0dayNews — Vulnerability & Exploit News
Latest intelligence
all articles →
Known Exploited Vulnerabilities
Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Palo Alto Networks PAN-OS Code Injection Vulnerability
PAN-OS code injection flaw lets authenticated network attackers run code as root. Actively exploited; CISA KEV deadline October 17.
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Ivanti Connect Secure Authentication Bypass by Spoofing
Authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. Unauthenticated remote attackers can execute arbitrary commands. Added to CISA KEV October 13, 2026.
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Latest security news
Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday
Fortinet, Citrix, and Ivanti each released October patches today, closing 29 vulnerabilities including critical-severity flaws in edge network products.
AI Finds Linux vhost Flaw Giving Root, VM Escape
A Linux vhost subsystem flaw lets local users reach root via kernel memory access and can break guest VM isolation. The vulnerability spans nearly a decade of kernel versions.
Critical Ghostscript Flaw Lets PDFs Execute Code
A heap buffer overflow in Ghostscript (CVE-2026-39919, CVSS 9.8) allows remote code execution through a crafted PDF, exposing server-side document processors.
Docker Hub Fixes Critical Image Impersonation Flaw
Docker has patched CVE-2026-105445, a CVSS 9.8 flaw that let any valid PAT holder push, pull, or delete images in another user's Docker Hub repositories.
Microsoft October Patch Tuesday Fixes 1,411 Flaws
Microsoft's October 2026 Patch Tuesday patches a record 1,411 CVEs, including one zero-day confirmed exploited in the wild and two publicly disclosed vulnerabilities.
Ivanti Connect Secure Zero-Day Exploited, Fix By Oct 16
Ivanti has patched CVE-2026-104935, an authentication bypass in Connect Secure actively exploited in a three-zero-day chain. CISA deadline: October 16.