Search: “HG532”

ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.

Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoVulnerability 6 sourcesCVE-2026-71116

Home & Small Office Wireless Routers Exploited to Attack Gaming Servers

Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.

Unit 42 researchers identified an updated Gafgyt variant derived from the JenX botnet that combines three remote code execution exploits: CVE-2017-18368 (Zyxel P660HN-T1A), CVE-2017-17215 (Huawei HG532), and CVE-2014-8361 (Realtek RTL81XX chipset). Shodan scans show more than 32,000 wireless routers worldwide potentially vulnerable to these exploits. The exploits act as droppers, pulling architecture-specific binaries from a malicious server (185.172.110.224), and the botnet performs denial-of-service attacks against gaming servers, most notably Valve Source engine servers.

Palo Alto Unit 42·Aug 18, 04:46 UTC · 29d agoMalware in the wildCVE-2017-18368CVE-2017-17215CVE-2014-83611

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes·Aug 25, 16:11 UTC · 22d agoVulnerability

July 2026 CVE Landscape

Recorded Future·Aug 7, 00:00 UTC · Aug 7, 2026Ransomware in the wildCVE-2025-3248CVE-2008-4128CVE-2017-17215+78 CVEs1

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.

PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.

The Hacker News·Sep 4, 15:20 UTC · 12d agoVulnerabilityCVE-2026-64711

datasette 0.65.5new

Datasette 0.65.5 patches a permission bypass where a trailing newline in a table name could expose private rows (GHSA-h547-rmjf-5m2m).

Datasette 0.65.5 fixes a security issue tracked as GHSA-h547-rmjf-5m2m in which a trailing newline in a requested table name bypassed table permission checks and exposed private rows. The flaw was reported by dpfkdlemtp. The same fix is included in the 1.0a40 alpha release.

Simon Willison·Sep 16, 23:51 UTC · 46m agoVulnerability 5 sources

IBM security advisory (AV26-922)

Canadian Cyber Centre relays IBM advisory for Langflow, MQ, and Sterling File Gateway flaws including MQ remote code execution (CVE-2026-13293).

Canadian Cyber Centre advisory AV26-922 relays IBM fixes for Langflow OSS (versions through 1.11.5 across release lines), IBM MQ (10.0.0.0 and 9.x LTS/CD through 9.4.5.1), and Sterling File Gateway (through 6.2.2.1). CVE-2026-13293 is a remote code execution flaw in IBM MQ Java messaging caused by an incomplete security scanner blocklist enabling network-based code execution. CVE-2026-19290 is an improper access control vulnerability in IBM Sterling File Gateway. Administrators are urged to review and apply the necessary updates.

Canadian Centre for Cyber Security·Sep 15, 14:29 UTC · 1d agoAdvisoryCVE-2026-13293CVE-2026-19290

Re: Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

oss-security·Sep 5, 12:16 UTC · 11d agoVulnerabilityCVE-2026-86137CVE-2026-86138

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)

0day Rubbish Research Team disclosed a CVSS 7.2 local privilege escalation (CWE-250) in Royal Server 5.04.50529.0 to LocalSystem.

Researchers publicly disclosed a local privilege escalation vulnerability in Royal Server 5.04.50529.0, classified as CWE-250 (execution with unnecessary privileges) with a CVSS score of 7.2. The flaw allows escalation to LocalSystem on the execution path without credential override. The disclosure was posted to the Full Disclosure mailing list on September 8, 2026; no patch or CVE id was mentioned in the notice.

Full Disclosure·Sep 8, 17:31 UTC · 8d agoVulnerability

HTTP/2 Bomb CVE-2026-49975

Fortinet advisory details CVE-2026-49975, an Apache HTTP Server HTTP/2 flaw enabling denial of service, affecting versions 2.4.17 through 2.4.67.

