Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,024 articles

VULNhighCVE-2026-131297.8 HIGHZero Day Initiative16 days ago

ZDI-26-601: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User i…

VULNhighCVE-2026-572377.8 HIGHZero Day Initiative16 days ago

ZDI-26-600: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User i…

VULNhighCVE-2026-572387.8 HIGHZero Day Initiative16 days ago

ZDI-26-599: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User i…

VULNhighCVE-2026-242517.8 HIGHZero Day Initiative16 days ago

ZDI-26-594: NVIDIA Megatron Bridge load_model_config Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User int…

VULNhighCVE-2026-242687.8 HIGHZero Day Initiative16 days ago

ZDI-26-593: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interactio…

VULNhighCVE-2026-242387.8 HIGHZero Day Initiative16 days ago

ZDI-26-592: NVIDIA TensorRT ONNX File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interactio…

VULNhighCVE-2026-242727.8 HIGHZero Day Initiative16 days ago

ZDI-26-591: NVIDIA TensorRT ONNX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA TensorRT. User interactio…

VULNhighCVE-2026-19773Zero Day Initiative16 days ago

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is…

VULNhighCVE-2026-19774Zero Day Initiative16 days ago

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker mus…

VULNhighCVE-2026-19504Zero Day Initiative16 days ago

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction w…

VULNhighCVE-2026-19781Zero Day Initiative16 days ago

ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User inter…

VULNhighCVE-2026-19886Zero Day Initiative16 days ago

ZDI-26-586: OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User in…

VULNhighCVE-2026-19885Zero Day Initiative16 days ago

ZDI-26-585: OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User in…

VULNPalo Alto Unit 4218 days ago

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and stric…

VULNCheck Point Research20 days ago

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-contro…

VULNPalo Alto Unit 4220 days ago

Identity Abuse Through Trusted Communication Channels

Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defe…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] VMS 6.48.809 Authenticated command injection to root RCE (8.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in VMS 6.48.80…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] ONE Reporter 13.1 Authenticated RCE / privilege escalation via CommandExecutor (8.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in ONE Reporte…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] Gemini 7.3.0 Authenticated SQL injection to xp_cmdshell RCE (8.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in Gemini 7.3.…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] RoboTask 11.0.5.1229 Unauthenticated REST API remote task execution (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in RoboTask 11…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] ActiveFax Server 10.70 Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in ActiveFax S…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] Tornado 2.11.3 Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in Tornado 2.1…

VULNcriticalFull Disclosure20 days ago

[0day-rubbish] Datalore On-Premises 2026.2.3 Unauthenticated RCE via InteractiveReport access-mapping flaw (9.8)

Posted by disclosure via Fulldisclosure on Aug 19 0day Rubbish Research Team is publicly disclosing a vulnerability in Datalore On…

VULNFull Disclosure20 days ago

APPLE-SA-08-18-2026-1 Safari 26.6.1

Posted by Apple Product Security via Fulldisclosure on Aug 19 APPLE-SA-08-18-2026-1 Safari 26.6.1 https://support.apple.com/148286…

VULNCVE-2026-719609.1 CRITICALFull Disclosure20 days ago

Cudy WR3000: Hard-coded JWT Secret to Root Command Injection

Posted by Nir Yehoshua on Aug 19 Hello Full Disclosure list, Cipher Security Labs has published details for two vulnerabilities a…

VULNMicrosoft Security21 days ago

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Microsoft is named a visionary leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, recognized for unified runt…

VULNRecorded Future21 days ago

Recorded Future Launches 6 New Capabilities for Third-Party Risk

Recorded Future has launched native risk ratings capabilities inside its Third-Party Risk product, uniting threat intelligence and…

VULNMicrosoft Security22 days ago

Hunting MacSync Stealer infrastructure through behavioral pivots

MacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+…

VULNhighCheck Point Research22 days ago

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Research by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopAndProtect…

VULNFull Disclosure22 days ago

Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)

Posted by disclosure via Fulldisclosure on Aug 17 0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry…