Vulnerability & Exploit Coverage
820 articles · sorted newest first
News results
PwnEscape: Linux Kernel Flaw Lets VMs Read Host Memory
A critical Linux kernel vulnerability named PwnEscape allows guest virtual machines to read host system memory, demonstrated live against Vercel's cloud infrastructure.
Next.js Out-of-Band Update Fixes Two Critical RCEs
Vercel patched two critical unauthenticated RCE flaws in Next.js on October 14: one in the caching layer, one in SVG processing, plus a high-severity DoS bug.
Langflow RCE Draws 1,423 Attacks: Patch to 1.9.0
CVE-2026-105740, CVSS 9.9, lets authenticated Langflow users execute server commands. Patch to 1.9.0 now; 1,423 exploit attempts logged since September 19.
CVE-2026-110447: Collabora CODE Server Exploited
CVE-2026-110447 is a CVSS 9.8 command injection in Collabora CODE Server before 26.4.303, actively exploited on Nextcloud hosts since September 2026.
CISA: 105 Attacks Confirm Ivanti Patch Is Urgent
CISA cites 105 honeypot-logged exploit attempts and urges immediate patching of CVE-2026-104935 in Ivanti Connect Secure. Oct 16 deadline is 24 hours out.
Palo Alto PAN-OS Zero-Day Added to KEV, Fix by Oct 17
CVE-2026-0322, a PAN-OS code injection flaw, is confirmed exploited in attacks. CISA added it to KEV with an October 17 remediation deadline.
Cisco Patches Exploited Email Gateway File Write Bug
Cisco patches a second critical SEG zero-day in two months: unauthenticated attackers can write files to the OS. Exploitation is active. Patch immediately.
Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday
Fortinet, Citrix, and Ivanti each released October patches today, closing 29 vulnerabilities including critical-severity flaws in edge network products.
AI Finds Linux vhost Flaw Giving Root, VM Escape
A Linux vhost subsystem flaw lets local users reach root via kernel memory access and can break guest VM isolation. The vulnerability spans nearly a decade of kernel versions.
Critical Ghostscript Flaw Lets PDFs Execute Code
A heap buffer overflow in Ghostscript (CVE-2026-39919, CVSS 9.8) allows remote code execution through a crafted PDF, exposing server-side document processors.
Docker Hub Fixes Critical Image Impersonation Flaw
Docker has patched CVE-2026-105445, a CVSS 9.8 flaw that let any valid PAT holder push, pull, or delete images in another user's Docker Hub repositories.
Microsoft October Patch Tuesday Fixes 1,411 Flaws
Microsoft's October 2026 Patch Tuesday patches a record 1,411 CVEs, including one zero-day confirmed exploited in the wild and two publicly disclosed vulnerabilities.
Ivanti Connect Secure Zero-Day Exploited, Fix By Oct 16
Ivanti has patched CVE-2026-104935, an authentication bypass in Connect Secure actively exploited in a three-zero-day chain. CISA deadline: October 16.
GitLab CVSS 10.0 Flaw Enables Unauthenticated RCE
An integer overflow in GitLab's CI/CD config regex lets unauthenticated attackers run arbitrary code. Patches are available for all supported release lines.
Preinstalled Malware Found in Low-Cost Android Phones
Budget Android phones shipping with firmware-level malware turn devices into residential proxies and covertly install apps. Here is what to check.
UNISOC Modem Bug Enables Over-the-Air RCE, CVSS 9.8
CVE-2026-66086: Stack overflow in UNISOC modem OTA stack triggered by malformed LTE SIB1 messages. Remote code execution possible with no user interaction.
CyberXero Used Claude Code, Stole 628K Ukrainian Records
Threat group CyberXero used Claude Code in a two-pronged attack on WordPress and critical infrastructure, exposing 628,000 Ukrainian records.
Ransomware Consultant Arrested in FBI Hack Probe
U.S. authorities arrested a cybersecurity executive linked to ransomware response work in connection with the ShinyHunters FBI breach investigation. Identity unconfirmed.
Bricksforge Plugin Flaw Gets Exploited Days After Patch
Attackers exploited CVE-2026-85097, a CVSS 9.8 unauthenticated file-upload RCE in Bricksforge, within days of public disclosure. Update to version 4.0.1.
Everest Backup RCE: No Patch for CVE-2026-39802
Everest Backup versions through 2.3.13 remain vulnerable to unauthenticated RCE. No fixed version is listed; temporarily deactivate the plugin if installed.
Booster for WooCommerce Has CVSS 9.8 Object Injection
Unauthenticated PHP Object Injection in Booster for WooCommerce plugin, versions up to 8.4.0, rates CVSS 9.8 critical. Update the plugin immediately.
SiteVault WordPress Plugin Has CVSS 10 RCE Bug
A CVSS 10.0 unauthenticated RCE in the SiteVault WordPress backup plugin hits versions 1.5.19 and earlier. No patch confirmed. Disable it now.
Industrial Engineer Jailed for 20-Bitcoin Extortion
Former core infrastructure engineer deleted admin accounts, reset hundreds of passwords at an industrial firm, demanded 20 bitcoin for recovery. Now in prison.
CVSS 9.8 Code Injection in openapi-typescript-codegen
openapi-typescript-codegen through 0.31.0 lets attackers who control an OpenAPI spec inject JavaScript into generated clients. CVSS 9.8 critical.
No articles match the current filters.