Fortinet PSIRT advisory FG-IR-26-163, revised 2026-08-19, covers CVE-2026-49975, a memory allocation with excessive size value flaw (HTTP/2 bomb) in Apache HTTP Server's mod_http2, scored CVSSv3 5.8. Malicious HTTP requests can cause a denial of service, and affected versions span Apache HTTP Server 2.4.17 through 2.4.67. The advisory text does not state which Fortinet product bundles the affected Apache component or whether exploitation has been observed.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026AdvisoryCVE-2026-49975

ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI advisory ZDI-26-669 details an out-of-bounds read (CVE-2026-81978) when Adobe Acrobat Reader DC parses JBIG2 files.

The Zero Day Initiative published advisory ZDI-26-669 for an out-of-bounds read triggered when Acrobat Reader DC parses JBIG2 files. Successful exploitation allows a remote attacker to disclose sensitive information from affected installations. User interaction is required, such as opening a malicious file or visiting a malicious page. ZDI rated the issue 3.3 and assigned CVE-2026-81978.

ZDI Published Advisories·Sep 10, 05:00 UTC · 6d agoAdvisory 19 sourcesCVE-2026-81978

wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)

Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371

thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program

The redirect CGI program shipped with thttpd v2.26 has a stack buffer overflow that unauthenticated attackers can trigger for crashes or possible code execution.

A stack-based buffer overflow exists in the redirect CGI program distributed with thttpd v2.26. Unsafe string concatenation when constructing redirect URLs from attacker-controlled CGI environment variables causes the overflow. A remote, unauthenticated attacker can trigger it via a crafted HTTP request, crashing the CGI process and causing denial of service. In environments lacking modern exploit mitigations, code execution may also be possible.

Full Disclosure·Sep 4, 00:13 UTC · 13d agoVulnerability

ZDI-26-562: (Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability

ZDI-26-562 details an unauthenticated, network-adjacent SSRF in the Home Assistant Green mDNS server, rated CVSS 5.4 and originally demonstrated at Pwn2Own.

A server-side request forgery in Home Assistant Green's mDNS service lets network-adjacent attackers initiate arbitrary server-side requests without authentication. The Zero Day Initiative assigned the flaw a CVSS 5.4 rating under advisory ZDI-26-562. The finding originated from Pwn2Own, and no exploitation in the wild is reported.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Vulnerability

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT

Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.

SOCRadar reports that exploitation of CVE-2025-25249 is being used to deploy PivotC2, a purpose-built post-exploitation RAT, on FortiGate firewall appliances. The attack follows the common pattern of compromising public-facing edge devices such as VPNs, routers, and firewalls as the initial entry point. Defenders running FortiGate appliances should prioritize patching and watch for post-exploitation activity indicating RAT deployment.

SOCRadar·Sep 8, 10:00 UTC · 8d agoExploit / PoC in the wildCVE-2025-25249

7th September – Threat Intelligence Report

Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.

Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.

Check Point Research·Sep 7, 14:54 UTC · 9d agoAdvisory in the wildCVE-2026-83548CVE-2026-83549CVE-2026-823291

CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

CVE-2026-75880: authenticated ActiveMQ Artemis clients can cause denial of service via crafted selector wildcard handling in affected versions.

An authenticated client can attach a consumer with a selector containing crafted wildcard usage, causing excessive evaluation during message delivery attempts that occupies a shared broker thread and leads to denial of service. Affected versions are Apache Artemis artemis-selector 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis artemis-selector 1.0.0 through 2.44.0. Apache rates the issue moderate.

oss-security·Sep 10, 00:49 UTC · 6d agoVulnerability 7 sourcesCVE-2026-758801

GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi

Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.

A vulnerability in Canonical's grub-efi-amd64-signed (gcdx64.efi, GRUB 2.14) exposes a serial command that accepts a caller-supplied 64-bit MMIO base address. The lockdown path does not restrict this command even when lockdown=y under UEFI Secure Boot, and the serial implementation does not validate that the requested register span belongs to a real UART rather than ordinary RAM. A local attacker with control of GRUB's boot configuration can abuse this to bypass the Secure Boot lockdown.

oss-security·Sep 13, 13:59 UTC · 3d agoVulnerability2

Heap overflow in kernel driver due to missing size validation

Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.

Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.

