Skip to content
feed: live
>_0dayNews

0dayNews — Vulnerability & Exploit News

$ kev-tracker --recent

Known Exploited Vulnerabilities

full tracker →
CVE-2026-20349
[ HIGH ]CVSS 8.6EPSS 0.9%kev

Cisco ASA and FTD VPN Heap Inspection Denial-of-Service Flaw

Unauthenticated remote attackers can crash Cisco Secure Firewall ASA and FTD devices over VPN. Added to CISA KEV on 2026-08-11 with a three-day federal remediation deadline.

Cisco / Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
CVE-2026-68820
[ HIGH ]CVSS 7.0EPSS 0.3%kev

Windows AFD WinSock Use-After-Free Privilege Escalation

Use-after-free in Windows Ancillary Function Driver for WinSock (afd.sys) lets local attackers gain SYSTEM privileges via race condition. Actively exploited by Lazarus.

Microsoft / Windows (multiple versions)
CVE-2026-72898
[ CRITICAL ]CVSS 10.0EPSS 10.4%kev

Metabase SQL Injection Vulnerability

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Metabase / Metabase
CVE-2026-18556
[ HIGH ]CVSS 7.4EPSS 0.5%kev

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

N-able / N-central
CVE-2026-34486
[ HIGH ]CVSS 7.5EPSS 82.9%kev

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.

Apache / Tomcat
CVE-2026-9198
[ CRITICAL ]CVSS 9.8EPSS 17.4%kev

IBM Langflow Code Injection Vulnerability

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

IBM / Langflow
$ latest --more

From the desk

all articles →
~/articles/2026-08-16-evooo1bot-botnet-routers-socks5-relay
Evooo1Bot Botnet Hijacks Routers as SOCKS5 Proxies
● Breaking
threat intel

Evooo1Bot Botnet Hijacks Routers as SOCKS5 Proxies

Fortinet researchers track Evooo1Bot, a Mirai-based modular Linux botnet hijacking routers as SOCKS5 relays with DDoS and credential-sniffing capability.

read →
~/articles/2026-08-16-linux-kernel-can-subsystem-race-condition-patch-wave
Linux CAN Subsystem Gets 14-CVE Race Condition Fix Wave
linux kernel

Linux CAN Subsystem Gets 14-CVE Race Condition Fix Wave

The August 15 Linux stable drop patches 14 CVEs in the CAN broadcast manager and ISO 15765-2 transport: data races and use-after-frees.

read →
~/articles/2026-08-16-linux-dm-luks-key-wipe-cve-2026-72103
Linux dm Bug Silently Breaks LUKS Key Wipe
linux kernel

Linux dm Bug Silently Breaks LUKS Key Wipe

Kernel refactoring regression in Linux device-mapper causes cryptsetup luksSuspend to silently fail to wipe the LUKS volume key. Patch is in stable.

read →
~/articles/2026-08-16-ksmbd-stack-overflow-cve-2026-72044
Linux ksmbd SMB Server: Stack Overflow Fix in Stable
Analysis
linux kernel

Linux ksmbd SMB Server: Stack Overflow Fix in Stable

CVE-2026-72044 patches a ksmbd stack overflow in multichannel session binding. Patched in stable; no CVSS assigned yet, no exploitation confirmed.

read →
~/articles/2026-08-15-maxupload-cve-2026-15965-file-upload
MaxUpload for WordPress: Unauthenticated File Upload
wordpress

MaxUpload for WordPress: Unauthenticated File Upload

CVE-2026-15965: MaxUpload (≤1.4.0) lets unauthenticated attackers upload arbitrary files via a filename validation mismatch between chunk and final assembly. CVSS 8.8, no patch confirmed.

read →
~/articles/2026-08-15-metasploit-summer-thirteen-new-modules
Thirteen New Metasploit Modules, One Old Pattern
Analysis
threat intel

Thirteen New Metasploit Modules, One Old Pattern

Rapid7's latest wrap-up adds thirteen exploit modules spanning Ghost CMS, SonicWall SMA1000, Langflow, Ray, and more. The targets rotate. The underlying pattern doesn't.

read →