Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

1,213 articles

VULNhighCVE-2026-917927.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-724: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interacti…

VULNhighCVE-2026-917907.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-723: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User i…

VULNhighCVE-2026-917917.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-722: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interacti…

VULNhighRecorded Futureabout 1 month ago

The Lure Isn't The Malware. It's Your Logo.

Recorded Future's Insikt GroupⓇ has been tracking ClickFix, a social engineering technique that turns a familiar logo or verificat…

VULNFull Disclosureabout 1 month ago

Code Security Review tool

Posted by E. Kellinis on Sep 22 Karma Pro is an open source code review tool that can assist code reviewers with a multitude of us…

VULNhighCVE-2026-89082Full Disclosureabout 1 month ago

HP Advance / Output Central: unauthenticated SYSTEM RCE and two additional vulnerabilities (CVE-2026-89082/89083/89084)

Posted by Joe via Fulldisclosure on Sep 22 HP Advance / HP Output Central Unauthenticated SYSTEM RCE, authorization bypass, and ar…

VULNFull Disclosureabout 1 month ago

CFP No cON Name 2k26 - Palma, Mallorca - Spain

Posted by Jose Nicolas Castellano on Sep 22 No cON Name 2026 - Palma, Mallorca - Balearic Islands https://www.noconname.org/call-f…

VULNhighCVE-2026-176137.5 HIGHFull Disclosureabout 1 month ago

CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)

Posted by Louis Sanchez via Fulldisclosure on Sep 22 Posting this as an update rather than a first disclosure. The advisory went p…

VULNhighCVE-2026-4475610.0 CRITICALFull Disclosureabout 1 month ago

CVE-2026-44756: Pre-Auth RCE in SAP EPP Processing (ICM, Web Dispatcher, disp+work)

Posted by Raschin Tavakoli via Fulldisclosure on Sep 22 nullFaktor Security Advisory ============================================…

VULNcriticalFull Disclosureabout 1 month ago

[0day-rubbish] TigerGraph Community Edition 4.2.4 Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (9.8)

Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in TigerGraph…

VULNcriticalFull Disclosureabout 1 month ago

[0day-rubbish] Teltonika RutOS 00.07.06.21 Authenticated ipsec.lua logread command injection with reflected output (8.8)

Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in Teltonika R…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-10 Xcode 27

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-10 Xcode 27 https://support.apple.com/149040. ht…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-9 Safari 27

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-9 Safari 27 https://support.apple.com/149039. ht…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-8 visionOS 27

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-8 visionOS 27 https://support.apple.com/149038.…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-7 watchOS 27

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-7 watchOS 27 https://support.apple.com/149037. h…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-6 tvOS 27

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-6 tvOS 27 https://support.apple.com/149036. http…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-5 macOS Sequoia 15.8

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-5 macOS Sequoia 15.8 https://support.apple.com/1…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-4 macOS Tahoe 26.7

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-4 macOS Tahoe 26.7 https://support.apple.com/149…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-3 macOS Golden Gate 27

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-3 macOS Golden Gate 27 https://support.apple.com…

VULNFull Disclosureabout 1 month ago

APPLE-SA-09-14-2026-2 iOS 26.7 and iPadOS 26.7

Posted by Apple Product Security via Fulldisclosure on Sep 22 APPLE-SA-09-14-2026-2 iOS 26.7 and iPadOS 26.7 https://support.apple…

VULNhighMicrosoft Securityabout 1 month ago

Unmasking EvilTokens: Getting to the root of device code phishing

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, aut…

VULNhighCVE-2026-203504.7 MEDIUMZero Day Initiativeabout 1 month ago

ZDI-26-719: Cisco ThousandEyes Virtual Appliance DHCP Client Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco ThousandEyes Virtual Appli…

VULNRecorded Futureabout 1 month ago

Agent Running in the Age of AI

In the age of AI, the new customer of intelligence is an agent. Every agent needs an intelligence layer it can trust to make good…

VULNCheck Point Researchabout 1 month ago

21st September – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 21st Setpember, please download our Threat Intelligence Bulletin. TOP…

VULNPalo Alto Unit 42about 1 month ago

From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies

We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail mon…

VULNhighCVE-2026-668047.8 HIGHGoogle Project Zeroabout 1 month ago

Windows Exploitation Techniques: Dangling COM Object Registrations

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I…

VULNhighSentinelOne Labsabout 1 month ago

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Ter…

VULNPalo Alto Unit 42about 1 month ago

A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to…

VULNhighCVE-2026-202354.9 MEDIUMZero Day Initiativeabout 1 month ago

ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services…

VULNhighCVE-2026-202119.1 CRITICALZero Day Initiativeabout 1 month ago

ZDI-26-717: Cisco Identity Services Engine AlarmMessageDiskQueue Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine.…