Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

363 articles

VULNCheck Point Researchabout 1 month ago

VECT: Ransomware by design, Wiper by accident

Key Takeaways Background VECT Ransomware is a Ransomware-as-a-Service (RaaS) program that made its first appearance in December 20…

VULNcriticalZero Day Initiativeabout 1 month ago

ZDI-26-305: (0Day) OpenAI Codex Sandbox Escape Vulnerability

This vulnerability allows remote attackers to bypass the sandbox on affected installations of OpenAI Codex. User interaction is re…

VULNhighZero Day Initiativeabout 1 month ago

ZDI-26-306: Oracle VirtualBox SoundBlaster 16 Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must…

VULNCheck Point Researchabout 1 month ago

27th April – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 27th April, please download our Threat Intelligence Bulletin. TOP ATT…

VULNhighZero Day Initiativeabout 1 month ago

ZDI-26-301: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interacti…

VULNhighZero Day Initiativeabout 1 month ago

ZDI-26-302: Foxit PDF Reader AcroForm Signature Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interacti…

VULNhighZero Day Initiativeabout 1 month ago

ZDI-26-303: Foxit PDF Reader AcroForm Signature Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User i…

VULNhighZero Day Initiativeabout 1 month ago

ZDI-26-300: Flowise AccountService resetPassword Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Flowise. Authentication is not re…

VULNhighZero Day Initiativeabout 1 month ago

ZDI-26-304: Foxit PDF Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interacti…

VULNhighMandiantabout 2 months ago

Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-299: Docker Desktop Enhanced Container Isolation Exposed Dangerous Function Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must fir…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-296: Delta Electronics ASDA-Soft PAR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics ASDA-Soft. Use…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-297: Siemens SINEC NMS Improper Authentication Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Siemens SINEC NMS. Authentication i…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-298: Siemens SINEC NMS Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Siemens SINEC NMS. Authentication…

VULNcriticalZero Day Initiativeabout 2 months ago

ZDI-26-293: (0Day) Microsoft Office URI Handler NTLM Response Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose NTLM responses on affected installations of Microsoft Office. User interact…

VULNcriticalZero Day Initiativeabout 2 months ago

ZDI-26-245: (0Day) aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication i…

VULNcriticalZero Day Initiativeabout 2 months ago

ZDI-26-294: (0Day) Microsoft Windows library-ms NTLM Response Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Microsoft Wind…

VULNcriticalZero Day Initiativeabout 2 months ago

ZDI-26-295: (0Day) PublicCMS getXml Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PublicCMS. Authenticatio…

VULNCheck Point Researchabout 2 months ago

20th April – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 20th April, please download our Threat Intelligence Bulletin. TOP ATT…

VULNCheck Point Researchabout 2 months ago

DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

Key Points The Gentlemen RaaS The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around…

VULNhighMandiantabout 2 months ago

Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever

Introduction Advances in AI model-powered exploitation have demonstrated that general-purpose AI models can excel at vulnerabilit…

VULNMandiantabout 2 months ago

The German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape

Written by: Jamie Collier, Robin Grunewald Germany has reclaimed its position as a primary focus for cyber extortion in Europe.…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-263: Adobe ColdFusion subscribeToEndpoints Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Adobe ColdFusion. Authentication…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-267: Malwarebytes Anti-Malware Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Anti-Malware. An attack…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-269: TrendAI Apex One Console Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentica…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-268: Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Samsung MagicINFO 9 Server. An attac…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-270: TrendAI Apex One Console Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentica…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-272: ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authe…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-274: Microsoft Qlib fit Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction…

VULNhighZero Day Initiativeabout 2 months ago

ZDI-26-273: Microsoft Olive Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Olive. User interactio…