Fortinet PSIRT·Aug 12, 07:00 UTC · Aug 12, 2026Advisory

**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

Tozed ZLT X300 5G CPE firmware 6.01.3 has an unauthenticated TR-069 command injection (CVE-2026-2035703, CVSS 9.8) enabling root code execution.

Tozed ZLT X300 5G CPE router firmware 6.01.3 contains an OS command injection (CWE-78) in the TR-069/CWMP client daemon netcwmpd, tracked as CVE-2026-2035703 with CVSS 9.8. The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, and the resulting shell command executes via system_by_root() as root. An attacker operating a rogue LTE base station built from roughly $300 of SDR hardware can impersonate the carrier's Auto Configuration Server and inject arbitrary commands. The disclosure does not report any observed exploitation.

Full Disclosure·Sep 8, 17:30 UTC · 8d agoVulnerabilityCVE-2026-2035703

[remote] PCMan 2.0.7 - Buffer Overflow

A remote buffer overflow in PCMan 2.0.7 has a public proof-of-concept exploit published on Exploit-DB.

Exploit-DB listing 52657 discloses a remote buffer overflow vulnerability in PCMan version 2.0.7. A proof-of-concept exploit is publicly available, allowing attackers to potentially crash or compromise affected instances. The listing includes no CVE identifier and reports no observed exploitation in the wild.

Exploit-DB·Aug 18, 00:00 UTC · Aug 18, 2026Exploit / PoC1

CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.

A stack-based buffer overflow was identified in GNU libextractor's OLE2 plugin in versions prior to 1.15, assigned CVE-2026-91752. The flaw resides in the process_star_office function, which sizes a variable-length stack array using attacker-controlled OLE2 stream data. Attackers can craft malicious OLE2/StarOffice files to trigger the overflow. The issue was disclosed on the oss-security mailing list by researcher Haitam Lazaar on September 16, 2026.

oss-security·Sep 16, 23:13 UTC · 1h agoVulnerability 2 sourcesCVE-2026-91752

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-security·Sep 4, 21:23 UTC · 12d agoVulnerability

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm Center·Sep 16, 18:44 UTC · 5h agoExploit / PoC

CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.

CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.

oss-security·Sep 14, 15:07 UTC · 2d agoVulnerabilityCVE-2026-68570

$536 and 8 Hours: AI Learns to Attack a Different PLC

Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.

Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.

Security Affairs·Sep 2, 13:50 UTC · 14d agoResearchCVE-2021-318861

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News·Sep 2, 07:47 UTC · 14d agoResearchCVE-2021-318862

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published Advisories·Aug 31, 05:00 UTC · 16d agoAdvisory

PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

PostgreSQL flaw CVE-2026-6471, present since 2014, lets low-privilege replication accounts execute code and take over database servers; patches released.

Cyera researchers disclosed PostGREShell (CVE-2026-6471, CVSS 7.2), a missing-authorization bug in PostgreSQL logical decoding that lets users with REPLICATION privilege dlopen arbitrary files and execute code as the server account. The flaw affects PostgreSQL 9.4 through 18 and can yield privilege escalation, permanent superuser access and persistent backdoors on Windows, Linux and macOS. Fixes are available in versions 18.6, 17.11, 16.15, 15.19 and 14.24. Defenders should update and remove unnecessary Replication privileges.

Security Affairs·Sep 4, 13:41 UTC · 12d agoVulnerabilityCVE-2026-64711

ZDI-26-615: (0Day) pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Zero Day Initiative disclosed an uncontrolled search path flaw in pdfforge PDF Architect's update service, allowing local privilege escalation (CVSS 7.8).

ZDI published advisory ZDI-26-615 describing a local privilege escalation vulnerability in the activation-service Update Service of pdfforge PDF Architect. An uncontrolled search path element lets local attackers escalate privileges, but they must first be able to execute low-privileged code on the target. ZDI rated the issue 7.8 and tagged it as a 0-day disclosure.

ZDI Published Advisories·Aug 31, 05:00 UTC · 16d agoVulnerability

CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.

CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.

oss-security·Sep 14, 15:09 UTC · 2d agoVulnerabilityCVE-2026-725241