0dayNews — Vulnerability & Exploit News
Latest intelligence
all articles →
Known Exploited Vulnerabilities
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Ivanti Connect Secure Authentication Bypass by Spoofing
Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. Unauthenticated remote attackers can execute arbitrary commands. Added to CISA KEV October 13, 2026.
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Latest security news
Preinstalled Malware Found in Low-Cost Android Phones
Budget Android phones shipping with firmware-level malware turn devices into residential proxies and covertly install apps. Here is what to check.
UNISOC Modem Bug Enables Over-the-Air RCE, CVSS 9.8
CVE-2026-66086: Stack overflow in UNISOC modem OTA stack triggered by malformed LTE SIB1 messages. Remote code execution possible with no user interaction.
CyberXero Used Claude Code, Stole 628K Ukrainian Records
Threat group CyberXero used Claude Code in a two-pronged attack on WordPress and critical infrastructure, exposing 628,000 Ukrainian records.
Ransomware Consultant Arrested in FBI Hack Probe
U.S. authorities arrested a cybersecurity executive linked to ransomware response work in connection with the ShinyHunters FBI breach investigation. Identity unconfirmed.
Bricksforge Plugin Flaw Gets Exploited Days After Patch
Attackers exploited CVE-2026-85097, a CVSS 9.8 unauthenticated file-upload RCE in Bricksforge, within days of public disclosure. Update to version 4.0.1.
Everest Backup Plugin Has CVSS 8.1 RCE Bug
An unauthenticated RCE flaw in Everest Backup versions up to 2.3.13 lets attackers execute code on WordPress sites without credentials. Patch now.