Topic
84 articles
Threat IntelIvanti discloses critical vulnerability CVE-2026-104935 in Connect Secure and Policy Secure gateways allowing pre-auth SAML remote code execution.
Threat IntelApache Struts resolves critical vulnerability S2-032 (CVE-2016-3081) where dynamic method invocation enables arbitrary remote command execution via OGNL payloads.
MicrosoftA critical remote code execution flaw in Microsoft Semantic Kernel allows threat actors to compromise host systems via crafted agent plugin manifests.
Threat IntelA high-severity vulnerability in Ollama allows unauthenticated network actors to trigger remote code execution when pulling tampered GGUF model manifests.
Threat IntelA critical vulnerability in the Langflow AI visual agent framework allows remote unauthenticated attackers to escape execution sandboxes and execute arbitrary Python code.
GoogleGoogle released Chrome 154.0.8037.97 resolving a critical out-of-bounds write flaw in WebGL (CVE-2026-103628) that exposes memory to arbitrary code execution.
Threat IntelKiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
Threat IntelA critical heap buffer overflow in Apache Thrift C++ THeaderTransport allows remote adversaries to corrupt memory during ZLIB frame decompression.
Threat IntelA critical stack-based buffer overflow in Fortra Core Privileged Access Manager BoKS autoregistration daemon allows unauthenticated remote code execution.
Threat IntelA critical use-after-free in Apache HTTP Server mod_http2 via shared session bucket brigades enables remote unauthenticated memory corruption.
OT / SCADAA pre-authentication integer underflow in MikroTik RouterOS WebFig allows unauthenticated network attackers to achieve remote code execution as root.
Agentic AIA critical flaw in Mooncake distributed KVCache transfer engine allows unauthenticated TCP attackers to read and write arbitrary process memory, exposing LLM prompt caches.
Threat IntelA critical vulnerability in the SConnect browser digital signature native host component allows malicious websites to achieve unauthenticated remote code execution.
FortinetA critical zero-day flaw in Fortinet FortiMail secure email gateways allows unauthenticated remote attackers to write arbitrary files and execute code as root.
LinuxA critical vulnerability in Foreman allows authenticated users to escape the safemode Ruby templating sandbox via delegated method manipulation, executing commands as root.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.
Threat IntelA critical security flaw in yii2-starter-kit exposes the Gii code generator and debug modules to all remote IP addresses by default, allowing unauthenticated RCE.
DevSecOpsA critical command injection flaw in GitLab AI Gateway allows remote attackers to break LLM agent sandboxes and execute code across enterprise cloud runners.
Threat IntelA critical stack-based buffer overflow in Tenda GPON optical terminals allows unauthenticated remote attackers on the WAN interface to achieve root command execution.
Threat IntelA critical format string vulnerability in ASUS gateway router web modules allows authenticated attackers to execute arbitrary code with root privileges.
Threat IntelAn authentication bypass in Zammad helpdesk versions 6.3.0–6.5.4 allows remote attackers to hijack administrative sessions and achieve remote code execution.
Threat IntelAn unauthenticated RPyC service in LightLLM visual_only deployments enables remote attackers to execute arbitrary code on GPU clusters via pickle deserialization.
Threat IntelA critical template injection flaw in Next.js next/og (CVE-2026-94545) allows unauthenticated remote attackers to execute arbitrary code via Satori SVG parsing.