0dayNews — Vulnerability & Exploit News
Latest intelligence
all articles →
Known Exploited Vulnerabilities
ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Citrix NetScaler Memory Buffer Flaw Enables Denial-of-Service Attacks
NetScaler ADC and Gateway contain an exploited memory-buffer flaw enabling denial of service. CISA KEV listed October 4, federal deadline October 7.
Latest security news
FusionPBX Caller ID Bug Lets Attackers Run OS Commands
CVE-2026-108161, CVSS 7.5: unauthenticated OS command injection in FusionPBX 5.6.5 and earlier via crafted caller IDs. Update or restrict exposure.
Contao Patches Critical XSS in Four-CVE Update
Contao 5.3.50 and 5.7.12 fix a critical stored XSS in the comment module that executes in admin sessions, plus three medium-severity issues. Update now.
Three Critical WooCommerce Plugins Need Patching
An RCE, an auth bypass, and an arbitrary file deletion in three WooCommerce plugins this week. All rated CVSS 9.1 or higher. Patch all three now.
FBI Arrests ShinyHunters Suspect in FBI Breach Case
FBI Director Kash Patel announced Oct. 9 the arrest of a ShinyHunters co-conspirator tied to the September breach of FBI systems.
Germany Arrests Core Qilin Member After Japan Extradition
German authorities arrested a Russian national suspected of being a core Qilin ransomware member after extradition from Japan, confirmed by Japan's National Police Agency.
AhsayCBS Backup Platform Exploited, No Patch Ready
Two AhsayCBS flaws, including a CVSS 10.0 auth bypass, are chained to drop webshells and XMRig miners on MSP networks. No patch is available.