 https://blog.evan.lat/posts/CVE-2026-65053/ the blog talks about two vulns that are chainable toget…

VULNhighCVE-2026-00138.4 HIGHFull Disclosure14 days ago

[NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00126.2 MEDIUMFull Disclosure14 days ago

[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00118.4 HIGHFull Disclosure14 days ago

[NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00108.4 HIGHFull Disclosure14 days ago

[NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNhighCVE-2026-00097.8 HIGHFull Disclosure14 days ago

[NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write

Posted by advisories on Aug 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotC…

VULNMicrosoft Security14 days ago

When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvest…

VULNFull Disclosure14 days ago

Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure

Posted by Ron E on Aug 26 An unauthenticated remote debugger vulnerability exists in Escargot v4.3.0-214-gfaee4437 when the applic…

VULNFull Disclosure14 days ago

Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path

Posted by Ron E on Aug 26 An OS command injection vulnerability exists in the Escargot v4.3.0-214-gfaee4437 crash handler due to a…

VULNFull Disclosure14 days ago

Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow

Posted by Ron E on Aug 26 Escargot contains a remotely triggerable one-byte stack-based out-of-bounds write in the WebSocket messa…

VULNFull Disclosure14 days ago

UltraJSON v5.13.0-6-g733f9e1 Length-Boundary Violation Causes Out-of-Bounds Read During Incomplete JSON Parsing

Posted by Ron E on Aug 26 UltraJSON contains an out-of-bounds read in its native C JSON decoder when processing certain incomplete…

VULNFull Disclosure14 days ago

Realtek edimax 52fc10d19 In-Band Ioctl Response Length Confusion Causes Heap Buffer Overflow

Posted by Ron E on Aug 26 The Realtek in-band ioctl bridge contains a heap-buffer overflow when processing peer-supplied ioctl res…

VULNFull Disclosure14 days ago

WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize

Posted by Ron E on Aug 26 WatsonWebserver contains an HTTP/1 request body size-limit bypass when processing requests using Transfe…

VULNFull Disclosure14 days ago

Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags

Posted by Ron E on Aug 26 Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection…

VULNFull Disclosure14 days ago

Chronicle Wire v2026.8 Insecure Reflection Allows Unvalidated Method Invocation

Posted by Ron E on Aug 26 Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events…

VULNFull Disclosure14 days ago

Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection

Posted by Ron E on Aug 26 Chronicle Wire's FileMarshallableOut follows symbolic links when writing files in append mode. When ?app…

VULNhighFull Disclosure14 days ago

Multiple Vulnerabilities in TBEA TLogger Communication Box 3rd Generation

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Aug 26 ----------------------------------------------------------------…

VULNcriticalFull Disclosure14 days ago

[0day-rubbish] VitalPBX 4.5.2 (Asterisk 20.20.1) Authenticated root RCE via asterisk_cli to dialplan System() (8.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in VitalPBX 4.…

VULNcriticalFull Disclosure14 days ago

[0day-rubbish] Seeq Server R65.2.3 (default deployment with Data Lab installed via the official CLI) Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (9.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Seeq Server…

VULNcriticalFull Disclosure14 days ago

[0day-rubbish] Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX gateway) Authenticated config injection to root RCE (8.8)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Raritan EMX…

VULNcriticalFull Disclosure14 days ago

[0day-rubbish] mySCADA PRO Runtime 9.4.0 (container deployment msxrun; earlier versions with the same upgrade branch are likely affected) Unauthenticated OS command injection to root RCE (9.4)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in mySCADA PRO…

VULNcriticalFull Disclosure14 days ago

[0day-rubbish] Maian Gallery v2.1 Authenticated unrestricted file upload to PHP RCE (7.2)

Posted by disclosure via Fulldisclosure on Aug 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Galle…