60
60
[local] Microsoft Edge 150.0.4078.48 - RCE
Exploit-DB publishes a local remote code execution exploit for Microsoft Edge 150.0.4078.48.
A public exploit demonstrates remote code execution in Microsoft Edge version 150.0.4078.48, listed under the local category on Exploit-DB. Successful exploitation could allow arbitrary code execution in the context of the browser. Users should update to the latest patched Edge release.
38
60
60
60
60
60
50
63 New Flaws (Including 0
60
Google fixes Chrome zero day exploited in the wild (CVE-2023-6345)
60
60
60
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
78
60
60
Microsoft fixes 6 zero-days under active attack
60
60
60
Decline in Rig Exploit Kit
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.
15
60
60
60
60
60
August 2018 Microsoft Patch Tuesday fixes two flaws exploited in attacks in the wild
60
May 2018 Patch Tuesday: Microsoft fixes 2 zero-day flaws reportedly exploited by APT group
60
Microsoft Patch Tuesday fixes three flaws actively exploited in attacks in the wild
60
Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.
90
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [3 February]
60
60
60
60
60
60
Microsoft Patches 5 Zero-Day Vulnerabilities Being Exploited in the Wild
60
60
January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE
60
March 2021 Patch Tuesday: Microsoft fixes yet another actively exploited IE zero-day
60
60