Skip to content
feed: live
0dayNews

0dayNews — Vulnerability & Exploit News

█root@0daynews:~$ tail -f /var/log/kev-catalog
~/articles/2026-10-13-unisoc-modem-cve-2026-66086-baseband-rce
● Breaking
mobile

UNISOC Modem Bug Enables Over-the-Air RCE, CVSS 9.8

CVE-2026-66086: Stack overflow in UNISOC modem OTA stack triggered by malformed LTE SIB1 messages. Remote code execution possible with no user interaction.

read →

Latest intelligence

GitLab CVSS 10.0 Flaw Enables Unauthenticated RCE→

Preinstalled Malware Found in Low-Cost Android Phones→

CyberXero Used Claude Code, Stole 628K Ukrainian Records→

● Breaking

Ransomware Consultant Arrested in FBI Hack Probe→

Bricksforge Plugin Flaw Gets Exploited Days After Patch→

Everest Backup Plugin Has CVSS 8.1 RCE Bug→

all articles →
$ kev-tracker --recent

Known Exploited Vulnerabilities

full tracker →
CVE-2026-104935
[ HIGH ]CVSS 8.6kev

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

Ivanti / Connect Secure
CVE-2026-96951
[ HIGH ]CVSS 8.8kev

Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

Microsoft / Windows
CVE-2015-3306
[ CRITICAL ]CVSS 10.0EPSS 99.5%kev

ProFTPD Improper Access Control Vulnerability

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

ProFTPD / ProFTPD
CVE-2015-5477
[ HIGH ]CVSS 7.8EPSS 99.4%kev

ISC BIND Data Processing Errors Vulnerability

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

ISC / BIND
CVE-2016-3081
[ HIGH ]CVSS 8.1EPSS 96.1%kev

Apache Struts Command Injection Vulnerability

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

Apache / Struts
CVE-2021-3199
[ CRITICAL ]CVSS 9.8EPSS 19.4%kev

ONLYOFFICE Docs Server Path Traversal Vulnerability

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

ONLYOFFICE / Docs
$ latest --more

Latest security news

all articles →
~/articles/2026-10-12-booster-woocommerce-php-object-injection-cve-2026-42718
wordpress

Booster for WooCommerce Has CVSS 9.8 Object Injection

Unauthenticated PHP Object Injection in Booster for WooCommerce plugin, versions up to 8.4.0, rates CVSS 9.8 critical. Update the plugin immediately.

read →
~/articles/2026-10-12-sitevault-wordpress-rce-cve-2026-42696
wordpress

SiteVault WordPress Plugin Has CVSS 10 RCE Bug

A CVSS 10.0 unauthenticated RCE in the SiteVault WordPress backup plugin hits versions 1.5.19 and earlier. No patch confirmed. Disable it now.

read →
~/articles/2026-10-11-industrial-insider-extortion-bitcoin-prison
ics ot

Industrial Engineer Jailed for 20-Bitcoin Extortion

Former core infrastructure engineer deleted admin accounts, reset hundreds of passwords at an industrial firm, demanded 20 bitcoin for recovery. Now in prison.

read →
~/articles/2026-10-11-openapi-typescript-codegen-cve-2026-108551-code-injection
supply chain

CVSS 9.8 Code Injection in openapi-typescript-codegen

openapi-typescript-codegen through 0.31.0 lets attackers who control an OpenAPI spec inject JavaScript into generated clients. CVSS 9.8 critical.

read →
~/articles/2026-10-11-fusionpbx-caller-id-os-command-injection
threat intel

FusionPBX Caller ID Bug Lets Attackers Run OS Commands

CVE-2026-108161, CVSS 7.5: unauthenticated OS command injection in FusionPBX 5.6.5 and earlier via crafted caller IDs. Update or restrict exposure.

read →
~/articles/2026-10-11-contao-cms-four-cve-critical-xss-patch
threat intel

Contao Patches Critical XSS in Four-CVE Update

Contao 5.3.50 and 5.7.12 fix a critical stored XSS in the comment module that executes in admin sessions, plus three medium-severity issues. Update now.

read →
$ briefings --latest

This week's SITREP

~/briefings/2026-10-01 to 2026-10-04
October 12, 2026

Week in Review: Oct 1-4, 2026

Fortinet FortiMail KEV, Pentagon breach 3M records, Operation KillSwitch takes KillSec offline. Zimbra zero-day, Warlock APT, and GitLab AI Gateway RCE.