0dayNews — Vulnerability & Exploit News
Latest intelligence
all articles →
Known Exploited Vulnerabilities
Palo Alto Networks PAN-OS Code Injection Vulnerability
PAN-OS code injection flaw lets authenticated network attackers run code as root. Actively exploited; CISA KEV deadline October 17.
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Ivanti Connect Secure Authentication Bypass by Spoofing
Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. Unauthenticated remote attackers can execute arbitrary commands. Added to CISA KEV October 13, 2026.
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Latest security news
Critical Ghostscript Flaw Lets PDFs Execute Code
A heap buffer overflow in Ghostscript (CVE-2026-39919, CVSS 9.8) allows remote code execution through a crafted PDF, exposing server-side document processors.
Docker Hub Fixes Critical Image Impersonation Flaw
Docker has patched CVE-2026-105445, a CVSS 9.8 flaw that let any valid PAT holder push, pull, or delete images in another user's Docker Hub repositories.
Microsoft October Patch Tuesday Fixes 1,411 Flaws
Microsoft's October 2026 Patch Tuesday patches a record 1,411 CVEs, including one zero-day confirmed exploited in the wild and two publicly disclosed vulnerabilities.
Ivanti Connect Secure Zero-Day Exploited, Fix By Oct 16
Ivanti has patched CVE-2026-104935, an authentication bypass in Connect Secure actively exploited in a three-zero-day chain. CISA deadline: October 16.
GitLab CVSS 10.0 Flaw Enables Unauthenticated RCE
An integer overflow in GitLab's CI/CD config regex lets unauthenticated attackers run arbitrary code. Patches are available for all supported release lines.
Preinstalled Malware Found in Low-Cost Android Phones
Budget Android phones shipping with firmware-level malware turn devices into residential proxies and covertly install apps. Here is what to check.