Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

666 articles

Inside the Modern SOC: The 72-Minute Race

Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-dri…

VULNMandiantabout 1 month ago

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of Chin…

VULNCheck Point Researchabout 1 month ago

15th June – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTA…

VULNPalo Alto Unit 42about 1 month ago

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn…

VULNhighCVE-2026-202539.8 CRITICALwatchTowr Labsabout 1 month ago

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)

Three posts in three days? Are we insane? We're home alone, there's no-one to stop us, and we're up past bed time. So, we need to…

VULNhighCVE-2026-507519.3 CRITICALwatchTowr Labsabout 1 month ago

Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the b…

VULNhighCVE-2026-352739.8 CRITICALMandiantabout 1 month ago

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

Introduction Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attr…

VULNhighCheck Point Researchabout 1 month ago

From SQLi to RCE – Exploiting LangGraph’s Checkpointer

By Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store…

VULNSentinelOne Labsabout 1 month ago

LABScon25 Replay | Keynote: Steps to an Ecology of Cyber

Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the cas…

VULNPalo Alto Unit 42about 1 month ago

Trust No Skill: Integrity Verification for AI Agent Supply Chains

Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage att…

VULNhighCVE-2026-89166.1 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-359: Samsung rlottie Numeric Truncation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction wit…

VULNhighCVE-2026-52849Zero Day Initiativeabout 2 months ago

ZDI-26-360: MATE Desktop Atril Document Viewer EPUB File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MATE Desktop Atril Document View…

VULNhighCVE-2026-114434.6 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-358: Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability

This vulnerability allows remote attackers to execute arbitrary script on affected installations of Allegra. User interaction is r…

VULNhighCVE-2026-114426.5 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-357: Allegra exportReport Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication…

VULNhighCVE-2026-340325.3 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-356: Apache HTTP Server mod_proxy_ajp Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apache HTTP Server. An a…

VULNRecorded Futureabout 2 months ago

Recorded Future Launches Impact and Metrics Dashboard

See the business value of your intelligence program in one live, continuously updated dashboard, built for the conversations that…

VULNRecorded Futureabout 2 months ago

Cyber-Enabled Maritime Sanctions Evasion

Discover how Iranian and Russian shadow fleets use a vast network of fake maritime websites and fraudulent documents to evade inte…

VULNhighCVE-2026-272207.8 HIGHZero Day Initiativeabout 2 months ago

ZDI-26-355: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User in…

VULNhighCVE-2026-1052010.0 CRITICALwatchTowr Labsabout 2 months ago

More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)

Today, Ivanti published an advisory. “No way?” we hear you say. "Yes way!" a random dog screams back at you, across the street. To…

VULNRecorded Futureabout 2 months ago

2026 FIFA World Cup: What Public Safety Officials Need to Know

Prepare for the 2026 FIFA World Cup with expert analysis of the physical and cyber threat landscape. Discover key mitigation strat…

VULNRecorded Futureabout 2 months ago

China's Noncombatant Evacuation Operations: 2005–2025

Explore the Insikt Group study on 37 Chinese noncombatant evacuation operations (NEOs) from 2005–2025, revealing how China leverag…

VULNPalo Alto Unit 42about 2 months ago

Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility

Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defe…

VULNhighCVE-2026-02579.1 CRITICALPalo Alto Unit 42about 2 months ago

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257

We include indicators of activity and mitigations for PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitati…

VULNCVE-2026-251127.8 HIGHFull Disclosureabout 2 months ago

SEC Consult SA-20260608-0 :: Privilege Escalation via Binary Planting in Genetec-provided RabbitMQ in multiple Genetec products

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 08 SEC Consult Vulnerability Lab Security Advisory ============…

VULNFull Disclosureabout 2 months ago

[SYSS-2026-004] SAP NetWeaver SAML XML Signature Wrapping

Posted by Moritz Bechler via Fulldisclosure on Jun 08 Advisory ID: SYSS-2026-004 Product: SAP NetW…

VULNhighCVE-2026-479127.8 HIGHZero Day Initiativeabout 2 months ago

ZDI-26-345: Adobe Acrobat Reader DC Font Handling Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User in…

VULNhighCVE-2026-479235.5 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-344: Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Acrobat Reader DC.…

VULNhighCVE-2026-80379.6 CRITICALZero Day Initiativeabout 2 months ago

ZDI-26-342: Progress Software Kemp LoadMaster apiuser Uninitialized Memory Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaste…

VULNhighCVE-2026-80379.6 CRITICALZero Day Initiativeabout 2 months ago

ZDI-26-340: Progress Software Kemp LoadMaster dodelapikey Uninitialized Memory Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaste…

VULNhighCVE-2026-340026.1 MEDIUMZero Day Initiativeabout 2 months ago

ZDI-26-336: X.Org Server CheckKeyActions Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker…